analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
download:

NVtz-JPa4XqPL1XZ8inH_lMvLBZZBA-L1S

Full analysis: https://app.any.run/tasks/dbf36564-f296-46f8-8739-28d0eb9f3e80
Verdict: Malicious activity
Analysis date: April 23, 2019, 14:17:12
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
opendir
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines
MD5:

CBA837A55722D77BED269A83DE9CCE16

SHA1:

A27F59159053A0BDE21BED2189FB96B77E4358D9

SHA256:

474B7F305055FF40E7D644828C8BB5B3B19BDC17A8A6054C88CE7489A80314F3

SSDEEP:

768:gb79CXA8BJZ4oKYM59pLOcf2s/eX8luIJ9/yIguFjGR5ensRlgJ35lD/oLX/4vF1:GCXAeJZ4BXpLOcfo2jsRlqH2s

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    No malicious indicators.
  • SUSPICIOUS

    • Executes application which crashes

      • WScript.exe (PID: 2548)
      • WScript.exe (PID: 3120)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
5
Malicious processes
0
Suspicious processes
2

Behavior graph

Click at the process to see the details
start rundll32.exe no specs wscript.exe wscript.exe ntvdm.exe no specs ntvdm.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2928"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\Desktop\NVtz-JPa4XqPL1XZ8inH_lMvLBZZBA-L1SC:\Windows\system32\rundll32.exeexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2548"C:\Windows\System32\WScript.exe" "C:\Users\admin\Desktop\NVtz-JPa4XqPL1XZ8inH_lMvLBZZBA-L1S.js" C:\Windows\System32\WScript.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
3120"C:\Windows\System32\WScript.exe" "C:\Users\admin\Desktop\NVtz-JPa4XqPL1XZ8inH_lMvLBZZBA-L1S.js" C:\Windows\System32\WScript.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
3084"C:\Windows\system32\ntvdm.exe" -i1 C:\Windows\system32\ntvdm.exeWScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
NTVDM.EXE
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3100"C:\Windows\system32\ntvdm.exe" -i2 C:\Windows\system32\ntvdm.exeWScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
NTVDM.EXE
Exit code:
3221225786
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
846
Read events
807
Write events
39
Delete events
0

Modification events

(PID) Process:Key:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:LangID
Value:
0904
(PID) Process:Key:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Value:
Adobe Acrobat Reader DC
(PID) Process:Key:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Windows\eHome\ehshell.exe
Value:
Windows Media Center
(PID) Process:Key:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Program Files\Internet Explorer\iexplore.exe
Value:
Internet Explorer
(PID) Process:Key:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Windows\system32\mspaint.exe
Value:
Paint
(PID) Process:Key:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Windows\system32\NOTEPAD.EXE
Value:
Notepad
(PID) Process:Key:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\PROGRA~1\MICROS~1\Office14\OIS.EXE
Value:
Microsoft Office 2010
(PID) Process:Key:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Program Files\Opera\Opera.exe
Value:
Opera Internet Browser
(PID) Process:Key:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Program Files\Windows Photo Viewer\PhotoViewer.dll
Value:
Windows Photo Viewer
(PID) Process:Key:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Program Files\VideoLAN\VLC\vlc.exe
Value:
VLC media player
Executable files
0
Suspicious files
0
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
3120WScript.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\Ss2r[1].txt
MD5:
SHA256:
3084ntvdm.exeC:\Users\admin\AppData\Local\Temp\scs26E4.tmp
MD5:
SHA256:
3084ntvdm.exeC:\Users\admin\AppData\Local\Temp\scs26F5.tmp
MD5:
SHA256:
3100ntvdm.exeC:\Users\admin\AppData\Local\Temp\scs29F1.tmp
MD5:
SHA256:
3100ntvdm.exeC:\Users\admin\AppData\Local\Temp\scs29F2.tmp
MD5:
SHA256:
3120WScript.exeC:\Users\admin\AppData\Local\Temp\o0qexly9w.exehtml
MD5:0EDB244E38E38773D4DCAA5E169F014B
SHA256:391DD078E12C05BC0C2CDF423709A365790D0017C71C3CFD0A75DD43C8740963
2548WScript.exeC:\Users\admin\AppData\Local\Temp\ingxs3789.exehtml
MD5:0EDB244E38E38773D4DCAA5E169F014B
SHA256:391DD078E12C05BC0C2CDF423709A365790D0017C71C3CFD0A75DD43C8740963
2548WScript.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\Ss2r[2].txthtml
MD5:0EDB244E38E38773D4DCAA5E169F014B
SHA256:391DD078E12C05BC0C2CDF423709A365790D0017C71C3CFD0A75DD43C8740963
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
4
DNS requests
3
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2548
WScript.exe
GET
200
192.185.152.59:80
http://danpanahon.com/dan/Ss2r/
US
html
731 b
suspicious
3120
WScript.exe
GET
200
192.185.152.59:80
http://danpanahon.com/dan/Ss2r/
US
html
731 b
suspicious
2548
WScript.exe
GET
301
50.116.45.41:80
http://www.jubileesvirginhair.com/wp-content/upgrade/2PWW/
US
html
178 b
unknown
3120
WScript.exe
GET
301
50.116.45.41:80
http://www.jubileesvirginhair.com/wp-content/upgrade/2PWW/
US
html
178 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2548
WScript.exe
192.185.152.59:80
danpanahon.com
CyrusOne LLC
US
suspicious
2548
WScript.exe
50.116.45.41:80
www.jubileesvirginhair.com
Linode, LLC
US
unknown
3120
WScript.exe
50.116.45.41:80
www.jubileesvirginhair.com
Linode, LLC
US
unknown
3120
WScript.exe
192.185.152.59:80
danpanahon.com
CyrusOne LLC
US
suspicious

DNS requests

Domain
IP
Reputation
www.jubileesvirginhair.com
  • 50.116.45.41
unknown
danpanahon.com
  • 192.185.152.59
suspicious

Threats

PID
Process
Class
Message
2548
WScript.exe
Misc activity
SUSPICIOUS [PTsecurity] Cmd.Powershell.Download HTTP UserAgent (Win7)
3120
WScript.exe
Misc activity
SUSPICIOUS [PTsecurity] Cmd.Powershell.Download HTTP UserAgent (Win7)
3120
WScript.exe
Misc activity
SUSPICIOUS [PTsecurity] Cmd.Powershell.Download HTTP UserAgent (Win7)
2548
WScript.exe
Misc activity
SUSPICIOUS [PTsecurity] Cmd.Powershell.Download HTTP UserAgent (Win7)
No debug info