analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

report.js

Full analysis: https://app.any.run/tasks/80b3fd64-dfe5-493e-8ef5-8e4246a06213
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: June 19, 2019, 05:40:00
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
loader
gozi
ursnif
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines, with no line terminators
MD5:

5A95A51AD8CBF9F7D0D3DCC89A6866B9

SHA1:

9561E35AB34C51685F1B36F0AE7DB4E4FA005A66

SHA256:

44D8920AEDB1DB31DACC00E629196B8350BE5657EAE3652915F3420FE79B7D35

SSDEEP:

96:rZJBDVuIdkaIyhyQZCEVRSYuKlP1OfIoDBtCCDmu26DOlQwZV:FJNVJ+5EVRSpRtCCOyOlr

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Downloads executable files from the Internet

      • WScript.exe (PID: 3320)
      • iexplore.exe (PID: 2380)

    • Application was dropped or rewritten from another process

      • x[1].exe (PID: 3036)

    • URSNIF Shellcode was detected

      • explorer.exe (PID: 116)

    • Runs injected code in another process

      • x[1].exe (PID: 3036)

    • Changes the autorun value in the registry

      • explorer.exe (PID: 116)

    • Application was injected by another process

      • explorer.exe (PID: 116)

    • Detected URSNIF Trojan

      • x[1].exe (PID: 3036)

  • SUSPICIOUS

    • Executes scripts

      • explorer.exe (PID: 116)

    • Creates files in the user directory

      • WScript.exe (PID: 3320)
      • x[1].exe (PID: 3036)

    • Executable content was dropped or overwritten

      • WScript.exe (PID: 3320)
      • iexplore.exe (PID: 2852)
      • iexplore.exe (PID: 2380)
      • x[1].exe (PID: 3036)

    • Starts Internet Explorer

      • explorer.exe (PID: 116)

    • Reads Internet Cache Settings

      • explorer.exe (PID: 116)

    • Starts CMD.EXE for commands execution

      • explorer.exe (PID: 116)

  • INFO

    • Manual execution by user

      • iexplore.exe (PID: 2852)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2380)

    • Application launched itself

      • iexplore.exe (PID: 2852)

    • Creates files in the user directory

      • iexplore.exe (PID: 2380)

    • Changes internet zones settings

      • iexplore.exe (PID: 2852)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2380)
      • iexplore.exe (PID: 2852)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
9
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start inject wscript.exe iexplore.exe iexplore.exe #URSNIF x[1].exe explorer.exe cmd.exe no specs cmd.exe no specs nslookup.exe no specs nslookup.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3320"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\report.js"C:\Windows\System32\WScript.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
2852"C:\Program Files\Internet Explorer\iexplore.exe" C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2380"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2852 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3036"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\x[1].exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\x[1].exe
iexplore.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
116C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3556cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\admin\AppData\Local\Temp\BBD0.bi1"C:\Windows\system32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1000cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\admin\AppData\Local\Temp\A9FA.bi1"C:\Windows\system32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2308nslookup myip.opendns.com resolver1.opendns.com C:\Windows\system32\nslookup.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
nslookup
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
992nslookup myip.opendns.com resolver1.opendns.com C:\Windows\system32\nslookup.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
nslookup
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
805
Read events
698
Write events
0
Delete events
0

Modification events

No data
Executable files
5
Suspicious files
0
Text files
11
Unknown types
5

Dropped files

PID
Process
Filename
Type
2852iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\favicon[1].ico —
MD5:—
SHA256:—
2852iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
3320WScript.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\x[1].exeexecutable
MD5:62DCE691218548EA95233ED930D9489C
SHA256:EBA016EB13094E9CCF57C58F8B230F59E090C15A6EB3A209A77DC34478113231
3320WScript.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\IETldCache\index.datdat
MD5:D7A950FEFD60DBAA01DF2D85FEFB3862
SHA256:75D0B1743F61B76A35B1FEDD32378837805DE58D79FA950CB6E8164BFA72073A
2380iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012019061920190620\index.datdat
MD5:DEDBEEFCF6D359BB2969E47B26ACE22B
SHA256:5B40D6782F0393C5C47E15C627CF5DF90B7299072524A218BC6ED45B981A4785
2380iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.datdat
MD5:C558BA5A156C41C2E16C7703CCC70774
SHA256:15AB2E5D1B1D6643DE3B938051C9E2C1D04A71ACD2D4159F7CE8AA416E8B877F
3036x[1].exeC:\Users\admin\AppData\Roaming\Microsoft\Devivmgr\crypptsp.exeexecutable
MD5:62DCE691218548EA95233ED930D9489C
SHA256:EBA016EB13094E9CCF57C58F8B230F59E090C15A6EB3A209A77DC34478113231
2852iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\x[1].exeexecutable
MD5:62DCE691218548EA95233ED930D9489C
SHA256:EBA016EB13094E9CCF57C58F8B230F59E090C15A6EB3A209A77DC34478113231
2852iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Feeds Cache\desktop.iniini
MD5:4A3DEB274BB5F0212C2419D3D8D08612
SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38
2380iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\NSH2FQDT\x[1].exeexecutable
MD5:62DCE691218548EA95233ED930D9489C
SHA256:EBA016EB13094E9CCF57C58F8B230F59E090C15A6EB3A209A77DC34478113231
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
3
DNS requests
3
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3320
WScript.exe
GET
200
92.63.98.103:80
http://bibicity.ru/x.exe
RU
executable
626 Kb
malicious
2380
iexplore.exe
GET
200
92.63.98.103:80
http://bibicity.ru/x.exe
RU
executable
626 Kb
malicious
2852
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2852
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3320
WScript.exe
92.63.98.103:80
bibicity.ru
JSC ISPsystem
RU
malicious
2380
iexplore.exe
92.63.98.103:80
bibicity.ru
JSC ISPsystem
RU
malicious

DNS requests

Domain
IP
Reputation
bibicity.ru
  • 92.63.98.103
  • 89.223.24.93
  • 89.223.88.84
  • 62.173.145.112
malicious
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
interruption.ru
  • —
malicious

Threats

PID
Process
Class
Message
3320
WScript.exe
A Network Trojan was detected
ET TROJAN Single char EXE direct download likely trojan (multiple families)
3320
WScript.exe
A Network Trojan was detected
ET CURRENT_EVENTS Possible Malicious Macro DL EXE Feb 2016
3320
WScript.exe
Potentially Bad Traffic
ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile
3320
WScript.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2380
iexplore.exe
A Network Trojan was detected
ET TROJAN Single char EXE direct download likely trojan (multiple families)
2380
iexplore.exe
Potentially Bad Traffic
ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile
2380
iexplore.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
report.js