analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

«ПАО «НГК «Славнефть» подробности заказа.js

Full analysis: https://app.any.run/tasks/1ce02d85-8636-4700-baff-99da7b776a77
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Analysis date: February 19, 2019, 10:01:03
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
loader
ransomware
troldesh
shade
Indicators:
MIME: text/plain
File info: ASCII text, with CRLF, LF line terminators
MD5:

865D000775BAA36CD7971C67031070DD

SHA1:

9FA5C4E71A849D0C2485F0DD6259FAD2A2A05766

SHA256:

5BDDAEA170C8CBEB2B541A93296025D4258A2068C07FE1A6B50A82A96D9349B2

SSDEEP:

96:ooytS/DgA7EEz87svZjOjH4pewNA6BcHRUrsHTNP/Rj6S8a3gQ:ooyg/hzPvtvkkA6BcHRFHTNBj58az

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • radA544F.tmp (PID: 3648)
    • Downloads executable files from the Internet

      • WScript.exe (PID: 2860)
    • TROLDESH was detected

      • radA544F.tmp (PID: 3648)
    • Changes the autorun value in the registry

      • radA544F.tmp (PID: 3648)
  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • WScript.exe (PID: 2860)
    • Creates files in the program directory

      • radA544F.tmp (PID: 3648)
    • Executable content was dropped or overwritten

      • radA544F.tmp (PID: 3648)
      • WScript.exe (PID: 2860)
    • Starts application with an unusual extension

      • cmd.exe (PID: 2944)
    • Connects to unusual port

      • radA544F.tmp (PID: 3648)
  • INFO

    • Dropped object may contain Bitcoin addresses

      • radA544F.tmp (PID: 3648)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
33
Monitored processes
3
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start wscript.exe cmd.exe no specs #TROLDESH rada544f.tmp

Process information

PID
CMD
Path
Indicators
Parent process
2860"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\«ПАО «НГК «Славнефть» подробности заказа.js"C:\Windows\System32\WScript.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
2944"C:\Windows\System32\cmd.exe" /c C:\Users\admin\AppData\Local\Temp\radA544F.tmpC:\Windows\System32\cmd.exeWScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3648C:\Users\admin\AppData\Local\Temp\radA544F.tmpC:\Users\admin\AppData\Local\Temp\radA544F.tmp
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Total events
157
Read events
135
Write events
22
Delete events
0

Modification events

(PID) Process:(2860) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WScript_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2860) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WScript_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2860) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WScript_RASAPI32
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(2860) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WScript_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
4294901760
(PID) Process:(2860) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WScript_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(2860) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WScript_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(2860) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WScript_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2860) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WScript_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2860) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WScript_RASMANCS
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(2860) WScript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WScript_RASMANCS
Operation:writeName:ConsoleTracingMask
Value:
4294901760
Executable files
3
Suspicious files
0
Text files
20
Unknown types
0

Dropped files

PID
Process
Filename
Type
3648radA544F.tmpC:\Users\admin\AppData\Local\Temp\6893A5D897\state.tmp
MD5:
SHA256:
3648radA544F.tmpC:\Users\admin\AppData\Local\Temp\6893A5D897\unverified-microdesc-consensus.tmp
MD5:
SHA256:
3648radA544F.tmpC:\Users\admin\AppData\Local\Temp\6893A5D897\cached-certs.tmp
MD5:
SHA256:
3648radA544F.tmpC:\Users\admin\AppData\Local\Temp\6893A5D897\cached-microdesc-consensus.tmp
MD5:
SHA256:
3648radA544F.tmpC:\Users\admin\AppData\Local\Temp\6893A5~1\unverified-microdesc-consensustext
MD5:AFEFD64721E3D62E80DAF4A62C139FED
SHA256:F53C34C5BD2220F529B0A522A4E90E869B788AA2C3A8E3C1959B2A62ADB0DB58
3648radA544F.tmpC:\Users\admin\AppData\Local\Temp\6893A5D897\cached-microdescs.newtext
MD5:43629F112FA7911DCBBECD67C1E0CFB1
SHA256:190EF1E335ED79C73098E298985E41BEE2F58A7D430273182E1855B49046D2D9
2860WScript.exeC:\Users\admin\AppData\Local\Temp\radA544F.tmpexecutable
MD5:676740F0607965D86455D5F16E364C1A
SHA256:1C06B518A94AD6DB106D7D31626F2A7C80BD03F0DCD6D0BC450FFAC1750CDF79
2860WScript.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\messg[1].jpgexecutable
MD5:676740F0607965D86455D5F16E364C1A
SHA256:1C06B518A94AD6DB106D7D31626F2A7C80BD03F0DCD6D0BC450FFAC1750CDF79
3648radA544F.tmpC:\ProgramData\Windows\csrss.exeexecutable
MD5:676740F0607965D86455D5F16E364C1A
SHA256:1C06B518A94AD6DB106D7D31626F2A7C80BD03F0DCD6D0BC450FFAC1750CDF79
3648radA544F.tmpC:\Users\admin\AppData\Local\Temp\6893A5~1\cached-certstext
MD5:E7283CE392F8D30E33233F59CCEAEE8E
SHA256:2653E2E13C92E088BF5DE296376D9107D7A48F10F6A19982D91C562B8D68CCE7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
6
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2860
WScript.exe
GET
200
5.39.31.164:80
http://taddactivity.net/wp-content/themes/imbalance2/libs/messg.jpg
FR
executable
1.40 Mb
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3648
radA544F.tmp
193.23.244.244:443
Chaos Computer Club e.V.
DE
malicious
2860
WScript.exe
5.39.31.164:80
taddactivity.net
OVH SAS
FR
suspicious
3648
radA544F.tmp
128.31.0.39:9101
Massachusetts Institute of Technology
US
malicious
3648
radA544F.tmp
163.172.53.84:21
Online S.a.s.
FR
suspicious
3648
radA544F.tmp
81.7.16.182:443
ISPpro Internet KG
DE
suspicious
3648
radA544F.tmp
93.186.200.144:9001
myLoc managed IT AG
DE
suspicious

DNS requests

Domain
IP
Reputation
taddactivity.net
  • 5.39.31.164
unknown

Threats

PID
Process
Class
Message
2860
WScript.exe
A Network Trojan was detected
ET CURRENT_EVENTS Likely Evil EXE download from MSXMLHTTP non-exe extension M2
2860
WScript.exe
A Network Trojan was detected
ET TROJAN JS/WSF Downloader Dec 08 2016 M4
2860
WScript.exe
Misc activity
SUSPICIOUS [PTsecurity] PE as Image Content type mismatch
3648
radA544F.tmp
Misc activity
ET POLICY TLS possible TOR SSL traffic
3648
radA544F.tmp
Potential Corporate Privacy Violation
POLICY [PTsecurity] TOR SSL connection
3648
radA544F.tmp
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 264
3648
radA544F.tmp
Potential Corporate Privacy Violation
POLICY [PTsecurity] TOR SSL connection
3648
radA544F.tmp
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 676
3648
radA544F.tmp
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 168
3648
radA544F.tmp
Misc activity
ET POLICY TLS possible TOR SSL traffic
2 ETPRO signatures available at the full report
No debug info