File name:

Delivery_Notification_00000126783.doc.wsf

Full analysis: https://app.any.run/tasks/f196e488-105f-4133-aafb-0142071949eb
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: February 25, 2019, 14:49:15
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
nemucod
loader
ransomware
kovter
Indicators:
MIME: text/html
File info: HTML document, ASCII text, with very long lines, with no line terminators
MD5:

1CC1132E8997AE16CBC75B3EC1F3187D

SHA1:

4CF071A3E6F1B4AB80CBF49532E68FA1430C201F

SHA256:

35E4CED515B33A2A68C391D2D63C36B236B35E7E2230169FCBAC0DD778D409C8

SSDEEP:

96:mCrOBaGZXa3lkGRt4Q+dNgEUbOqrkvwF29jt9vPhznJ2sUrI4px:mCWXWlhRuQuNgDmIF29PtJJX0x

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • a2.exe (PID: 3452)
      • a1.exe (PID: 2964)
      • a.exe (PID: 2392)
      • a2.exe (PID: 2324)
      • a1.exe (PID: 2564)

    • Loads dropped or rewritten executable

      • a2.exe (PID: 3452)
      • a.exe (PID: 2392)

    • Downloads executable files from the Internet

      • WScript.exe (PID: 2944)

    • NEMUCOD was detected

      • WScript.exe (PID: 2944)

    • Dropped file may contain instructions of ransomware

      • cmd.exe (PID: 3212)

    • Changes the autorun value in the registry

      • reg.exe (PID: 2056)
      • regsvr32.exe (PID: 2588)

    • Executes PowerShell scripts

      • mshta.exe (PID: 2344)

    • Changes internet zones settings

      • regsvr32.exe (PID: 2588)

    • Renames files like Ransomware

      • a.exe (PID: 2392)

    • Writes to a start menu file

      • regsvr32.exe (PID: 2588)

    • Registers / Runs the DLL via REGSVR32.EXE

      • powershell.exe (PID: 2280)
      • regsvr32.exe (PID: 2588)

    • Connects to CnC server

      • regsvr32.exe (PID: 2588)

    • KOVTER was detected

      • regsvr32.exe (PID: 2588)

  • SUSPICIOUS

    • Creates files in the user directory

      • WScript.exe (PID: 2944)
      • powershell.exe (PID: 2280)
      • regsvr32.exe (PID: 2588)

    • Executable content was dropped or overwritten

      • a2.exe (PID: 3452)
      • WScript.exe (PID: 2944)

    • Starts CMD.EXE for commands execution

      • WScript.exe (PID: 2944)

    • Uses REG.EXE to modify Windows registry

      • cmd.exe (PID: 2680)
      • cmd.exe (PID: 2940)
      • cmd.exe (PID: 588)

    • Creates files like Ransomware instruction

      • cmd.exe (PID: 3212)

    • Application launched itself

      • a1.exe (PID: 2964)
      • a2.exe (PID: 3452)
      • regsvr32.exe (PID: 2588)

    • Connects to server without host name

      • regsvr32.exe (PID: 2588)

    • Modifies the open verb of a shell class

      • regsvr32.exe (PID: 2588)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • cmd.exe (PID: 3212)
      • WScript.exe (PID: 2944)

    • Reads internet explorer settings

      • mshta.exe (PID: 2344)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
66
Monitored processes
24
Malicious processes
6
Suspicious processes
3

Behavior graph

Click at the process to see the details
drop and start drop and start start #NEMUCOD wscript.exe a1.exe no specs a2.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs reg.exe reg.exe no specs reg.exe no specs a.exe no specs a1.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs notepad.exe no specs a2.exe no specs mshta.exe no specs powershell.exe no specs #KOVTER regsvr32.exe regsvr32.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
588"C:\Windows\system32\cmd.exe" /c REG ADD "HKCR\.crypted" /ve /t REG_SZ /F /D "Crypted"C:\Windows\system32\cmd.exe—WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2056REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Crypted" /t REG_SZ /F /D "C:\Users\admin\AppData\Local\Temp\a.txt"C:\Windows\system32\reg.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2232notepad.exe "C:\Users\admin\AppData\Local\Temp\a.txt"C:\Windows\system32\notepad.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2280"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iex $env:otyjC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2324"C:\Users\admin\AppData\Local\Temp\a2.exe" C:\Users\admin\AppData\Local\Temp\a2.exe—a2.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\a2.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
2344"C:\Windows\system32\mshta.exe" javascript:zkCD2p5vy="oqzqmy";cE6=new%20ActiveXObject("WScript.Shell");izh8UMN="PwFCYJ";qIG5h=cE6.RegRead("HKCU\\software\\W6s5zY0G\\rJ20nB9Y");krB7BJ="FK0kFPVR";eval(qIG5h);bNn5DI="S";C:\Windows\system32\mshta.exe—wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\mshta.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\mshtml.dll
c:\windows\system32\psapi.dll
2392C:\Users\admin\AppData\Local\Temp\a.exe "C:\Users\admin\AppData\Local\Temp\a.php"C:\Users\admin\AppData\Local\Temp\a.exe—cmd.exe
User:
admin
Company:
The PHP Group
Integrity Level:
MEDIUM
Description:
PHP Script Interpreter
Exit code:
0
Version:
4.4.9.9
Modules
Images
c:\users\admin\appdata\local\temp\a.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\temp\php4ts.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2408"C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe—regsvr32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2564"C:\Users\admin\AppData\Local\Temp\a1.exe" C:\Users\admin\AppData\Local\Temp\a1.exe—a1.exe
User:
admin
Company:
FlashMod inc.
Integrity Level:
MEDIUM
Description:
Our motto "Endo - Easy - Efficient" is the result of over 100 years' experience in providing dentists with endodontic products. VDW offers high quality, innovative ...
Exit code:
0
Version:
1.00.0168
Modules
Images
c:\users\admin\appdata\local\temp\a1.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2588regsvr32.exeC:\Windows\system32\regsvr32.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
1 641
Read events
1 517
Write events
123
Delete events
1

Modification events

(PID) Process:(2944) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WScript_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2944) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WScript_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2944) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WScript_RASAPI32
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(2944) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WScript_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
4294901760
(PID) Process:(2944) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WScript_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(2944) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WScript_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(2944) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WScript_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2944) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WScript_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2944) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WScript_RASMANCS
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(2944) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WScript_RASMANCS
Operation:writeName:ConsoleTracingMask
Value:
4294901760
Executable files
9
Suspicious files
32
Text files
21
Unknown types
4

Dropped files

PID
Process
Filename
Type
2944WScript.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\d[1].pngexecutable
MD5:—
SHA256:—
2944WScript.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\35f2769bed5e37[1].pngexecutable
MD5:—
SHA256:—
2944WScript.exeC:\Users\admin\AppData\Local\Temp\a1.exeexecutable
MD5:—
SHA256:—
3452a2.exeC:\Users\admin\AppData\Local\Temp\wordpress-hostinghtml
MD5:—
SHA256:—
2944WScript.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D2YPIJ90\666f05a[1].pngexecutable
MD5:—
SHA256:—
3452a2.exeC:\Users\admin\AppData\Local\Temp\feed212565215.rss+xmlxml
MD5:—
SHA256:—
2944WScript.exeC:\Users\admin\AppData\Local\Temp\a2.exeexecutable
MD5:—
SHA256:—
3452a2.exeC:\Users\admin\AppData\Local\Temp\home1496213447.htmlhtml
MD5:—
SHA256:—
2944WScript.exeC:\Users\admin\AppData\Local\Temp\a.exeexecutable
MD5:—
SHA256:—
3452a2.exeC:\Users\admin\AppData\Local\Temp\public363103015.csstext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
59
DNS requests
1
Threats
52

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2944
WScript.exe
GET
200
217.97.216.17:80
http://kppspgrojec.internetdsl.pl/counter/?ad=13TsQUPWC4BsQfc7GPPmtx4RZyz6iSM5GC&id=rZUH9RUqgN7qAPNhizR6ft3c_43tJzJDAPXwSwjwfjXd4fmZJ6WQyI91hPn7ExxXkJjKH2oSdEsNaxI&rnd=05
PL
text
3.07 Kb
malicious
2588
regsvr32.exe
POST
—
200.9.23.235:80
http://200.9.23.235/
BR
—
—
malicious
2944
WScript.exe
GET
200
217.97.216.17:80
http://kppspgrojec.internetdsl.pl/counter/?ad=13TsQUPWC4BsQfc7GPPmtx4RZyz6iSM5GC&id=rZUH9RUqgN7qAPNhizR6ft3c_43tJzJDAPXwSwjwfjXd4fmZJ6WQyI91hPn7ExxXkJjKH2oSdEsNaxI&rnd=03
PL
executable
44.0 Kb
malicious
2944
WScript.exe
GET
200
217.97.216.17:80
http://kppspgrojec.internetdsl.pl/counter/?ad=13TsQUPWC4BsQfc7GPPmtx4RZyz6iSM5GC&id=rZUH9RUqgN7qAPNhizR6ft3c_43tJzJDAPXwSwjwfjXd4fmZJ6WQyI91hPn7ExxXkJjKH2oSdEsNaxI&rnd=02
PL
executable
176 Kb
malicious
2588
regsvr32.exe
POST
—
200.9.23.235:80
http://200.9.23.235/
BR
—
—
malicious
2588
regsvr32.exe
POST
—
200.9.23.235:80
http://200.9.23.235/
BR
—
—
malicious
2944
WScript.exe
GET
200
217.97.216.17:80
http://kppspgrojec.internetdsl.pl/counter/?ad=13TsQUPWC4BsQfc7GPPmtx4RZyz6iSM5GC&id=rZUH9RUqgN7qAPNhizR6ft3c_43tJzJDAPXwSwjwfjXd4fmZJ6WQyI91hPn7ExxXkJjKH2oSdEsNaxI&rnd=04
PL
executable
1.35 Mb
malicious
2588
regsvr32.exe
POST
—
200.9.23.235:80
http://200.9.23.235/
BR
—
—
malicious
2944
WScript.exe
GET
200
217.97.216.17:80
http://kppspgrojec.internetdsl.pl/counter/?ad=13TsQUPWC4BsQfc7GPPmtx4RZyz6iSM5GC&id=rZUH9RUqgN7qAPNhizR6ft3c_43tJzJDAPXwSwjwfjXd4fmZJ6WQyI91hPn7ExxXkJjKH2oSdEsNaxI&rnd=01
PL
executable
286 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2588
regsvr32.exe
4.49.142.40:443
—
Level 3 Communications, Inc.
US
malicious
2588
regsvr32.exe
72.44.146.148:80
—
ATX Telecommunications Services
US
unknown
2588
regsvr32.exe
71.31.208.29:80
—
Windstream Communications Inc
US
unknown
2944
WScript.exe
217.97.216.17:80
kppspgrojec.internetdsl.pl
Orange Polska Spolka Akcyjna
PL
malicious
2588
regsvr32.exe
114.234.65.223:80
—
No.31,Jin-rong Street
CN
unknown
2588
regsvr32.exe
145.76.102.128:80
—
SURFnet bv
NL
unknown
2588
regsvr32.exe
23.56.40.226:80
—
Akamai International B.V.
NL
whitelisted
2588
regsvr32.exe
203.198.92.24:80
—
PCCW Limited
HK
unknown
2588
regsvr32.exe
5.195.175.63:80
—
Emirates Telecommunications Corporation
AE
unknown
2588
regsvr32.exe
25.234.107.31:80
—
—
GB
unknown

DNS requests

Domain
IP
Reputation
kppspgrojec.internetdsl.pl
  • 217.97.216.17
malicious

Threats

PID
Process
Class
Message
2944
WScript.exe
A Network Trojan was detected
ET TROJAN JS/Nemucod requesting EXE payload 2016-03-31
2944
WScript.exe
A Network Trojan was detected
ET TROJAN WS/JS Downloader Mar 07 2017 M1
2944
WScript.exe
Misc activity
SUSPICIOUS [PTsecurity] Cmd.Powershell.Download HTTP UserAgent (Win7)
2944
WScript.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2944
WScript.exe
A Network Trojan was detected
ET TROJAN JS/Nemucod.M.gen downloading EXE payload
2944
WScript.exe
A Network Trojan was detected
ET CURRENT_EVENTS Likely Evil EXE download from MSXMLHTTP non-exe extension M2
2944
WScript.exe
A Network Trojan was detected
ET TROJAN JS/WSF Downloader Dec 08 2016 M3
2944
WScript.exe
A Network Trojan was detected
ET TROJAN JS/WSF Downloader Dec 08 2016 M4
2944
WScript.exe
Misc activity
ET INFO EXE - Served Attached HTTP
2944
WScript.exe
Misc activity
SUSPICIOUS [PTsecurity] PE as Image Content type mismatch
3 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Delivery_Notification_00000126783.doc.wsf