analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

790be13ee21b9a652ff99336ffa5e47e-sample.zip

Full analysis: https://app.any.run/tasks/c5896f5c-d10e-4028-bd07-1f28d5b724f1
Verdict: Malicious activity
Threats:

TrickBot is an advanced banking trojan that attackers can use to steal payment credentials from the victims. It can redirect the victim to a fake banking cabinet and retrieve credentials typed in on the webpage.

Malware Trends Tracker     >>>
Analysis date: July 18, 2019, 07:17:53
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trickbot
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

75617A0BD7D6F45CC377EA589F17A44D

SHA1:

8AE1DAF3CD18C6642AF0D53A9FB51F0AB09F265C

SHA256:

55546232C0AB0365F1657DA4A3B75422A36B859724D8434C49791072AFBE64C7

SSDEEP:

6144:PD4Ic41bI0pCMxY294gd447Wu1HsWGV4A1cXoBCe78+gM:PBcQCv2m47K1cXosU3h

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 0146eac3aedca01c0095a50bce1b316d.exe (PID: 3076)
      • 0148eac3aedca01c0097a70bce1b318d.exe (PID: 4084)
      • 0148eac3aedca01c0097a70bce1b318d.exe (PID: 2296)
      • 0148eac3aedca01c0097a70bce1b318d.exe (PID: 4068)
      • 0148eac3aedca01c0097a70bce1b318d.exe (PID: 1428)

    • Stops/Deletes Windows Defender service via SC.exe

      • cmd.exe (PID: 3464)
      • cmd.exe (PID: 2804)
      • cmd.exe (PID: 1696)
      • cmd.exe (PID: 1468)
      • cmd.exe (PID: 1532)
      • cmd.exe (PID: 3928)
      • cmd.exe (PID: 3548)
      • cmd.exe (PID: 3232)
      • cmd.exe (PID: 2184)
      • cmd.exe (PID: 1456)
      • cmd.exe (PID: 3424)
      • cmd.exe (PID: 3552)

    • Disables Windows Defender

      • 0146eac3aedca01c0095a50bce1b316d.exe (PID: 3076)
      • 0148eac3aedca01c0097a70bce1b318d.exe (PID: 4084)
      • 0148eac3aedca01c0097a70bce1b318d.exe (PID: 2296)
      • 0148eac3aedca01c0097a70bce1b318d.exe (PID: 4068)
      • 0148eac3aedca01c0097a70bce1b318d.exe (PID: 1428)

    • Loads the Task Scheduler COM API

      • 0146eac3aedca01c0095a50bce1b316d.exe (PID: 3076)

    • Trickbot detected

      • 0146eac3aedca01c0095a50bce1b316d.exe (PID: 3076)

    • Executes PowerShell scripts

      • cmd.exe (PID: 2152)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3728)
      • 0146eac3aedca01c0095a50bce1b316d.exe (PID: 3076)

    • Starts CMD.EXE for commands execution

      • 0146eac3aedca01c0095a50bce1b316d.exe (PID: 3076)
      • 0148eac3aedca01c0097a70bce1b318d.exe (PID: 4084)
      • 0148eac3aedca01c0097a70bce1b318d.exe (PID: 2296)
      • 0148eac3aedca01c0097a70bce1b318d.exe (PID: 4068)
      • 0148eac3aedca01c0097a70bce1b318d.exe (PID: 1428)

    • Executes PowerShell scripts

      • cmd.exe (PID: 1816)
      • cmd.exe (PID: 3684)
      • cmd.exe (PID: 3832)
      • cmd.exe (PID: 2572)
      • cmd.exe (PID: 1656)

    • Creates files in the user directory

      • powershell.exe (PID: 2932)
      • 0146eac3aedca01c0095a50bce1b316d.exe (PID: 3076)
      • powershell.exe (PID: 2628)
      • powershell.exe (PID: 2748)
      • powershell.exe (PID: 3536)
      • powershell.exe (PID: 3804)
      • powershell.exe (PID: 3228)

    • Executed via Task Scheduler

      • 0148eac3aedca01c0097a70bce1b318d.exe (PID: 2296)

  • INFO

    • Manual execution by user

      • 0146eac3aedca01c0095a50bce1b316d.exe (PID: 3076)
      • explorer.exe (PID: 3160)
      • 0148eac3aedca01c0097a70bce1b318d.exe (PID: 4084)
      • 0148eac3aedca01c0097a70bce1b318d.exe (PID: 4068)
      • 0148eac3aedca01c0097a70bce1b318d.exe (PID: 1428)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: 0146eac3aedca01c0095a50bce1b316d
ZipUncompressedSize: 475648
ZipCompressedSize: 275569
ZipCRC: 0x684ebf05
ZipModifyDate: 2019:06:27 14:28:06
ZipCompression: Deflated
ZipBitFlag: 0x0009
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
102
Monitored processes
43
Malicious processes
6
Suspicious processes
12

Behavior graph

Click at the process to see the details
start winrar.exe #TRICKBOT 0146eac3aedca01c0095a50bce1b316d.exe cmd.exe no specs sc.exe no specs cmd.exe no specs cmd.exe no specs sc.exe no specs powershell.exe no specs explorer.exe no specs 0148eac3aedca01c0097a70bce1b318d.exe no specs cmd.exe no specs sc.exe no specs cmd.exe no specs cmd.exe no specs sc.exe no specs powershell.exe no specs 0148eac3aedca01c0097a70bce1b318d.exe no specs cmd.exe no specs sc.exe no specs cmd.exe no specs cmd.exe no specs sc.exe no specs powershell.exe no specs 0148eac3aedca01c0097a70bce1b318d.exe no specs cmd.exe no specs sc.exe no specs cmd.exe no specs cmd.exe no specs sc.exe no specs powershell.exe no specs 0148eac3aedca01c0097a70bce1b318d.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs powershell.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs cmd.exe no specs cmd.exe no specs sc.exe no specs powershell.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3728"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\790be13ee21b9a652ff99336ffa5e47e-sample.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3076"C:\Users\admin\Desktop\0146eac3aedca01c0095a50bce1b316d.exe" C:\Users\admin\Desktop\0146eac3aedca01c0095a50bce1b316d.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Macedonian (FYROM) - Standard Keyboard Layout
Version:
10.0.17763.1 (WinBuild.160101.0800)
3464/c sc stop WinDefendC:\Windows\system32\cmd.exe—0146eac3aedca01c0095a50bce1b316d.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
5
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2152sc stop WinDefendC:\Windows\system32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
A tool to aid in developing services for WindowsNT
Exit code:
5
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2804/c sc delete WinDefendC:\Windows\system32\cmd.exe—0146eac3aedca01c0095a50bce1b316d.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
5
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1816/c powershell Set-MpPreference -DisableRealtimeMonitoring $trueC:\Windows\system32\cmd.exe—0146eac3aedca01c0095a50bce1b316d.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3844sc delete WinDefendC:\Windows\system32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
A tool to aid in developing services for WindowsNT
Exit code:
5
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2932powershell Set-MpPreference -DisableRealtimeMonitoring $trueC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3160"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
4084"C:\Users\admin\AppData\Roaming\msnet\0148eac3aedca01c0097a70bce1b318d.exe" C:\Users\admin\AppData\Roaming\msnet\0148eac3aedca01c0097a70bce1b318d.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Macedonian (FYROM) - Standard Keyboard Layout
Exit code:
0
Version:
10.0.17763.1 (WinBuild.160101.0800)
Total events
1 860
Read events
1 505
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
17
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2932powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\C3LIOPS6REFEY1VVOTTH.temp —
MD5:—
SHA256:—
2628powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2CSTWPY1OUQYVJN6GIRU.temp —
MD5:—
SHA256:—
2748powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\50N84JSE4UBUDSWLXUJ2.temp —
MD5:—
SHA256:—
3536powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\U3CRWX9WLJ4QYXF4T4E6.temp —
MD5:—
SHA256:—
3804powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\HKGBCS11BYL4BIUCIS88.temp —
MD5:—
SHA256:—
3228powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\M68KB09I47QX2WN931IO.temp —
MD5:—
SHA256:—
2628powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFf431a.TMPbinary
MD5:E4D9C442DD447A8FA05F9CFE88FCBB69
SHA256:EDD7D7597C6C79A1DFD3229A1FA23433329B1D8399EB558623FFF948D3BB4036
2932powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFe8fe7.TMPbinary
MD5:E4D9C442DD447A8FA05F9CFE88FCBB69
SHA256:EDD7D7597C6C79A1DFD3229A1FA23433329B1D8399EB558623FFF948D3BB4036
22960148eac3aedca01c0097a70bce1b318d.exeC:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\0f5007522459c86e95ffcc62f32308f1_90059c37-1320-41a4-b58d-2b75a9850d2fbinary
MD5:832B7EDA69B0E750E40B1BA7D645D992
SHA256:1BF706E919B3938ED0A61F23978B911CC4681B986290D0FB784B7AEF1F797960
2748powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFf92d1.TMPbinary
MD5:E4D9C442DD447A8FA05F9CFE88FCBB69
SHA256:EDD7D7597C6C79A1DFD3229A1FA23433329B1D8399EB558623FFF948D3BB4036
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
790be13ee21b9a652ff99336ffa5e47e-sample.zip