analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://cryptobinary-options.tradetoolsfx.com/administrator/cache/ural_726171.php

Full analysis: https://app.any.run/tasks/486573e9-142e-4706-a96c-5b9560254513
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Analysis date: May 24, 2019, 07:20:28
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
opendir
ransomware
troldesh
shade
Indicators:
MD5:

795424869AF6E1015957FC23FD075475

SHA1:

D618E09AAEA3196244F42F5D3390DD615FDE937F

SHA256:

5F337F1DA2E4982E9421B6A546BA12F5F3316B71215D02AD5C89EC8D6F64B378

SSDEEP:

3:N8K/JmWJfzbR3B5p6kTUnLVn:2K/kcX3Jcxn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Changes settings of System certificates

      • WScript.exe (PID: 3716)
    • Application was dropped or rewritten from another process

      • rad14F1C.tmp (PID: 1336)
    • TROLDESH was detected

      • rad14F1C.tmp (PID: 1336)
    • Changes the autorun value in the registry

      • rad14F1C.tmp (PID: 1336)
  • SUSPICIOUS

    • Creates files in the program directory

      • rad14F1C.tmp (PID: 1336)
    • Executable content was dropped or overwritten

      • WScript.exe (PID: 3716)
      • rad14F1C.tmp (PID: 1336)
    • Starts CMD.EXE for commands execution

      • WScript.exe (PID: 3716)
    • Starts application with an unusual extension

      • cmd.exe (PID: 3856)
    • Adds / modifies Windows certificates

      • WScript.exe (PID: 3716)
  • INFO

    • Changes internet zones settings

      • iexplore.exe (PID: 3932)
    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3932)
      • iexplore.exe (PID: 2576)
    • Manual execution by user

      • WinRAR.exe (PID: 3660)
      • WScript.exe (PID: 3716)
    • Creates files in the user directory

      • iexplore.exe (PID: 2576)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
6
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe winrar.exe no specs wscript.exe cmd.exe no specs #TROLDESH rad14f1c.tmp

Process information

PID
CMD
Path
Indicators
Parent process
3932"C:\Program Files\Internet Explorer\iexplore.exe" https://cryptobinary-options.tradetoolsfx.com/administrator/cache/ural_726171.phpC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2576"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3932 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3660"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Downloads\ural.zip"C:\Program Files\WinRAR\WinRAR.exeexplorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3716"C:\Windows\System32\WScript.exe" "C:\Users\admin\Downloads\Подробности заказа ОАО Авиакомпания Уральские авиалинии.js" C:\Windows\System32\WScript.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
3856"C:\Windows\System32\cmd.exe" /c C:\Users\admin\AppData\Local\Temp\rad14F1C.tmpC:\Windows\System32\cmd.exeWScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1336C:\Users\admin\AppData\Local\Temp\rad14F1C.tmpC:\Users\admin\AppData\Local\Temp\rad14F1C.tmp
cmd.exe
User:
admin
Company:
Glarysoft Ltd
Integrity Level:
MEDIUM
Description:
Registry Defrag
Version:
5.0.0.14
Total events
1 477
Read events
1 337
Write events
0
Delete events
0

Modification events

No data
Executable files
3
Suspicious files
3
Text files
10
Unknown types
4

Dropped files

PID
Process
Filename
Type
3932iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFC42E6C279531AB2C.TMP
MD5:
SHA256:
3932iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF35D25C04F588B692.TMP
MD5:
SHA256:
3932iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{701976C3-7DF4-11E9-A370-5254004A04AF}.dat
MD5:
SHA256:
3660WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3660.47255\Подробности заказа ОАО Авиакомпания Уральские авиалинии.js
MD5:
SHA256:
1336rad14F1C.tmpC:\Users\admin\AppData\Local\Temp\6893A5D897\state.tmp
MD5:
SHA256:
2576iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\CJ31CF5W\ural[1].zipcompressed
MD5:AC799004A0C2C98952A57F923AFC83F1
SHA256:EB70D8B16D839AAAF225857C4872B7CAAA47A3163BEF1C5FDC141EE0412AF334
2576iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.datdat
MD5:6996A6F9D9D5E32286132C6B2AEA8655
SHA256:4DC35FBC4A5764EE84D669CE1ECC844D5FB222F7E4B363D458851DE6E5146619
2576iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\JavaDeployReg.logtext
MD5:0FCE6F99C778D64B45692013F2B214A3
SHA256:2FD1C5F736682697D54DAE08F8FEF2D50CAC76C68028BE7353B92F9DB0857EC4
3932iexplore.exeC:\Users\admin\Downloads\ural.zipcompressed
MD5:AC799004A0C2C98952A57F923AFC83F1
SHA256:EB70D8B16D839AAAF225857C4872B7CAAA47A3163BEF1C5FDC141EE0412AF334
2576iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012019052420190525\index.datdat
MD5:4D7D051D56DC386FBBD76F9FBA453A1E
SHA256:4A96E8655CBBB01EE218C259B0E8D6787DBF49EF48C7D70E74796566AB72A22F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
6
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3716
WScript.exe
GET
301
95.216.12.141:80
http://kooolguru.com/wp-includes/ID3/1c.jpg
DE
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3716
WScript.exe
95.216.12.141:443
kooolguru.com
Hetzner Online GmbH
DE
suspicious
3716
WScript.exe
95.216.12.141:80
kooolguru.com
Hetzner Online GmbH
DE
suspicious
2576
iexplore.exe
85.93.145.251:443
cryptobinary-options.tradetoolsfx.com
JSC Internet-Cosmos
RU
unknown
3932
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
1336
rad14F1C.tmp
154.35.32.5:443
Rethem Hosting LLC
US
suspicious
3716
WScript.exe
188.165.53.185:443
www.moroccotours.info
OVH SAS
FR
malicious

DNS requests

Domain
IP
Reputation
cryptobinary-options.tradetoolsfx.com
  • 85.93.145.251
unknown
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
kooolguru.com
  • 95.216.12.141
unknown
www.moroccotours.info
  • 188.165.53.185
malicious

Threats

No threats detected
No debug info