analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Информация о заказе.xls.js

Full analysis: https://app.any.run/tasks/c410e4be-1dad-406e-8b70-abce7b73db30
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Analysis date: September 19, 2019, 10:59:28
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
loader
ransomware
troldesh
shade
evasion
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines, with CRLF, LF line terminators
MD5:

C4FA4FB5BC7B24913FAACE987CF87471

SHA1:

0EEFABDD8537C5333309AC4980C3FD2F9CD208B6

SHA256:

4B96D19F03917FC902DE321768E8107AAA0827708B54B622E8C7B51C07D04824

SSDEEP:

384:zdipBS4ugTIYCCSd7uzP7Gli1KQVX9GqGyM00:xipBXyYnSd7uzP7sCK6Nru

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • rad21C5D.tmp (PID: 2504)
      • rad21C5D.tmp (PID: 3696)
    • Downloads executable files from the Internet

      • WScript.exe (PID: 2876)
    • TROLDESH was detected

      • rad21C5D.tmp (PID: 3696)
    • Changes the autorun value in the registry

      • rad21C5D.tmp (PID: 3696)
    • Deletes shadow copies

      • rad21C5D.tmp (PID: 3696)
    • Dropped file may contain instructions of ransomware

      • rad21C5D.tmp (PID: 3696)
    • Runs app for hidden code execution

      • rad21C5D.tmp (PID: 3696)
    • Actions looks like stealing of personal data

      • rad21C5D.tmp (PID: 3696)
    • Modifies files in Chrome extension folder

      • rad21C5D.tmp (PID: 3696)
  • SUSPICIOUS

    • Starts application with an unusual extension

      • cmd.exe (PID: 3808)
      • rad21C5D.tmp (PID: 2504)
      • cmd.exe (PID: 3156)
    • Starts CMD.EXE for commands execution

      • WScript.exe (PID: 2876)
      • rad21C5D.tmp (PID: 3696)
    • Executable content was dropped or overwritten

      • WScript.exe (PID: 2876)
      • rad21C5D.tmp (PID: 3696)
    • Creates files in the program directory

      • rad21C5D.tmp (PID: 3696)
    • Application launched itself

      • rad21C5D.tmp (PID: 2504)
    • Creates files like Ransomware instruction

      • rad21C5D.tmp (PID: 3696)
    • Executed as Windows Service

      • vssvc.exe (PID: 2944)
    • Creates files in the user directory

      • rad21C5D.tmp (PID: 3696)
  • INFO

    • Dropped object may contain URL to Tor Browser

      • rad21C5D.tmp (PID: 3696)
    • Dropped object may contain TOR URL's

      • rad21C5D.tmp (PID: 3696)
    • Dropped object may contain Bitcoin addresses

      • rad21C5D.tmp (PID: 3696)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
51
Monitored processes
9
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start wscript.exe cmd.exe no specs rad21c5d.tmp no specs #TROLDESH rad21c5d.tmp vssadmin.exe no specs vssadmin.exe vssvc.exe no specs cmd.exe no specs chcp.com no specs

Process information

PID
CMD
Path
Indicators
Parent process
2876"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\Информация о заказе.xls.js"C:\Windows\System32\WScript.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
3808"C:\Windows\System32\cmd.exe" /c C:\Users\admin\AppData\Local\Temp\rad21C5D.tmpC:\Windows\System32\cmd.exeWScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2504C:\Users\admin\AppData\Local\Temp\rad21C5D.tmpC:\Users\admin\AppData\Local\Temp\rad21C5D.tmpcmd.exe
User:
admin
Company:
Sonic Foundry
Integrity Level:
MEDIUM
Description:
Remotely Imprvement Vases
Exit code:
0
Version:
4.5.34.3
3696C:\Users\admin\AppData\Local\Temp\rad21C5D.tmpC:\Users\admin\AppData\Local\Temp\rad21C5D.tmp
rad21C5D.tmp
User:
admin
Company:
Sonic Foundry
Integrity Level:
MEDIUM
Description:
Remotely Imprvement Vases
Version:
4.5.34.3
2624C:\Windows\system32\vssadmin.exe List ShadowsC:\Windows\system32\vssadmin.exerad21C5D.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Command Line Interface for Microsoft® Volume Shadow Copy Service
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2252"C:\Windows\system32\vssadmin.exe" Delete Shadows /All /QuietC:\Windows\system32\vssadmin.exe
rad21C5D.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Command Line Interface for Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2944C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exeservices.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3156C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exerad21C5D.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3612chcpC:\Windows\system32\chcp.comcmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Change CodePage Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
245
Read events
205
Write events
40
Delete events
0

Modification events

(PID) Process:(2876) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WScript_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2876) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WScript_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2876) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WScript_RASAPI32
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(2876) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WScript_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
4294901760
(PID) Process:(2876) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WScript_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(2876) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WScript_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(2876) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WScript_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2876) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WScript_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2876) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WScript_RASMANCS
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(2876) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WScript_RASMANCS
Operation:writeName:ConsoleTracingMask
Value:
4294901760
Executable files
3
Suspicious files
1 048
Text files
40
Unknown types
31

Dropped files

PID
Process
Filename
Type
3696rad21C5D.tmpC:\Users\admin\AppData\Local\Temp\6893A5D897\state.tmp
MD5:
SHA256:
3696rad21C5D.tmpC:\Users\admin\AppData\Local\Temp\6893A5D897\unverified-microdesc-consensus.tmp
MD5:
SHA256:
3696rad21C5D.tmpC:\Users\admin\AppData\Local\Temp\6893A5D897\cached-certs.tmp
MD5:
SHA256:
3696rad21C5D.tmpC:\Users\admin\AppData\Local\Temp\6893A5D897\cached-microdesc-consensus.tmp
MD5:
SHA256:
3696rad21C5D.tmpC:\Users\Public\Videos\Sample Videos\Wildlife.wmv
MD5:
SHA256:
3696rad21C5D.tmpC:\Users\Public\Videos\Sample Videos\uCeCXMlTOglvtxeEgPYORZYEhKCqkt0VqWBwVe9ldl4=.906D0F2E2F604F839E04.crypted000007
MD5:
SHA256:
3696rad21C5D.tmpC:\Users\Public\Pictures\Sample Pictures\Tulips.jpg
MD5:
SHA256:
3696rad21C5D.tmpC:\Users\Public\Pictures\Sample Pictures\Penguins.jpg
MD5:
SHA256:
3696rad21C5D.tmpC:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg
MD5:
SHA256:
3696rad21C5D.tmpC:\Users\Public\Pictures\Sample Pictures\Koala.jpg
MD5:
SHA256:
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
7
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2876
WScript.exe
GET
200
132.148.98.116:80
http://jdcontractingomaha.com/wp-content/blogs.dir/2c.jpg
US
executable
1.96 Mb
malicious
3696
rad21C5D.tmp
GET
200
66.171.248.178:80
http://ipv4bot.whatismyipaddress.com/
US
text
14 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3696
rad21C5D.tmp
128.31.0.39:9101
Massachusetts Institute of Technology
US
malicious
3696
rad21C5D.tmp
66.171.248.178:80
ipv4bot.whatismyipaddress.com
Alchemy Communications, Inc.
US
malicious
3696
rad21C5D.tmp
37.120.174.249:443
netcup GmbH
DE
suspicious
3696
rad21C5D.tmp
193.23.244.244:443
Chaos Computer Club e.V.
DE
malicious
3696
rad21C5D.tmp
217.199.207.250:9001
iQom Business Services GmbH
DE
suspicious
3696
rad21C5D.tmp
158.58.170.183:4443
Seflow S.N.C. Di Marco Brame' & C.
IT
malicious
2876
WScript.exe
132.148.98.116:80
jdcontractingomaha.com
GoDaddy.com, LLC
US
malicious

DNS requests

Domain
IP
Reputation
jdcontractingomaha.com
  • 132.148.98.116
malicious
ipv4bot.whatismyipaddress.com
  • 66.171.248.178
shared

Threats

PID
Process
Class
Message
2876
WScript.exe
A Network Trojan was detected
ET CURRENT_EVENTS Likely Evil EXE download from MSXMLHTTP non-exe extension M2
2876
WScript.exe
A Network Trojan was detected
ET TROJAN JS/WSF Downloader Dec 08 2016 M4
2876
WScript.exe
Misc activity
SUSPICIOUS [PTsecurity] PE as Image Content type mismatch
3696
rad21C5D.tmp
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 272
3696
rad21C5D.tmp
Potential Corporate Privacy Violation
POLICY [PTsecurity] TOR SSL connection
3696
rad21C5D.tmp
Misc activity
ET POLICY TLS possible TOR SSL traffic
3696
rad21C5D.tmp
Potential Corporate Privacy Violation
POLICY [PTsecurity] TOR SSL connection
3696
rad21C5D.tmp
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 442
3696
rad21C5D.tmp
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 353
3696
rad21C5D.tmp
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 162
3 ETPRO signatures available at the full report
No debug info