analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
download:

qwerty.ps1

Full analysis: https://app.any.run/tasks/39d9bbc2-d540-4bf6-a526-f0ab5a0b2590
Verdict: Malicious activity
Threats:

AZORult can steal banking information, including passwords and credit card details, as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat.

Analysis date: February 18, 2019, 19:59:06
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
rat
azorult
ransomware
gandcrab
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines
MD5:

2A38A8189A48B26EE932B937A8AFE529

SHA1:

08331A029132D44BAD08345751DEFA276B674520

SHA256:

44210681FA26A0DB1BC0E5FBCCBAA979B2A03C5AC6C4919D8E2EBD34486DFDCE

SSDEEP:

12288:/+4cJ4QK3tJMCiY7XKD+NZQkhuMW4mPpXx+dtxc:9cJ47tpdu+sH1A/xc

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • ajxn.exe (PID: 1380)
      • ajxn.exe (PID: 3016)
      • ajxn.exe (PID: 2476)
    • AZORULT was detected

      • ajxn.exe (PID: 3016)
    • Connects to CnC server

      • ajxn.exe (PID: 3016)
      • ajxn.exe (PID: 1380)
    • Actions looks like stealing of personal data

      • ajxn.exe (PID: 3016)
      • ajxn.exe (PID: 1380)
    • GandCrab keys found

      • ajxn.exe (PID: 1380)
    • Loads dropped or rewritten executable

      • ajxn.exe (PID: 3016)
    • Writes file to Word startup folder

      • ajxn.exe (PID: 1380)
    • Deletes shadow copies

      • ajxn.exe (PID: 1380)
    • Changes settings of System certificates

      • ajxn.exe (PID: 1380)
    • Dropped file may contain instructions of ransomware

      • ajxn.exe (PID: 1380)
    • Renames files like Ransomware

      • ajxn.exe (PID: 1380)
  • SUSPICIOUS

    • Application launched itself

      • ajxn.exe (PID: 2476)
    • Executable content was dropped or overwritten

      • powershell.exe (PID: 2852)
      • ajxn.exe (PID: 3016)
    • Creates files in the user directory

      • powershell.exe (PID: 2852)
      • ajxn.exe (PID: 3016)
      • ajxn.exe (PID: 1380)
    • Reads the cookies of Mozilla Firefox

      • ajxn.exe (PID: 3016)
      • ajxn.exe (PID: 1380)
    • Reads the cookies of Google Chrome

      • ajxn.exe (PID: 3016)
    • Creates files in the program directory

      • ajxn.exe (PID: 1380)
    • Creates files like Ransomware instruction

      • ajxn.exe (PID: 1380)
    • Adds / modifies Windows certificates

      • ajxn.exe (PID: 1380)
    • Reads Internet Cache Settings

      • ajxn.exe (PID: 1380)
  • INFO

    • Dropped object may contain TOR URL's

      • ajxn.exe (PID: 1380)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
6
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start powershell.exe ajxn.exe no specs #AZORULT ajxn.exe #GANDCRAB ajxn.exe wmic.exe vssvc.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2852"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "-file" "C:\Users\admin\AppData\Local\Temp\qwerty.ps1"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2476"C:\Users\Public\ajxn.exe"C:\Users\Public\ajxn.exepowershell.exe
User:
admin
Integrity Level:
MEDIUM
Description:
chiromancy
Exit code:
0
Version:
1.09.0001
3016C:\Users\Public\ajxn.exe"C:\Users\Public\ajxn.exe
ajxn.exe
User:
admin
Integrity Level:
MEDIUM
Description:
chiromancy
Version:
1.09.0001
1380C:\Users\Public\ajxn.exe"C:\Users\Public\ajxn.exe
ajxn.exe
User:
admin
Integrity Level:
MEDIUM
Description:
chiromancy
Version:
1.09.0001
884"C:\Windows\system32\wbem\wmic.exe" shadowcopy deleteC:\Windows\system32\wbem\wmic.exe
ajxn.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
WMI Commandline Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2932C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exeservices.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
409
Read events
310
Write events
0
Delete events
0

Modification events

No data
Executable files
49
Suspicious files
428
Text files
318
Unknown types
13

Dropped files

PID
Process
Filename
Type
2852powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\3FV7D4V0ZM7VCWAM0ENP.temp
MD5:
SHA256:
2852powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF198756.TMPbinary
MD5:901ECDF767744E6BB59CB023757886E3
SHA256:48A990A7B1201BFD70F417698302A6299D036A6574E558A96000AF48469479E1
2852powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:901ECDF767744E6BB59CB023757886E3
SHA256:48A990A7B1201BFD70F417698302A6299D036A6574E558A96000AF48469479E1
2476ajxn.exeC:\Users\admin\AppData\Local\Temp\~DF068A8C1CF5B7DBA1.TMPbinary
MD5:BBF514ACFBD61D697C5E7114E513616A
SHA256:9354ADF788F72A0E0D873091C6B061200B58C939FB002801DF2E369F78D9AFDC
2852powershell.exeC:\Users\Public\ajxn.exeexecutable
MD5:68F81C8661C6466621CEFE3AAC8070EA
SHA256:54F8C8FD97967B329DE39FCD9FD262C30E945BA838DBCDA301DCFA1096CBE169
3016ajxn.exeC:\Users\admin\AppData\Local\Temp\9622D276\api-ms-win-core-errorhandling-l1-1-0.dllexecutable
MD5:6D778E83F74A4C7FE4C077DC279F6867
SHA256:A97DCCA76CDB12E985DFF71040815F28508C655AB2B073512E386DD63F4DA325
3016ajxn.exeC:\Users\admin\AppData\Local\Temp\9622D276\api-ms-win-core-datetime-l1-1-0.dllexecutable
MD5:CB978304B79EF53962408C611DFB20F5
SHA256:90FAE0E7C3644A6754833C42B0AC39B6F23859F9A7CF4B6C8624820F59B9DAD3
3016ajxn.exeC:\Users\admin\AppData\Local\Temp\9622D276\api-ms-win-core-debug-l1-1-0.dllexecutable
MD5:88FF191FD8648099592ED28EE6C442A5
SHA256:C310CC91464C9431AB0902A561AF947FA5C973925FF70482D3DE017ED3F73B7D
3016ajxn.exeC:\Users\admin\AppData\Local\Temp\9622D276\api-ms-win-core-localization-l1-2-0.dllexecutable
MD5:EFF11130BFE0D9C90C0026BF2FB219AE
SHA256:03AD57C24FF2CF895B5F533F0ECBD10266FD8634C6B9053CC9CB33B814AD5D97
3016ajxn.exeC:\Users\admin\AppData\Local\Temp\9622D276\api-ms-win-core-file-l1-1-0.dllexecutable
MD5:94AE25C7A5497CA0BE6882A00644CA64
SHA256:7EA06B7050F9EA2BCC12AF34374BDF1173646D4E5EBF66AD690B37F4DF5F3D4E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
4
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3016
ajxn.exe
POST
188.225.58.33:80
http://dsdfgdfsdegdf.ru/index.php
RU
malicious
1380
ajxn.exe
GET
301
185.52.2.154:80
http://www.kakaocorp.link/
NL
html
162 b
malicious
3016
ajxn.exe
POST
200
188.225.58.33:80
http://dsdfgdfsdegdf.ru/index.php
RU
binary
4.27 Mb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1380
ajxn.exe
185.52.2.154:443
www.kakaocorp.link
RouteLabel V.O.F.
NL
suspicious
3016
ajxn.exe
188.225.58.33:80
dsdfgdfsdegdf.ru
TimeWeb Ltd.
RU
suspicious
1380
ajxn.exe
185.52.2.154:80
www.kakaocorp.link
RouteLabel V.O.F.
NL
suspicious

DNS requests

Domain
IP
Reputation
dsdfgdfsdegdf.ru
  • 188.225.58.33
  • 77.221.146.5
  • 185.62.103.173
malicious
www.kakaocorp.link
  • 185.52.2.154
malicious

Threats

PID
Process
Class
Message
3016
ajxn.exe
A Network Trojan was detected
MALWARE [PTsecurity] AZORult HTTP Header
3016
ajxn.exe
A Network Trojan was detected
MALWARE [PTsecurity] AZORult Request
3016
ajxn.exe
A Network Trojan was detected
MALWARE [PTsecurity] AZORult Response
3016
ajxn.exe
A Network Trojan was detected
MALWARE [PTsecurity] AZORult HTTP Header
3016
ajxn.exe
A Network Trojan was detected
ET TROJAN Generic - POST To .php w/Extended ASCII Characters (Likely Zeus Derivative)
1380
ajxn.exe
A Network Trojan was detected
MALWARE [PTsecurity] Blacklisted GandCrab Ransomware C2 Server
1380
ajxn.exe
A Network Trojan was detected
MALWARE [PTsecurity] Blacklisted GandCrab Ransomware C2 Server
1380
ajxn.exe
A Network Trojan was detected
MALWARE [PTsecurity] GandCrab v.5 SSL Connection
3 ETPRO signatures available at the full report
No debug info