| File name: | Сверить данные февраль.rar |
| Full analysis: | https://app.any.run/tasks/53ee6083-7580-4da7-9079-2bda462c6ab6 |
| Verdict: | Malicious activity |
| Threats: | Ursnif is a banking Trojan that usually infects corporate victims. It is based on an old malware but was substantially updated over the years and became quite powerful. Today Ursnif is one of the most widely spread banking Trojans in the world. |
| Analysis date: | February 18, 2019, 15:07:36 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-rar |
| File info: | RAR archive data, v5 |
| MD5: | 38D6EAA0F4DBA8F5B935AF46266870D1 |
| SHA1: | 07F7C3FD0575899328CFD0BA91E7D4DE72979778 |
| SHA256: | 9072556EAFDF2C8838CCD3F8C1405F3A6F44915956835E92C363732F25B2B7AD |
| SSDEEP: | 6144:nb/Fg01XYflKxGU7cZ/z4kVzhPG8ha0PpLObAsjwHaxOI0q:nb/m01KlKxyZ/EkVzZRha4LRN/Ib |
MALICIOUS
Application was dropped or rewritten from another process
- Сверить данные февраль.exe (PID: 4044)
Loads dropped or rewritten executable
- Сверить данные февраль.exe (PID: 4044)
- rundll32.exe (PID: 3100)
- explorer.exe (PID: 116)
Loads the Task Scheduler COM API
- Сверить данные февраль.exe (PID: 4044)
URSNIF was detected
- rundll32.exe (PID: 3100)
SUSPICIOUS
Creates files in the user directory
- explorer.exe (PID: 116)
Reads Internet Cache Settings
- explorer.exe (PID: 116)
Executable content was dropped or overwritten
- WinRAR.exe (PID: 3072)
- Сверить данные февраль.exe (PID: 4044)
Creates files in the program directory
- Сверить данные февраль.exe (PID: 4044)
Connects to unusual port
- rundll32.exe (PID: 3100)
INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .rar | | | RAR compressed archive (v5.0) (61.5) |
|---|---|---|
| .rar | | | RAR compressed archive (gen) (38.4) |
Total processes
35
Monitored processes
4
Malicious processes
3
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 116 | C:\Windows\Explorer.EXE | C:\Windows\explorer.exe | — | — | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3072 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Сверить данные февраль.rar" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 Modules
| |||||||||||||||
| 3100 | rundll32.exe "C:\ProgramData\2401bf603c90\2702bc633f93.dat",DllGetClassObject root | C:\Windows\system32\rundll32.exe | taskeng.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 4044 | "C:\Users\admin\Desktop\Сверить данные февраль.exe" | C:\Users\admin\Desktop\Сверить данные февраль.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
Total events
3 017
Read events
2 966
Write events
49
Delete events
2
Modification events
| (PID) Process: | (3072) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (3072) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (3072) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (3072) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\Desktop\Сверить данные февраль.rar | |||
| (PID) Process: | (3072) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (3072) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (3072) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (3072) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (116) explorer.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rar\OpenWithList |
| Operation: | write | Name: | a |
Value: WinRAR.exe | |||
| (PID) Process: | (116) explorer.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rar\OpenWithList |
| Operation: | write | Name: | MRUList |
Value: a | |||
Executable files
4
Suspicious files
1
Text files
0
Unknown types
4
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3100 | rundll32.exe | C:\Users\admin\AppData\Local\Temp\C867.tmp | — | |
MD5:— | SHA256:— | |||
| 3100 | rundll32.exe | C:\Users\admin\AppData\Local\Temp\bamianhhglknapgm | — | |
MD5:— | SHA256:— | |||
| 3100 | rundll32.exe | C:\Users\admin\Desktop\Сверить данные февраль.exe | — | |
MD5:— | SHA256:— | |||
| 3100 | rundll32.exe | C:\Users\admin\Desktop\behngdkgbffcehfd | — | |
MD5:— | SHA256:— | |||
| 116 | explorer.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\Сверить данные февраль.rar.lnk | lnk | |
MD5:— | SHA256:— | |||
| 116 | explorer.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\1b4dd67f29cb1962.automaticDestinations-ms | automaticdestinations-ms | |
MD5:— | SHA256:— | |||
| 116 | explorer.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012019021820190219\index.dat | dat | |
MD5:— | SHA256:— | |||
| 3072 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3072.49266\Сверить данные февраль.exe | executable | |
MD5:— | SHA256:— | |||
| 116 | explorer.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\290532160612e071.automaticDestinations-ms | automaticdestinations-ms | |
MD5:— | SHA256:— | |||
| 116 | explorer.exe | C:\Users\admin\Desktop\Сверить данные февраль.exe | executable | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
64
DNS requests
3
Threats
96
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3100 | rundll32.exe | GET | 200 | 178.62.9.171:80 | http://myip.ru/index_small.php | GB | html | 319 b | malicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3100 | rundll32.exe | 178.62.9.171:80 | myip.ru | Digital Ocean, Inc. | GB | malicious |
3100 | rundll32.exe | 37.48.120.47:2195 | — | LeaseWeb Netherlands B.V. | NL | suspicious |
3100 | rundll32.exe | 94.23.247.42:443 | — | OVH SAS | FR | suspicious |
3100 | rundll32.exe | 145.239.1.97:443 | — | OVH SAS | DE | suspicious |
3100 | rundll32.exe | 193.81.216.170:9001 | — | A1 Telekom Austria AG | AT | unknown |
3100 | rundll32.exe | 217.31.161.55:8443 | — | Bahnhof Internet AB | SE | suspicious |
3100 | rundll32.exe | 145.239.85.208:443 | — | OVH SAS | PL | suspicious |
3100 | rundll32.exe | 185.80.222.105:9001 | — | UK-2 Limited | NL | suspicious |
3100 | rundll32.exe | 176.31.43.51:9001 | — | OVH SAS | FR | suspicious |
3100 | rundll32.exe | 81.221.222.211:9095 | — | green.ch AG | CH | suspicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
myip.ru |
| unknown |
dns.msftncsi.com |
| shared |
Threats
PID | Process | Class | Message |
|---|---|---|---|
3100 | rundll32.exe | Potential Corporate Privacy Violation | ET POLICY myip.ru IP lookup |
3100 | rundll32.exe | Misc Attack | ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 446 |
3100 | rundll32.exe | Misc activity | ET POLICY TLS possible TOR SSL traffic |
3100 | rundll32.exe | Misc Attack | ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 707 |
3100 | rundll32.exe | Misc Attack | ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 143 |
3100 | rundll32.exe | Misc Attack | ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 354 |
3100 | rundll32.exe | Misc Attack | ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 627 |
3100 | rundll32.exe | Misc activity | ET POLICY TLS possible TOR SSL traffic |
3100 | rundll32.exe | Misc Attack | ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 181 |
3100 | rundll32.exe | Misc activity | ET POLICY TLS possible TOR SSL traffic |