analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

kittens.ps1

Full analysis: https://app.any.run/tasks/09282f4b-d188-44c9-8e04-a9f90e62aacb
Verdict: Malicious activity
Threats:

NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website.

Malware Trends Tracker     >>>
Analysis date: August 13, 2019, 20:14:00
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
nanocore
rat
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines
MD5:

35BB05648980F3F1985DF90D503F20A6

SHA1:

207A530C3D8B2D98E863BCF0451FE7EE01525987

SHA256:

8346405BBA6B2A758420A0BEC4A700FAA37AEE2565F368633002A81EB17D517C

SSDEEP:

24576:5ikwFvFYM/ec7VHHKXSo7weddTowzcERlDXMGqPovOHFvxcY8m3:g9ZKM6weDF0GqLHhv

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • jisv.exe (PID: 2904)
      • RegAsm.exe (PID: 2256)

    • Changes the autorun value in the registry

      • jisv.exe (PID: 2904)
      • RegAsm.exe (PID: 2256)

    • NanoCore was detected

      • RegAsm.exe (PID: 2256)

    • Connects to CnC server

      • RegAsm.exe (PID: 2256)

  • SUSPICIOUS

    • Creates files in the user directory

      • powershell.exe (PID: 3876)
      • RegAsm.exe (PID: 2256)

    • Suspicious files were dropped or overwritten

      • jisv.exe (PID: 2904)

    • Executable content was dropped or overwritten

      • jisv.exe (PID: 2904)
      • powershell.exe (PID: 3876)
      • RegAsm.exe (PID: 2256)

    • PowerShell script executed

      • powershell.exe (PID: 3876)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
3
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start powershell.exe jisv.exe #NANOCORE regasm.exe

Process information

PID
CMD
Path
Indicators
Parent process
3876"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "-file" "C:\Users\admin\Downloads\kittens.ps1"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2904"C:\Users\Public\jisv.exe"C:\Users\Public\jisv.exe
powershell.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2256"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
jisv.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Version:
2.0.50727.5420 (Win7SP1.050727-5400)
Total events
255
Read events
194
Write events
0
Delete events
0

Modification events

No data
Executable files
3
Suspicious files
2
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
3876powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\S1J2VDJQ2A28YHOY4FJQ.temp —
MD5:—
SHA256:—
3876powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF36e8f2.TMPbinary
MD5:A25A3218432767D044A42DFB20430D13
SHA256:89B8F26BBB4687757C87D5EF3D77646AF493AFFCF68B572BD2D4D5CE07C97BE7
2256RegAsm.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\run.dattext
MD5:69258E5BB26693208FA23E9161C27EB0
SHA256:6B6B6925F0866EF8E86015456E7B50BF194F8B54F8A0A08E47F32743D3B83576
2904jisv.exeC:\Users\Public\EcqdWJQTvB.vbstext
MD5:6D35F246E672BB263AF05280B951E37B
SHA256:6F9A85CBACEB464B2C48E9F76E373591E0FC81C4E73F11A3F003D3A9265BAA6F
3876powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:A25A3218432767D044A42DFB20430D13
SHA256:89B8F26BBB4687757C87D5EF3D77646AF493AFFCF68B572BD2D4D5CE07C97BE7
2904jisv.exeC:\Users\admin\appraiser\nslookup.batexecutable
MD5:1625FAD0E2FD0DDC9699F1506DEC4D50
SHA256:2F2FBE5837D5CC9C399E6C77C05B3AE5E4FFE0B797E08ADC391FC69A77614F87
3876powershell.exeC:\Users\Public\jisv.exeexecutable
MD5:EF4B6D05DB9A3F862125619D7E6A1229
SHA256:A0F090BF11D3B9E9A83603CC4363515CF2879DD63E8EB6A91F523E4FF115DCFB
2256RegAsm.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\TCP Monitor\tcpmon.exeexecutable
MD5:278EDBD499374BF73621F8C1F969D894
SHA256:C6999B9F79932C3B4F1C461A69D9DC8DC301D6A155ABC33EFE1B6E9E4A038391
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
6
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2256
RegAsm.exe
79.134.225.96:5556
—
Andreas Fink trading as Fink Telecom Services
CH
malicious

DNS requests

No data

Threats

PID
Process
Class
Message
2256
RegAsm.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 60B
2256
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
2256
RegAsm.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 60B
2256
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
2256
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
2256
RegAsm.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 60B
2256
RegAsm.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 60B
2256
RegAsm.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 60B
2256
RegAsm.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 60B
2256
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
4 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
kittens.ps1