analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
download:

stroi-industr.zip

Full analysis: https://app.any.run/tasks/fb489076-57f1-4f73-871b-fcd70a29157e
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Analysis date: March 14, 2019, 16:47:44
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
loader
ransomware
troldesh
shade
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

63883AF756EF6CB1201D220ADD38AA1F

SHA1:

6BC44C86C5014DF40CD7D3550142119F3A509FFA

SHA256:

675ECAAAD0EDA1AA6646A2E844980DF981689B29D102225A52CA8CBE2BD6546C

SSDEEP:

48:9KdFaeOMEp+7RiDfkkKoNgCfPKa23Qfgc/bqcK82nNMoSs07L9Owo2fCQl:4MjpZDfMJCfPB2gffDqcK/NMHL7pl

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • rad3FA38.tmp (PID: 2128)
    • Changes the autorun value in the registry

      • rad3FA38.tmp (PID: 2128)
    • TROLDESH was detected

      • rad3FA38.tmp (PID: 2128)
    • Downloads executable files from the Internet

      • WScript.exe (PID: 2904)
  • SUSPICIOUS

    • Executes scripts

      • WinRAR.exe (PID: 3488)
    • Starts CMD.EXE for commands execution

      • WScript.exe (PID: 2904)
    • Executable content was dropped or overwritten

      • WScript.exe (PID: 2904)
      • rad3FA38.tmp (PID: 2128)
    • Starts application with an unusual extension

      • cmd.exe (PID: 3480)
    • Creates files in the program directory

      • rad3FA38.tmp (PID: 2128)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
33
Monitored processes
4
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs wscript.exe cmd.exe no specs #TROLDESH rad3fa38.tmp

Process information

PID
CMD
Path
Indicators
Parent process
3488"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\stroi-industr.zip"C:\Program Files\WinRAR\WinRAR.exeexplorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
2904"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIa3488.8618\Информация о заказе Група компаний Строй-Индустрия.jse" C:\Windows\System32\WScript.exe
WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
3480"C:\Windows\System32\cmd.exe" /c C:\Users\admin\AppData\Local\Temp\rad3FA38.tmpC:\Windows\System32\cmd.exeWScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2128C:\Users\admin\AppData\Local\Temp\rad3FA38.tmpC:\Users\admin\AppData\Local\Temp\rad3FA38.tmp
cmd.exe
User:
admin
Company:
Burnaware
Integrity Level:
MEDIUM
Description:
Verify Disc
Version:
8.3.0.0
Total events
616
Read events
569
Write events
47
Delete events
0

Modification events

(PID) Process:(3488) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3488) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3488) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3488) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\stroi-industr.zip
(PID) Process:(3488) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3488) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3488) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3488) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3488) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
Operation:writeName:@C:\Windows\System32\wshext.dll,-4805
Value:
JScript Encoded Script File
(PID) Process:(3488) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
Executable files
3
Suspicious files
0
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
2128rad3FA38.tmpC:\Users\admin\AppData\Local\Temp\6893A5D897\state.tmp
MD5:
SHA256:
3488WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa3488.8618\Информация о заказе Група компаний Строй-Индустрия.jsetext
MD5:8FCBF41195A56CC9EAAEC6EB903C120B
SHA256:1ECDA1FA1E7C5AAECB9EA7B669B798A688A35B65EFD96E190E97CC14299CCD1C
2128rad3FA38.tmpC:\Users\admin\AppData\Local\Temp\6893A5~1\statetext
MD5:F73FA6B98BC5DB4E1EE249DFD82C8B09
SHA256:2238DCE763EBC1FB3A45E2B4988522DF8A5C173EBDFD6FC0C869E8B80CBB9B48
2904WScript.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\msg[1].jpgexecutable
MD5:5B6401C25C4DB9C6552A24BCF72295B8
SHA256:6DDD0CE0A815DA44D73286130CF49016830B2F18329E65C4F54F487E910B0FE3
2128rad3FA38.tmpC:\ProgramData\Windows\csrss.exeexecutable
MD5:5B6401C25C4DB9C6552A24BCF72295B8
SHA256:6DDD0CE0A815DA44D73286130CF49016830B2F18329E65C4F54F487E910B0FE3
2904WScript.exeC:\Users\admin\AppData\Local\Temp\rad3FA38.tmpexecutable
MD5:5B6401C25C4DB9C6552A24BCF72295B8
SHA256:6DDD0CE0A815DA44D73286130CF49016830B2F18329E65C4F54F487E910B0FE3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
3
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2904
WScript.exe
GET
200
64.207.98.127:80
http://auroradx.com/adxwp/wp-content/backups-dup-pro/tmp/msg.jpg
US
executable
1.22 Mb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2128
rad3FA38.tmp
208.83.223.34:80
Applied Operations, LLC
US
malicious
2904
WScript.exe
89.46.7.234:80
unlockall.neagoeandrei.com
T-Mobile Czech Republic a.s.
RO
malicious
2904
WScript.exe
64.207.98.127:80
auroradx.com
Recol
US
suspicious

DNS requests

Domain
IP
Reputation
unlockall.neagoeandrei.com
  • 89.46.7.234
malicious
auroradx.com
  • 64.207.98.127
malicious

Threats

PID
Process
Class
Message
2904
WScript.exe
A Network Trojan was detected
ET CURRENT_EVENTS Likely Evil EXE download from MSXMLHTTP non-exe extension M2
2904
WScript.exe
A Network Trojan was detected
ET TROJAN JS/WSF Downloader Dec 08 2016 M4
2904
WScript.exe
Misc activity
SUSPICIOUS [PTsecurity] PE as Image Content type mismatch
2 ETPRO signatures available at the full report
No debug info