analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

о заказе.msg

Full analysis: https://app.any.run/tasks/f7a2f3f0-2b77-4e4b-991f-a584258894d3
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Analysis date: September 19, 2019, 06:50:33
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
loader
ransomware
troldesh
shade
Indicators:
MIME: application/vnd.ms-outlook
File info: CDFV2 Microsoft Outlook Message
MD5:

92E33D6457DACDF7C0D480344EA54756

SHA1:

E39C70D10F5F8BE47B3845967A21E93F7C03CE51

SHA256:

374B136CC88444C6FA7859CDE8952376FFFC6BCA0CA3CF8310097CE9C31F449A

SSDEEP:

192:OikMUVjDsKspsKKuIduquRzutFu+dq0j4LI7Txu2p+MKW:OlMUVjDsKspsKsdq0j8iT82pIW

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Unusual execution from Microsoft Office

      • OUTLOOK.EXE (PID: 3500)
    • Application was dropped or rewritten from another process

      • rad33067.tmp (PID: 3132)
      • rad33067.tmp (PID: 1456)
    • Downloads executable files from the Internet

      • WScript.exe (PID: 3096)
    • Changes the autorun value in the registry

      • rad33067.tmp (PID: 1456)
    • TROLDESH was detected

      • rad33067.tmp (PID: 1456)
  • SUSPICIOUS

    • Creates files in the user directory

      • OUTLOOK.EXE (PID: 3500)
      • WScript.exe (PID: 3096)
    • Reads Internet Cache Settings

      • OUTLOOK.EXE (PID: 3500)
    • Starts Internet Explorer

      • OUTLOOK.EXE (PID: 3500)
    • Executes scripts

      • WinRAR.exe (PID: 2948)
    • Starts application with an unusual extension

      • cmd.exe (PID: 3004)
      • rad33067.tmp (PID: 3132)
    • Starts CMD.EXE for commands execution

      • WScript.exe (PID: 3096)
    • Executable content was dropped or overwritten

      • WScript.exe (PID: 3096)
      • rad33067.tmp (PID: 1456)
    • Creates files in the program directory

      • rad33067.tmp (PID: 1456)
    • Application launched itself

      • rad33067.tmp (PID: 3132)
  • INFO

    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 3500)
    • Application launched itself

      • iexplore.exe (PID: 2868)
    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3580)
      • iexplore.exe (PID: 2868)
    • Reads settings of System Certificates

      • iexplore.exe (PID: 2868)
    • Changes internet zones settings

      • iexplore.exe (PID: 2868)
    • Manual execution by user

      • WinRAR.exe (PID: 2948)
    • Application was crashed

      • rad33067.tmp (PID: 1456)
    • Dropped object may contain Bitcoin addresses

      • rad33067.tmp (PID: 1456)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msg | Outlook Message (58.9)
.oft | Outlook Form Template (34.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
47
Monitored processes
9
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start outlook.exe iexplore.exe iexplore.exe winrar.exe no specs winrar.exe no specs wscript.exe cmd.exe no specs rad33067.tmp no specs #TROLDESH rad33067.tmp

Process information

PID
CMD
Path
Indicators
Parent process
3500"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\о заказе.msg"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Version:
14.0.6025.1000
2868"C:\Program Files\Internet Explorer\iexplore.exe" http://waterlink-inc.com/wp-admin/css/colors/blue/doc/C:\Program Files\Internet Explorer\iexplore.exe
OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3580"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2868 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2996"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IJ31IR9\doc[1].zip"C:\Program Files\WinRAR\WinRAR.exeiexplore.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
2948"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\doc.rar"C:\Program Files\WinRAR\WinRAR.exeexplorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3096"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIa2948.42294\Информация о заказе.xls.js" C:\Windows\System32\WScript.exe
WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
3004"C:\Windows\System32\cmd.exe" /c C:\Users\admin\AppData\Local\Temp\rad33067.tmpC:\Windows\System32\cmd.exeWScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3132C:\Users\admin\AppData\Local\Temp\rad33067.tmpC:\Users\admin\AppData\Local\Temp\rad33067.tmpcmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
1456C:\Users\admin\AppData\Local\Temp\rad33067.tmpC:\Users\admin\AppData\Local\Temp\rad33067.tmp
rad33067.tmp
User:
admin
Integrity Level:
MEDIUM
Total events
2 863
Read events
2 341
Write events
0
Delete events
0

Modification events

No data
Executable files
3
Suspicious files
2
Text files
46
Unknown types
6

Dropped files

PID
Process
Filename
Type
3500OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVR9A7F.tmp.cvr
MD5:
SHA256:
2868iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\favicon[1].ico
MD5:
SHA256:
2868iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
MD5:
SHA256:
2868iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF461C1EE7EF2150DE.TMP
MD5:
SHA256:
3500OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:B7BA83B0DC03567346FF2F58C0EAEC11
SHA256:793E95AED377B1881D6976B73A9B41BE2BD049B7924FE3A4A02A74F64F7CC025
2868iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{E735CB06-DAA9-11E9-B86F-5254004A04AF}.datbinary
MD5:32480656FFF232742184E8D43238E1FF
SHA256:AB19A027A36E0038DEC5537F448AB0C1112642A02D02B9418A83D8F5EE457738
3580iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.datdat
MD5:00E0360B1849C6C140EDC1A1CD6FA15D
SHA256:FBBBD569154A10136F7453D0CDFBC712EF6B418CE9954F508A94FFFF50B529F5
3500OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_Calendar_2_9C45400B77B94D4FBA6E1028C5E9A806.datxml
MD5:B21ED3BD946332FF6EBC41A87776C6BB
SHA256:B1AAC4E817CD10670B785EF8E5523C4A883F44138E50486987DC73054A46F6F4
2868iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFF63DE2F07EB547AD.TMP
MD5:
SHA256:
3500OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_AvailabilityOptions_2_09585F31F5400C45824ED2C27E0E040A.datxml
MD5:EEAA832C12F20DE6AAAA9C7B77626E72
SHA256:C4C9A90F2C961D9EE79CF08FBEE647ED7DE0202288E876C7BAAD00F4CA29CA16
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
9
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3500
OUTLOOK.EXE
GET
64.4.26.155:80
http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig
US
whitelisted
3096
WScript.exe
GET
200
193.9.21.67:80
http://solvo.si/wp-content/themes/twentyseventeen/assets/css/2c.jpg
SI
executable
1022 Kb
malicious
3580
iexplore.exe
GET
200
132.148.98.116:80
http://waterlink-inc.com/wp-admin/css/colors/blue/doc/
US
compressed
12.2 Kb
malicious
2868
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3580
iexplore.exe
132.148.98.116:80
waterlink-inc.com
GoDaddy.com, LLC
US
malicious
3096
WScript.exe
193.9.21.67:80
solvo.si
Optimus IT d.o.o.
SI
malicious
1456
rad33067.tmp
171.25.193.9:80
Foreningen for digitala fri- och rattigheter
SE
malicious
3500
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
Microsoft Corporation
US
whitelisted
2868
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
1456
rad33067.tmp
86.59.21.38:443
Tele2 Telecommunication GmbH
AT
malicious
1456
rad33067.tmp
213.141.138.174:9001
Net By Net Holding LLC
RU
suspicious
1456
rad33067.tmp
83.86.195.126:443
Ziggo
NL
suspicious
1456
rad33067.tmp
172.107.96.70:443
Psychz Networks
US
suspicious

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
waterlink-inc.com
  • 132.148.98.116
malicious
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
solvo.si
  • 193.9.21.67
unknown

Threats

PID
Process
Class
Message
3096
WScript.exe
A Network Trojan was detected
ET CURRENT_EVENTS Likely Evil EXE download from MSXMLHTTP non-exe extension M2
3096
WScript.exe
A Network Trojan was detected
ET TROJAN JS/WSF Downloader Dec 08 2016 M4
3096
WScript.exe
Misc activity
SUSPICIOUS [PTsecurity] PE as Image Content type mismatch
1456
rad33067.tmp
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 180
1456
rad33067.tmp
Misc activity
ET POLICY TLS possible TOR SSL traffic
1456
rad33067.tmp
Potential Corporate Privacy Violation
POLICY [PTsecurity] TOR SSL connection
1456
rad33067.tmp
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 643
1456
rad33067.tmp
Potential Corporate Privacy Violation
POLICY [PTsecurity] TOR SSL connection
1456
rad33067.tmp
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 183
1456
rad33067.tmp
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 342
2 ETPRO signatures available at the full report
No debug info