analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

MongoDBJDBCDriver.zip

Full analysis: https://app.any.run/tasks/0666d9c0-aab5-4210-b2f9-110cc8dbbdd5
Verdict: Malicious activity
Analysis date: January 10, 2019, 16:57:24
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

DF4953C07E570EE39FE011A17421A39C

SHA1:

0D08E814B67DD5C16265077160B46758A611E893

SHA256:

464080A08DDA380B9C083189B3C6E73BE1A3960AF85DF5C02DD7336D3DFD6E3A

SSDEEP:

196608:QvjCizXV5VoEK++b3rb2COFnaN2bUkwjQJGv6GM2w3KbECJ:OjPlDzKNb32o5kwbvhMiPJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • javaw.exe (PID: 2236)

  • SUSPICIOUS

    • Creates files in the user directory

      • javaw.exe (PID: 2236)

    • Starts Internet Explorer

      • rundll32.exe (PID: 1840)

    • Application launched itself

      • WinRAR.exe (PID: 3592)

    • Executes scripts

      • javaw.exe (PID: 2768)

    • Executable content was dropped or overwritten

      • javaw.exe (PID: 2236)

    • Uses RUNDLL32.EXE to load library

      • javaw.exe (PID: 2236)

    • Starts CMD.EXE for commands execution

      • javaw.exe (PID: 2236)

    • Executes JAVA applets

      • wscript.exe (PID: 2532)
      • javaw.exe (PID: 2236)

    • Creates files in the program directory

      • javaw.exe (PID: 2236)

  • INFO

    • Reads internet explorer settings

      • iexplore.exe (PID: 4036)

    • Application launched itself

      • iexplore.exe (PID: 3052)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3052)
      • iexplore.exe (PID: 4036)

    • Changes internet zones settings

      • iexplore.exe (PID: 3052)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: setup.jar
ZipUncompressedSize: 8806318
ZipCompressedSize: 8688727
ZipCRC: 0x6448254e
ZipModifyDate: 2018:11:16 14:51:23
ZipCompression: Deflated
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
51
Monitored processes
12
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs winrar.exe no specs javaw.exe no specs wscript.exe no specs javaw.exe cmd.exe no specs cmd.exe no specs rundll32.exe no specs iexplore.exe iexplore.exe no specs java.exe no specs java.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3592"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\MongoDBJDBCDriver.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3248"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\Rar$DIa3592.46781\setup.jarC:\Program Files\WinRAR\WinRAR.exe—WinRAR.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
2768"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -jar "C:\Users\admin\Desktop\setup.jar" C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe—explorer.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.920.14
2532wscript C:\Users\admin\AppData\Local\Temp\Installer.js "C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -Dizpack.mode=privileged -jar C:\Users\admin\Desktop\setup.jarC:\Windows\system32\wscript.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
2236"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" "-Dizpack.mode=privileged" "-jar" "C:\Users\admin\Desktop\setup.jar"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe
wscript.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
HIGH
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.920.14
772cmd.exe /C setC:\Windows\system32\cmd.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2388cmd.exe /C "dir /D /-C "C:\Program Files\CData\CData JDBC Driver for MongoDB 2018""C:\Windows\system32\cmd.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1840rundll32 url.dll,FileProtocolHandler file:///C:\Program Files\CData\CData JDBC Driver for MongoDB 2018/help/help.htmC:\Windows\system32\rundll32.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3052"C:\Program Files\Internet Explorer\iexplore.exe" C:\Program Files\CData\CData JDBC Driver for MongoDB 2018\help\help.htmC:\Program Files\Internet Explorer\iexplore.exe
rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
4036"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3052 CREDAT:79873C:\Program Files\Internet Explorer\iexplore.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Total events
1 486
Read events
1 384
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
6
Text files
103
Unknown types
11

Dropped files

PID
Process
Filename
Type
3592WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3592.48048\setup.jar —
MD5:—
SHA256:—
2236javaw.exeC:\Program Files\CData\CData JDBC Driver for MongoDB 2018\lib\cdata.jdbc.mongodb.remoting.initext
MD5:EB4B5685EA574691F55ADBC3C6A259B5
SHA256:C3D9E08AE1C4B25658F542D7EFD67CFA0A57BFD04C99461E11A4EB7D2B9CFBF3
2236javaw.exeC:\Program Files\CData\CData JDBC Driver for MongoDB 2018\db\GetDocument.rsbtext
MD5:CA30639EE32310A20817C82E79A92CBE
SHA256:5B45F8EEBB8D47125FD074001EF7C02FD1140C441B8FB4B0138DD44F8EFCCB67
2236javaw.exeC:\Program Files\CData\CData JDBC Driver for MongoDB 2018\db\CreateSchema.rsbtext
MD5:2AF1EAAC1EC289D7AC83BDE73651140F
SHA256:D8B9E798A26F5A5054A8B1EF28E0AB6EC831B2397C310796345CFF80787654BF
3592WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa3592.46781\setup.jarcompressed
MD5:6794572927E781DFFB7132B76B2E5819
SHA256:E2FF72459A3C2503FC8C51FEF7C0435CDB02D2A2963087CC6E40ED532A8E59D2
2236javaw.exeC:\Users\admin\.CData\cdata.jdbc.mongodb.lictext
MD5:281168FCA70C7C5B5749A8F1B9E2D9F6
SHA256:F5098EE99539591D24B41C36914D7D194DA622749F26B263BDAB45440C895C9A
2768javaw.exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamptext
MD5:575C222AAC620AAD6BA6753C7C01C1C5
SHA256:63DAE6824D3AB92746ABF757471973F7CC956F3D2C0A92702D26E7AD78AD5085
2236javaw.exeC:\Program Files\CData\CData JDBC Driver for MongoDB 2018\db\SearchDocument.rsbtext
MD5:E4A0768E233DD1BEE7F08D39EB1033DD
SHA256:443A00D8E91FB5F340B0F19A4F32C05828D6F8C3476495F189A1B5EE17830942
2236javaw.exeC:\Program Files\CData\CData JDBC Driver for MongoDB 2018\db\AddDocument.rsbtext
MD5:2BA933AAB8FF8E55BBA57434F1B32043
SHA256:7107B1B96A0A4566F5FFDBA964FBFFA69CEF4F2AC8730669FD1465E135FB0DDB
2236javaw.exeC:\Program Files\CData\CData JDBC Driver for MongoDB 2018\lib\cdata.jdbc.mongodb.jarcompressed
MD5:8E250C39883EE98959A41FE510FA6C71
SHA256:5C7E1C78C7CDB41CAC548964CCD9326B7365785AFE17DF85E9C3E757C9743035
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
2
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2236
javaw.exe
GET
200
206.72.114.195:80
http://lic.cdata.com/lic/?prod=DGRDV&nodeid=0ACB3BGN&bld=6894&uid=admin&name=test&email=test%40test.com&canemail=0&c=4&setup=true&a=itrial&exp=0
US
text
378 b
suspicious
3052
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3052
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
2236
javaw.exe
206.72.114.195:80
lic.cdata.com
Peak 10
US
suspicious

DNS requests

Domain
IP
Reputation
lic.cdata.com
  • 206.72.114.195
suspicious
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
MongoDBJDBCDriver.zip