analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

SalesContractConfirmation0928374839874839874839Output.js

Full analysis: https://app.any.run/tasks/3f33536d-1f0e-4279-9ae7-57bb3ad46d04
Verdict: Malicious activity
Analysis date: February 18, 2019, 16:20:58
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
autoit
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines, with CRLF line terminators
MD5:

3D480CBE635276CF9DF90AB197E464E6

SHA1:

75A44FE695CD64F1DB23DBFFA35683C938472A90

SHA256:

748C4476E1709728948FE84AD83B40F57BC7569E2967FA33BF32FE144780B55C

SSDEEP:

49152:TtiWeeav3fDbTL5Ct0CyAGG0j8y/QNUEXn5OE1Sds9:P

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • voMrVmMgGtyPGg.scr (PID: 3976)
      • ign.exe (PID: 4092)
      • ign.exe (PID: 2496)

    • Changes the autorun value in the registry

      • ign.exe (PID: 2496)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • voMrVmMgGtyPGg.scr (PID: 3976)
      • WScript.exe (PID: 3660)

    • Drop AutoIt3 executable file

      • voMrVmMgGtyPGg.scr (PID: 3976)

    • Starts application with an unusual extension

      • WScript.exe (PID: 3660)

    • Connects to unusual port

      • RegSvcs.exe (PID: 3624)

    • Application launched itself

      • ign.exe (PID: 4092)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • voMrVmMgGtyPGg.scr (PID: 3976)
      • ign.exe (PID: 4092)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
35
Monitored processes
5
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start start drop and start wscript.exe vomrvmmggtypgg.scr ign.exe no specs ign.exe regsvcs.exe

Process information

PID
CMD
Path
Indicators
Parent process
3660"C:\Windows\System32\WScript.exe" "C:\Users\admin\Desktop\SalesContractConfirmation0928374839874839874839Output.js"C:\Windows\System32\WScript.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
3976"C:\Users\admin\AppData\Local\Temp\voMrVmMgGtyPGg.scr" /SC:\Users\admin\AppData\Local\Temp\voMrVmMgGtyPGg.scr
WScript.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
4092"C:\Users\admin\AppData\Local\Temp\64465499\ign.exe" ksx=blo C:\Users\admin\AppData\Local\Temp\64465499\ign.exe—voMrVmMgGtyPGg.scr
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script
Exit code:
0
Version:
3, 3, 14, 5
2496C:\Users\admin\AppData\Local\Temp\64465499\ign.exe C:\Users\admin\AppData\Local\Temp\64465499\JQHTUC:\Users\admin\AppData\Local\Temp\64465499\ign.exe
ign.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script
Exit code:
0
Version:
3, 3, 14, 5
3624"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
ign.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Services Installation Utility
Version:
4.6.1055.0 built by: NETFXREL2
Total events
763
Read events
753
Write events
10
Delete events
0

Modification events

(PID) Process:(3660) WScript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3660) WScript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3976) voMrVmMgGtyPGg.scrKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3976) voMrVmMgGtyPGg.scrKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(2496) ign.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:WindowsUpdate
Value:
C:\Users\admin\AppData\Local\Temp\64465499\ign.exe C:\Users\admin\AppData\Local\Temp\64465499\KSX_BL~1
Executable files
2
Suspicious files
0
Text files
49
Unknown types
0

Dropped files

PID
Process
Filename
Type
3976voMrVmMgGtyPGg.scrC:\Users\admin\AppData\Local\Temp\64465499\gfe.icotext
MD5:11DEFBA67133BE46720186ADD3E722CB
SHA256:A077EBC679A9F68BB850B619A5F89DF0822D43C4D604796073AD18DB90D098AA
3976voMrVmMgGtyPGg.scrC:\Users\admin\AppData\Local\Temp\64465499\psh.jpgtext
MD5:9AEDFB8C0D8D5ADE4281CA3B0383E967
SHA256:4400FA5D1783502EDF593AB0FE7F54D8AEDF9ECB62B4678B18DCE095341A1B02
3976voMrVmMgGtyPGg.scrC:\Users\admin\AppData\Local\Temp\64465499\ocq.docxtext
MD5:D7D93F0EE007D9B40D813ADBB50FC546
SHA256:F6A67EC64170A3DDB166F6C4C8A47641D322B72C88EFABF3D32083951D4CBC2B
3976voMrVmMgGtyPGg.scrC:\Users\admin\AppData\Local\Temp\64465499\wxi.mp4text
MD5:69B06E4AA477CD4FE94B1B35078F2DC1
SHA256:7328C57726C9F7A7D910D88435C0598A32D72DDB767BF0E0593438AB4AB5F1B5
3976voMrVmMgGtyPGg.scrC:\Users\admin\AppData\Local\Temp\64465499\ksx=blotext
MD5:DEEBF38DE35A3BD1DCBD4C6EB463B637
SHA256:C66FAB255C3B91B8A5FAABC405E044D6ED20C89D311DFB830EE02E8E251C6CB3
3976voMrVmMgGtyPGg.scrC:\Users\admin\AppData\Local\Temp\64465499\gea.icmtext
MD5:656A443BCA8E5554171C4D94517B957A
SHA256:3AEA4177EE1640FACA606170131CDB0CC6DDBE0883C14E912560F3FEE9BE5070
3660WScript.exeC:\Users\admin\AppData\Local\Temp\voMrVmMgGtyPGg.screxecutable
MD5:0CCFBDB777D14F2ADE09FF4BFA7E0EC1
SHA256:6AA1B829D07E5DFB4B6F5983523605DF398603E14B8F83EC3256B5E3E8A0E176
3976voMrVmMgGtyPGg.scrC:\Users\admin\AppData\Local\Temp\64465499\gtl.jpgtext
MD5:74BC0104E6DA688A0EB9463A70172922
SHA256:2D84D067F64D2C57A0261319BF773884C8C0694EC8CD20FD503307FB825E9C18
3976voMrVmMgGtyPGg.scrC:\Users\admin\AppData\Local\Temp\64465499\ece.icmtext
MD5:A42C60B77B4EEC327E75A580999E1080
SHA256:3F9AFBDC6A591B483763ADD1054CBF4CCFCE9B70D765FDE8D398AC64C68F0889
3976voMrVmMgGtyPGg.scrC:\Users\admin\AppData\Local\Temp\64465499\gke.pdftext
MD5:689B07C01132148BFBAE0EE38E803C81
SHA256:9F4576228A93F6584E9171436689F74C6A6BEDF51BF94EC6C7EB9C76EDF63793
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
8
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3624
RegSvcs.exe
185.247.228.73:5592
mrstan.duckdns.org
—
—
malicious

DNS requests

Domain
IP
Reputation
mrstan.duckdns.org
  • 185.247.228.73
malicious

Threats

PID
Process
Class
Message
—
—
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
SalesContractConfirmation0928374839874839874839Output.js