analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
download:

qwerty.ps1

Full analysis: https://app.any.run/tasks/dcc7bbba-97f7-478f-971f-665b08df0929
Verdict: Malicious activity
Threats:

AZORult can steal banking information, including passwords and credit card details, as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat.

Malware Trends Tracker     >>>
Analysis date: February 18, 2019, 20:19:57
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
rat
azorult
ransomware
gandcrab
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines
MD5:

2A38A8189A48B26EE932B937A8AFE529

SHA1:

08331A029132D44BAD08345751DEFA276B674520

SHA256:

44210681FA26A0DB1BC0E5FBCCBAA979B2A03C5AC6C4919D8E2EBD34486DFDCE

SSDEEP:

12288:/+4cJ4QK3tJMCiY7XKD+NZQkhuMW4mPpXx+dtxc:9cJ47tpdu+sH1A/xc

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • hgsw.exe (PID: 3596)
      • hgsw.exe (PID: 3672)
      • hgsw.exe (PID: 2456)
      • hgsw.exe (PID: 2968)
      • hgsw.exe (PID: 3224)
      • hgsw.exe (PID: 2300)
      • hgsw.exe (PID: 2932)
      • hgsw.exe (PID: 2952)
      • hgsw.exe (PID: 2820)
      • hgsw.exe (PID: 2840)
      • hgsw.exe (PID: 3892)
      • hgsw.exe (PID: 2432)

    • AZORULT was detected

      • hgsw.exe (PID: 3596)
      • hgsw.exe (PID: 3892)
      • hgsw.exe (PID: 2840)

    • Connects to CnC server

      • hgsw.exe (PID: 3596)
      • hgsw.exe (PID: 2840)
      • hgsw.exe (PID: 3672)
      • hgsw.exe (PID: 3892)

    • GandCrab keys found

      • hgsw.exe (PID: 3672)

    • Writes file to Word startup folder

      • hgsw.exe (PID: 3672)

    • Deletes shadow copies

      • hgsw.exe (PID: 3672)

    • Actions looks like stealing of personal data

      • hgsw.exe (PID: 3672)

    • Renames files like Ransomware

      • hgsw.exe (PID: 3672)

    • Dropped file may contain instructions of ransomware

      • hgsw.exe (PID: 3672)

    • Changes settings of System certificates

      • hgsw.exe (PID: 3672)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 2960)

    • Creates files in the user directory

      • powershell.exe (PID: 2960)
      • hgsw.exe (PID: 3596)
      • hgsw.exe (PID: 3672)

    • Application launched itself

      • hgsw.exe (PID: 2456)
      • hgsw.exe (PID: 2968)
      • hgsw.exe (PID: 3224)
      • hgsw.exe (PID: 2300)

    • Creates files in the program directory

      • hgsw.exe (PID: 3672)

    • Reads the cookies of Mozilla Firefox

      • hgsw.exe (PID: 3672)

    • Reads Internet Cache Settings

      • hgsw.exe (PID: 3672)

    • Creates files like Ransomware instruction

      • hgsw.exe (PID: 3672)

    • Adds / modifies Windows certificates

      • hgsw.exe (PID: 3672)

  • INFO

    • Dropped object may contain TOR URL's

      • hgsw.exe (PID: 3672)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
57
Monitored processes
17
Malicious processes
9
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start powershell.exe hgsw.exe no specs #AZORULT hgsw.exe #GANDCRAB hgsw.exe explorer.exe no specs hgsw.exe no specs hgsw.exe no specs hgsw.exe no specs wmic.exe hgsw.exe no specs #AZORULT hgsw.exe hgsw.exe no specs hgsw.exe no specs #AZORULT hgsw.exe hgsw.exe no specs vssvc.exe no specs notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2960"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "-file" "C:\Users\admin\AppData\Local\Temp\qwerty.ps1"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2456"C:\Users\Public\hgsw.exe"C:\Users\Public\hgsw.exe—powershell.exe
User:
admin
Integrity Level:
MEDIUM
Description:
chiromancy
Exit code:
0
Version:
1.09.0001
3596C:\Users\Public\hgsw.exe"C:\Users\Public\hgsw.exe
hgsw.exe
User:
admin
Integrity Level:
MEDIUM
Description:
chiromancy
Exit code:
0
Version:
1.09.0001
3672C:\Users\Public\hgsw.exe"C:\Users\Public\hgsw.exe
hgsw.exe
User:
admin
Integrity Level:
MEDIUM
Description:
chiromancy
Version:
1.09.0001
3808"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2968"C:\Users\Public\hgsw.exe" C:\Users\Public\hgsw.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
chiromancy
Exit code:
0
Version:
1.09.0001
2300"C:\Users\Public\hgsw.exe" C:\Users\Public\hgsw.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
chiromancy
Exit code:
0
Version:
1.09.0001
3224"C:\Users\Public\hgsw.exe" C:\Users\Public\hgsw.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
chiromancy
Exit code:
0
Version:
1.09.0001
3940"C:\Windows\system32\wbem\wmic.exe" shadowcopy deleteC:\Windows\system32\wbem\wmic.exe
hgsw.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
WMI Commandline Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2820C:\Users\Public\hgsw.exe" C:\Users\Public\hgsw.exe—hgsw.exe
User:
admin
Integrity Level:
MEDIUM
Description:
chiromancy
Exit code:
0
Version:
1.09.0001
Total events
489
Read events
378
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
435
Text files
319
Unknown types
11

Dropped files

PID
Process
Filename
Type
2960powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\92LKEXTH6CK44CNHIBA0.temp —
MD5:—
SHA256:—
3672hgsw.exeC:\Recovery\345b46fe-a9f9-11e7-a83c-e8a4f72b1d33\boot.sdi —
MD5:—
SHA256:—
3672hgsw.exeC:\Recovery\345b46fe-a9f9-11e7-a83c-e8a4f72b1d33\Winre.wim —
MD5:—
SHA256:—
3672hgsw.exeC:\Recovery\345b46fe-a9f9-11e7-a83c-e8a4f72b1d33\Winre.wim.utnldcpjs —
MD5:—
SHA256:—
2960powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:6073B6FC66D2E68644893344F6904E4A
SHA256:0F2F61C8DFC3A20C7A5E5133C19BA1493441440E5477254273F28F6F668E64B3
3596hgsw.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\IETldCache\index.datdat
MD5:D7A950FEFD60DBAA01DF2D85FEFB3862
SHA256:75D0B1743F61B76A35B1FEDD32378837805DE58D79FA950CB6E8164BFA72073A
2960powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF246daf.TMPbinary
MD5:6073B6FC66D2E68644893344F6904E4A
SHA256:0F2F61C8DFC3A20C7A5E5133C19BA1493441440E5477254273F28F6F668E64B3
3672hgsw.exeC:\$Recycle.Bin\S-1-5-21-1302019708-1500728564-335382590-500\UTNLDCPJS-DECRYPT.txttext
MD5:6F8981CE932D23E4858C90CE3C2B0493
SHA256:D7A38967A206C3FF09DA1706A18D82ABC9EE85C19DB4D97F60779748CE9E6948
3672hgsw.exeC:\$Recycle.Bin\UTNLDCPJS-DECRYPT.txttext
MD5:6F8981CE932D23E4858C90CE3C2B0493
SHA256:D7A38967A206C3FF09DA1706A18D82ABC9EE85C19DB4D97F60779748CE9E6948
3672hgsw.exeC:\Recovery\UTNLDCPJS-DECRYPT.txttext
MD5:6F8981CE932D23E4858C90CE3C2B0493
SHA256:D7A38967A206C3FF09DA1706A18D82ABC9EE85C19DB4D97F60779748CE9E6948
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
5
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3596
hgsw.exe
POST
200
77.221.146.5:80
http://dsdfgdfsdegdf.ru/index.php
RU
text
4 b
malicious
3892
hgsw.exe
POST
200
77.221.146.5:80
http://dsdfgdfsdegdf.ru/index.php
RU
text
4 b
malicious
3672
hgsw.exe
GET
301
185.52.2.154:80
http://www.kakaocorp.link/
NL
html
162 b
malicious
2840
hgsw.exe
POST
200
77.221.146.5:80
http://dsdfgdfsdegdf.ru/index.php
RU
text
4 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2840
hgsw.exe
77.221.146.5:80
dsdfgdfsdegdf.ru
LeaseWeb Netherlands B.V.
RU
malicious
3672
hgsw.exe
185.52.2.154:80
www.kakaocorp.link
RouteLabel V.O.F.
NL
suspicious
3672
hgsw.exe
185.52.2.154:443
www.kakaocorp.link
RouteLabel V.O.F.
NL
suspicious
3596
hgsw.exe
77.221.146.5:80
dsdfgdfsdegdf.ru
LeaseWeb Netherlands B.V.
RU
malicious
3892
hgsw.exe
77.221.146.5:80
dsdfgdfsdegdf.ru
LeaseWeb Netherlands B.V.
RU
malicious

DNS requests

Domain
IP
Reputation
dsdfgdfsdegdf.ru
  • 77.221.146.5
  • 185.62.103.173
  • 188.225.58.33
malicious
www.kakaocorp.link
  • 185.52.2.154
malicious

Threats

PID
Process
Class
Message
3596
hgsw.exe
A Network Trojan was detected
MALWARE [PTsecurity] AZORult HTTP Header
3596
hgsw.exe
A Network Trojan was detected
MALWARE [PTsecurity] AZORult Request
3672
hgsw.exe
A Network Trojan was detected
MALWARE [PTsecurity] Blacklisted GandCrab Ransomware C2 Server
3672
hgsw.exe
A Network Trojan was detected
MALWARE [PTsecurity] Blacklisted GandCrab Ransomware C2 Server
3672
hgsw.exe
A Network Trojan was detected
MALWARE [PTsecurity] GandCrab v.5 SSL Connection
2840
hgsw.exe
A Network Trojan was detected
MALWARE [PTsecurity] AZORult HTTP Header
2840
hgsw.exe
A Network Trojan was detected
MALWARE [PTsecurity] AZORult Request
3892
hgsw.exe
A Network Trojan was detected
MALWARE [PTsecurity] AZORult HTTP Header
3892
hgsw.exe
A Network Trojan was detected
MALWARE [PTsecurity] AZORult Request
6 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
qwerty.ps1