| download: | qwerty.ps1 |
| Full analysis: | https://app.any.run/tasks/dcc7bbba-97f7-478f-971f-665b08df0929 |
| Verdict: | Malicious activity |
| Threats: | AZORult can steal banking information, including passwords and credit card details, as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat. |
| Analysis date: | February 18, 2019, 20:19:57 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | text/plain |
| File info: | ASCII text, with very long lines |
| MD5: | 2A38A8189A48B26EE932B937A8AFE529 |
| SHA1: | 08331A029132D44BAD08345751DEFA276B674520 |
| SHA256: | 44210681FA26A0DB1BC0E5FBCCBAA979B2A03C5AC6C4919D8E2EBD34486DFDCE |
| SSDEEP: | 12288:/+4cJ4QK3tJMCiY7XKD+NZQkhuMW4mPpXx+dtxc:9cJ47tpdu+sH1A/xc |
MALICIOUS
Application was dropped or rewritten from another process
- hgsw.exe (PID: 2456)
- hgsw.exe (PID: 3596)
- hgsw.exe (PID: 3672)
- hgsw.exe (PID: 2968)
- hgsw.exe (PID: 2300)
- hgsw.exe (PID: 3224)
- hgsw.exe (PID: 2932)
- hgsw.exe (PID: 2432)
- hgsw.exe (PID: 3892)
- hgsw.exe (PID: 2820)
- hgsw.exe (PID: 2952)
- hgsw.exe (PID: 2840)
AZORULT was detected
- hgsw.exe (PID: 3596)
- hgsw.exe (PID: 2840)
- hgsw.exe (PID: 3892)
GandCrab keys found
- hgsw.exe (PID: 3672)
Actions looks like stealing of personal data
- hgsw.exe (PID: 3672)
Writes file to Word startup folder
- hgsw.exe (PID: 3672)
Connects to CnC server
- hgsw.exe (PID: 3596)
- hgsw.exe (PID: 3672)
- hgsw.exe (PID: 2840)
- hgsw.exe (PID: 3892)
Renames files like Ransomware
- hgsw.exe (PID: 3672)
Deletes shadow copies
- hgsw.exe (PID: 3672)
Dropped file may contain instructions of ransomware
- hgsw.exe (PID: 3672)
Changes settings of System certificates
- hgsw.exe (PID: 3672)
SUSPICIOUS
Creates files in the program directory
- hgsw.exe (PID: 3672)
Creates files in the user directory
- powershell.exe (PID: 2960)
- hgsw.exe (PID: 3596)
- hgsw.exe (PID: 3672)
Executable content was dropped or overwritten
- powershell.exe (PID: 2960)
Application launched itself
- hgsw.exe (PID: 2456)
- hgsw.exe (PID: 2300)
- hgsw.exe (PID: 2968)
- hgsw.exe (PID: 3224)
Creates files like Ransomware instruction
- hgsw.exe (PID: 3672)
Reads the cookies of Mozilla Firefox
- hgsw.exe (PID: 3672)
Reads Internet Cache Settings
- hgsw.exe (PID: 3672)
Adds / modifies Windows certificates
- hgsw.exe (PID: 3672)
INFO
Dropped object may contain TOR URL's
- hgsw.exe (PID: 3672)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
57
Monitored processes
17
Malicious processes
9
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2196 | C:\Windows\system32\vssvc.exe | C:\Windows\system32\vssvc.exe | — | services.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft® Volume Shadow Copy Service Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2300 | "C:\Users\Public\hgsw.exe" | C:\Users\Public\hgsw.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: chiromancy Exit code: 0 Version: 1.09.0001 Modules
| |||||||||||||||
| 2432 | C:\Users\Public\hgsw.exe" | C:\Users\Public\hgsw.exe | — | hgsw.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: chiromancy Exit code: 0 Version: 1.09.0001 Modules
| |||||||||||||||
| 2456 | "C:\Users\Public\hgsw.exe" | C:\Users\Public\hgsw.exe | — | powershell.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: chiromancy Exit code: 0 Version: 1.09.0001 Modules
| |||||||||||||||
| 2756 | "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\UTNLDCPJS-DECRYPT.txt | C:\Windows\system32\NOTEPAD.EXE | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Notepad Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2820 | C:\Users\Public\hgsw.exe" | C:\Users\Public\hgsw.exe | — | hgsw.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: chiromancy Exit code: 0 Version: 1.09.0001 Modules
| |||||||||||||||
| 2840 | C:\Users\Public\hgsw.exe" | C:\Users\Public\hgsw.exe | hgsw.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: chiromancy Exit code: 0 Version: 1.09.0001 Modules
| |||||||||||||||
| 2932 | C:\Users\Public\hgsw.exe" | C:\Users\Public\hgsw.exe | — | hgsw.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: chiromancy Exit code: 0 Version: 1.09.0001 Modules
| |||||||||||||||
| 2952 | C:\Users\Public\hgsw.exe" | C:\Users\Public\hgsw.exe | — | hgsw.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: chiromancy Exit code: 0 Version: 1.09.0001 Modules
| |||||||||||||||
| 2960 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "-file" "C:\Users\admin\AppData\Local\Temp\qwerty.ps1" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
489
Read events
378
Write events
111
Delete events
0
Modification events
| (PID) Process: | (2960) powershell.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (2960) powershell.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
| (PID) Process: | (2960) powershell.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 1 | |||
| (PID) Process: | (3596) hgsw.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\hgsw_RASAPI32 |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (3596) hgsw.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\hgsw_RASAPI32 |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (3596) hgsw.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\hgsw_RASAPI32 |
| Operation: | write | Name: | FileTracingMask |
Value: 4294901760 | |||
| (PID) Process: | (3596) hgsw.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\hgsw_RASAPI32 |
| Operation: | write | Name: | ConsoleTracingMask |
Value: 4294901760 | |||
| (PID) Process: | (3596) hgsw.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\hgsw_RASAPI32 |
| Operation: | write | Name: | MaxFileSize |
Value: 1048576 | |||
| (PID) Process: | (3596) hgsw.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\hgsw_RASAPI32 |
| Operation: | write | Name: | FileDirectory |
Value: %windir%\tracing | |||
| (PID) Process: | (3596) hgsw.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\hgsw_RASMANCS |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
Executable files
1
Suspicious files
435
Text files
319
Unknown types
11
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2960 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\92LKEXTH6CK44CNHIBA0.temp | — | |
MD5:— | SHA256:— | |||
| 3672 | hgsw.exe | C:\Recovery\345b46fe-a9f9-11e7-a83c-e8a4f72b1d33\boot.sdi | — | |
MD5:— | SHA256:— | |||
| 3672 | hgsw.exe | C:\Recovery\345b46fe-a9f9-11e7-a83c-e8a4f72b1d33\Winre.wim | — | |
MD5:— | SHA256:— | |||
| 3672 | hgsw.exe | C:\Recovery\345b46fe-a9f9-11e7-a83c-e8a4f72b1d33\Winre.wim.utnldcpjs | — | |
MD5:— | SHA256:— | |||
| 3672 | hgsw.exe | C:\$Recycle.Bin\UTNLDCPJS-DECRYPT.txt | text | |
MD5:— | SHA256:— | |||
| 3672 | hgsw.exe | C:\$Recycle.Bin\S-1-5-21-1302019708-1500728564-335382590-500\UTNLDCPJS-DECRYPT.txt | text | |
MD5:— | SHA256:— | |||
| 3672 | hgsw.exe | C:\System Volume Information\SPP\OnlineMetadataCache\{05ed3515-06b3-48f6-8cf2-bf24b1bf0727}_OnDiskSnapshotProp | — | |
MD5:— | SHA256:— | |||
| 2960 | powershell.exe | C:\Users\Public\hgsw.exe | executable | |
MD5:— | SHA256:— | |||
| 3672 | hgsw.exe | C:\System Volume Information\SPP\OnlineMetadataCache\{16d74681-6bc3-4c44-97f0-8b8dfefe2355}_OnDiskSnapshotProp | — | |
MD5:— | SHA256:— | |||
| 3672 | hgsw.exe | C:\Recovery\UTNLDCPJS-DECRYPT.txt | text | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
5
DNS requests
2
Threats
15
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3892 | hgsw.exe | POST | 200 | 77.221.146.5:80 | http://dsdfgdfsdegdf.ru/index.php | RU | text | 4 b | malicious |
3596 | hgsw.exe | POST | 200 | 77.221.146.5:80 | http://dsdfgdfsdegdf.ru/index.php | RU | text | 4 b | malicious |
2840 | hgsw.exe | POST | 200 | 77.221.146.5:80 | http://dsdfgdfsdegdf.ru/index.php | RU | text | 4 b | malicious |
3672 | hgsw.exe | GET | 301 | 185.52.2.154:80 | http://www.kakaocorp.link/ | NL | html | 162 b | malicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3672 | hgsw.exe | 185.52.2.154:443 | www.kakaocorp.link | RouteLabel V.O.F. | NL | suspicious |
2840 | hgsw.exe | 77.221.146.5:80 | dsdfgdfsdegdf.ru | LeaseWeb Netherlands B.V. | RU | malicious |
3596 | hgsw.exe | 77.221.146.5:80 | dsdfgdfsdegdf.ru | LeaseWeb Netherlands B.V. | RU | malicious |
3892 | hgsw.exe | 77.221.146.5:80 | dsdfgdfsdegdf.ru | LeaseWeb Netherlands B.V. | RU | malicious |
3672 | hgsw.exe | 185.52.2.154:80 | www.kakaocorp.link | RouteLabel V.O.F. | NL | suspicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
dsdfgdfsdegdf.ru |
| malicious |
www.kakaocorp.link |
| malicious |
Threats
PID | Process | Class | Message |
|---|---|---|---|
3596 | hgsw.exe | A Network Trojan was detected | MALWARE [PTsecurity] AZORult HTTP Header |
3596 | hgsw.exe | A Network Trojan was detected | MALWARE [PTsecurity] AZORult Request |
3672 | hgsw.exe | A Network Trojan was detected | MALWARE [PTsecurity] Blacklisted GandCrab Ransomware C2 Server |
3672 | hgsw.exe | A Network Trojan was detected | MALWARE [PTsecurity] Blacklisted GandCrab Ransomware C2 Server |
3672 | hgsw.exe | A Network Trojan was detected | MALWARE [PTsecurity] GandCrab v.5 SSL Connection |
2840 | hgsw.exe | A Network Trojan was detected | MALWARE [PTsecurity] AZORult HTTP Header |
2840 | hgsw.exe | A Network Trojan was detected | MALWARE [PTsecurity] AZORult Request |
3892 | hgsw.exe | A Network Trojan was detected | MALWARE [PTsecurity] AZORult HTTP Header |
3892 | hgsw.exe | A Network Trojan was detected | MALWARE [PTsecurity] AZORult Request |
6 ETPRO signatures available at the full report