| URL: | http://trca.es/wp-content/themes/responsive/core/css/fonts/thn.htm |
| Full analysis: | https://app.any.run/tasks/9b98b23c-aa7c-40a0-8797-6ec2cdd0a5e1 |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | March 14, 2019, 08:30:19 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MD5: | 673B9798A321220A2B735CBDD06BEBDA |
| SHA1: | 262FEC68E066EA4056B684C7511A6FF6B6116661 |
| SHA256: | 6D0DB6E79F369555F8CB25E3C50082A47F2F01F5F86DA6895B3DE49DCA03D6C8 |
| SSDEEP: | 3:N1KKXGxSVYAQrFfiMMKdQKGWWKWNrI:CKXG3AkFf0KqdRXc |
MALICIOUS
Application was dropped or rewritten from another process
- rad4D7D0.tmp (PID: 2140)
Downloads executable files from the Internet
- WScript.exe (PID: 1044)
Changes the autorun value in the registry
- rad4D7D0.tmp (PID: 2140)
TROLDESH was detected
- rad4D7D0.tmp (PID: 2140)
Deletes shadow copies
- rad4D7D0.tmp (PID: 2140)
Runs app for hidden code execution
- rad4D7D0.tmp (PID: 2140)
Actions looks like stealing of personal data
- rad4D7D0.tmp (PID: 2140)
Dropped file may contain instructions of ransomware
- rad4D7D0.tmp (PID: 2140)
Modifies files in Chrome extension folder
- rad4D7D0.tmp (PID: 2140)
SUSPICIOUS
Starts application with an unusual extension
- cmd.exe (PID: 2648)
- cmd.exe (PID: 3072)
Executable content was dropped or overwritten
- WScript.exe (PID: 1044)
- rad4D7D0.tmp (PID: 2140)
Connects to unusual port
- rad4D7D0.tmp (PID: 2140)
Starts CMD.EXE for commands execution
- WScript.exe (PID: 1044)
- rad4D7D0.tmp (PID: 2140)
Creates files in the program directory
- rad4D7D0.tmp (PID: 2140)
Checks for external IP
- rad4D7D0.tmp (PID: 2140)
Creates files like Ransomware instruction
- rad4D7D0.tmp (PID: 2140)
Creates files in the user directory
- rad4D7D0.tmp (PID: 2140)
INFO
Changes settings of System certificates
- chrome.exe (PID: 2884)
Creates files in the user directory
- chrome.exe (PID: 2884)
Reads Internet Cache Settings
- chrome.exe (PID: 2884)
Application launched itself
- chrome.exe (PID: 2884)
Dropped object may contain URL to Tor Browser
- rad4D7D0.tmp (PID: 2140)
Dropped object may contain Bitcoin addresses
- rad4D7D0.tmp (PID: 2140)
Dropped object may contain TOR URL's
- rad4D7D0.tmp (PID: 2140)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
71
Monitored processes
27
Malicious processes
3
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 968 | "C:\Windows\system32\vssadmin.exe" Delete Shadows /All /Quiet | C:\Windows\system32\vssadmin.exe | rad4D7D0.tmp | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Command Line Interface for Microsoft® Volume Shadow Copy Service Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1044 | "C:\Windows\System32\WScript.exe" "C:\Users\admin\Downloads\Группа компаний Рольф подробности заказа.js" | C:\Windows\System32\WScript.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 Modules
| |||||||||||||||
| 1416 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=872,2483152675597224098,10037370310120290366,131072 --enable-features=PasswordImport --disable-gpu-compositing --service-pipe-token=6E7F1A3EBC136225CD6C51E00A1DC9CE --lang=en-US --instant-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=6E7F1A3EBC136225CD6C51E00A1DC9CE --renderer-client-id=7 --mojo-platform-channel-handle=3428 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 68.0.3440.106 Modules
| |||||||||||||||
| 2140 | C:\Users\admin\AppData\Local\Temp\rad4D7D0.tmp | C:\Users\admin\AppData\Local\Temp\rad4D7D0.tmp | cmd.exe | ||||||||||||
User: admin Company: Burnaware Integrity Level: MEDIUM Description: Verify Disc Exit code: 0 Version: 8.3.0.0 Modules
| |||||||||||||||
| 2160 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=872,2483152675597224098,10037370310120290366,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=21114F86D579893E30960A8501751B60 --mojo-platform-channel-handle=3428 --ignored=" --type=renderer " /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 68.0.3440.106 Modules
| |||||||||||||||
| 2232 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=872,2483152675597224098,10037370310120290366,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAACAAwBAAQAAAAAAAAAAAGAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --service-request-channel-token=1FAC90B25512B23239E11864D30D18B8 --mojo-platform-channel-handle=952 --ignored=" --type=renderer " /prefetch:2 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 68.0.3440.106 Modules
| |||||||||||||||
| 2648 | "C:\Windows\System32\cmd.exe" /c C:\Users\admin\AppData\Local\Temp\rad4D7D0.tmp | C:\Windows\System32\cmd.exe | — | WScript.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2652 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=872,2483152675597224098,10037370310120290366,131072 --enable-features=PasswordImport --service-pipe-token=90CE50554CF5EE78690B314B4B64143F --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=90CE50554CF5EE78690B314B4B64143F --renderer-client-id=4 --mojo-platform-channel-handle=1896 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 68.0.3440.106 Modules
| |||||||||||||||
| 2680 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=872,2483152675597224098,10037370310120290366,131072 --enable-features=PasswordImport --disable-gpu-compositing --service-pipe-token=BA367F1ABE64C879A8F3505EF34A946A --lang=en-US --instant-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=BA367F1ABE64C879A8F3505EF34A946A --renderer-client-id=8 --mojo-platform-channel-handle=3816 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 68.0.3440.106 Modules
| |||||||||||||||
| 2772 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=872,2483152675597224098,10037370310120290366,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=D533B629BF326964CFFE3E87FDF183AC --mojo-platform-channel-handle=4008 --ignored=" --type=renderer " /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 68.0.3440.106 Modules
| |||||||||||||||
Total events
868
Read events
744
Write events
120
Delete events
4
Modification events
| (PID) Process: | (2884) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | failed_count |
Value: 0 | |||
| (PID) Process: | (2884) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | state |
Value: 2 | |||
| (PID) Process: | (2884) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | state |
Value: 1 | |||
| (PID) Process: | (3060) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes |
| Operation: | write | Name: | 2884-13197025839708875 |
Value: 259 | |||
| (PID) Process: | (2884) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96} |
| Operation: | write | Name: | dr |
Value: 1 | |||
| (PID) Process: | (2884) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome |
| Operation: | write | Name: | UsageStatsInSample |
Value: 0 | |||
| (PID) Process: | (2884) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes |
| Operation: | delete value | Name: | 3516-13180984670829101 |
Value: 0 | |||
| (PID) Process: | (2884) chrome.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96} |
| Operation: | write | Name: | usagestats |
Value: 0 | |||
| (PID) Process: | (2884) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes |
| Operation: | delete value | Name: | 2884-13197025839708875 |
Value: 259 | |||
| (PID) Process: | (2884) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96} |
| Operation: | write | Name: | metricsid |
Value: | |||
Executable files
3
Suspicious files
1 192
Text files
156
Unknown types
28
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2884 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old | — | |
MD5:— | SHA256:— | |||
| 2884 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\7deb4aec-cc8f-403c-9785-cbc5c113f0af.tmp | — | |
MD5:— | SHA256:— | |||
| 2884 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB\000016.dbtmp | — | |
MD5:— | SHA256:— | |||
| 2884 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000016.dbtmp | — | |
MD5:— | SHA256:— | |||
| 2884 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old~RF198785.TMP | text | |
MD5:— | SHA256:— | |||
| 2884 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\50b9b89c-a2cd-4e27-8b00-3a2948ce1dcf.tmp | — | |
MD5:— | SHA256:— | |||
| 2884 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG.old~RF1987a5.TMP | text | |
MD5:— | SHA256:— | |||
| 2884 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old~RF198785.TMP | text | |
MD5:— | SHA256:— | |||
| 2884 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\b384ace4-47b9-473c-8dac-ddcb13f3f588.tmp | — | |
MD5:— | SHA256:— | |||
| 2884 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG.old | text | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
77
DNS requests
36
Threats
48
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2140 | rad4D7D0.tmp | GET | 403 | 104.16.154.36:80 | http://whatismyipaddress.com/ | US | text | 100 b | shared |
1044 | WScript.exe | GET | 200 | 198.38.82.163:80 | http://sandyzkitchen.com/wp/wp-admin/css/colors/blue/msges.jpg | US | executable | 1.22 Mb | malicious |
2140 | rad4D7D0.tmp | GET | 403 | 104.16.154.36:80 | http://whatismyipaddress.com/ | US | text | 100 b | shared |
2140 | rad4D7D0.tmp | GET | 403 | 104.16.154.36:80 | http://whatismyipaddress.com/ | US | text | 100 b | shared |
2140 | rad4D7D0.tmp | GET | 403 | 104.16.154.36:80 | http://whatismyipaddress.com/ | US | text | 100 b | shared |
2140 | rad4D7D0.tmp | GET | 403 | 104.16.154.36:80 | http://whatismyipaddress.com/ | US | text | 100 b | shared |
2140 | rad4D7D0.tmp | GET | 403 | 104.16.154.36:80 | http://whatismyipaddress.com/ | US | text | 100 b | shared |
2140 | rad4D7D0.tmp | GET | 200 | 104.18.35.131:80 | http://whatsmyip.net/ | US | html | 7.35 Kb | shared |
2140 | rad4D7D0.tmp | GET | 403 | 104.16.154.36:80 | http://whatismyipaddress.com/ | US | text | 100 b | shared |
2140 | rad4D7D0.tmp | GET | 403 | 104.16.154.36:80 | http://whatismyipaddress.com/ | US | text | 100 b | shared |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2884 | chrome.exe | 172.217.168.227:443 | www.google.de | Google Inc. | US | whitelisted |
2884 | chrome.exe | 216.58.205.228:443 | www.google.com | Google Inc. | US | whitelisted |
2884 | chrome.exe | 172.217.18.99:443 | www.google.lt | Google Inc. | US | whitelisted |
2884 | chrome.exe | 172.217.16.131:443 | fonts.gstatic.com | Google Inc. | US | whitelisted |
2884 | chrome.exe | 172.217.21.202:443 | fonts.googleapis.com | Google Inc. | US | whitelisted |
2884 | chrome.exe | 172.217.22.14:443 | apis.google.com | Google Inc. | US | whitelisted |
2884 | chrome.exe | 185.2.128.134:80 | trca.es | UK Webhosting Ltd | GB | suspicious |
2884 | chrome.exe | 216.58.205.227:443 | www.gstatic.com | Google Inc. | US | whitelisted |
2884 | chrome.exe | 172.217.16.195:443 | clientservices.googleapis.com | Google Inc. | US | whitelisted |
2884 | chrome.exe | 136.144.173.55:443 | webmail.albertgrafica.com.br | Transip B.V. | NL | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
trca.es |
| malicious |
clientservices.googleapis.com |
| whitelisted |
www.gstatic.com |
| whitelisted |
accounts.google.com |
| shared |
webmail.albertgrafica.com.br |
| unknown |
sb-ssl.google.com |
| whitelisted |
www.rolf.ru |
| unknown |
ssl.gstatic.com |
| whitelisted |
safebrowsing.googleapis.com |
| whitelisted |
www.google.de |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
1044 | WScript.exe | A Network Trojan was detected | ET CURRENT_EVENTS Likely Evil EXE download from MSXMLHTTP non-exe extension M2 |
1044 | WScript.exe | A Network Trojan was detected | ET TROJAN JS/WSF Downloader Dec 08 2016 M4 |
1044 | WScript.exe | Misc activity | SUSPICIOUS [PTsecurity] PE as Image Content type mismatch |
2140 | rad4D7D0.tmp | Misc Attack | ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 182 |
2140 | rad4D7D0.tmp | Misc activity | ET POLICY TLS possible TOR SSL traffic |
2140 | rad4D7D0.tmp | Potential Corporate Privacy Violation | POLICY [PTsecurity] TOR SSL connection |
2140 | rad4D7D0.tmp | Misc Attack | ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 161 |
2140 | rad4D7D0.tmp | Misc Attack | ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 698 |
2140 | rad4D7D0.tmp | Misc Attack | ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 285 |
2140 | rad4D7D0.tmp | Potential Corporate Privacy Violation | POLICY [PTsecurity] TOR SSL connection |
25 ETPRO signatures available at the full report