File name:

TICKET%2083992883992AIR8389494VERVED37783PDF.7z

Full analysis: https://app.any.run/tasks/fda3143b-cf95-44ee-93d2-40dbec14b0a6
Verdict: Malicious activity
Threats:

NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website.

Malware Trends Tracker     >>>
Analysis date: June 12, 2019, 01:25:49
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
nanocore
trojan
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

7DEBDC1CB4B638EE8604C18926853C82

SHA1:

0A34977E447551DA93ECAFB56CF36161C49ABDE2

SHA256:

94431A01FE024B4F4F1EA3ED43A5639E955A96C93362587DBBF7BA36CCB91A5E

SSDEEP:

6144:CeZp1FLLl3Ry+KlMPD2R0sTWeCKp5mQC23C7GD698DUkstC9QwW39geKs:f15RlyoO0lVKp5/76sj39yz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • TICKET 83992883992AIR8389494VERVED37783PDF.exe (PID: 1076)
      • TICKET 83992883992AIR8389494VERVED37783PDF.exe (PID: 1380)
      • TICKET 83992883992AIR8389494VERVED37783PDF.exe (PID: 2088)
      • TICKET 83992883992AIR8389494VERVED37783PDF.exe (PID: 1812)
      • TICKET 83992883992AIR8389494VERVED37783PDF.exe (PID: 2552)
      • TICKET 83992883992AIR8389494VERVED37783PDF.exe (PID: 3632)
      • TICKET 83992883992AIR8389494VERVED37783PDF.exe (PID: 2268)
      • TICKET 83992883992AIR8389494VERVED37783PDF.exe (PID: 584)

    • Uses Task Scheduler to run other applications

      • TICKET 83992883992AIR8389494VERVED37783PDF.exe (PID: 2088)
      • TICKET 83992883992AIR8389494VERVED37783PDF.exe (PID: 1380)
      • TICKET 83992883992AIR8389494VERVED37783PDF.exe (PID: 1076)
      • TICKET 83992883992AIR8389494VERVED37783PDF.exe (PID: 1812)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 3488)
      • schtasks.exe (PID: 1156)
      • schtasks.exe (PID: 2464)
      • schtasks.exe (PID: 2764)

    • NanoCore was detected

      • TICKET 83992883992AIR8389494VERVED37783PDF.exe (PID: 2552)

    • Changes the autorun value in the registry

      • TICKET 83992883992AIR8389494VERVED37783PDF.exe (PID: 2552)

    • Connects to CnC server

      • TICKET 83992883992AIR8389494VERVED37783PDF.exe (PID: 2552)

    • Actions looks like stealing of personal data

      • vbc.exe (PID: 1660)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3392)
      • TICKET 83992883992AIR8389494VERVED37783PDF.exe (PID: 2088)
      • TICKET 83992883992AIR8389494VERVED37783PDF.exe (PID: 2552)

    • Creates files in the user directory

      • TICKET 83992883992AIR8389494VERVED37783PDF.exe (PID: 2088)
      • TICKET 83992883992AIR8389494VERVED37783PDF.exe (PID: 2552)

    • Application launched itself

      • TICKET 83992883992AIR8389494VERVED37783PDF.exe (PID: 2088)
      • TICKET 83992883992AIR8389494VERVED37783PDF.exe (PID: 1812)
      • TICKET 83992883992AIR8389494VERVED37783PDF.exe (PID: 1380)
      • TICKET 83992883992AIR8389494VERVED37783PDF.exe (PID: 1076)

    • Executes scripts

      • TICKET 83992883992AIR8389494VERVED37783PDF.exe (PID: 2552)

    • Loads DLL from Mozilla Firefox

      • vbc.exe (PID: 2324)

  • INFO

    • Manual execution by user

      • TICKET 83992883992AIR8389494VERVED37783PDF.exe (PID: 2088)
      • TICKET 83992883992AIR8389494VERVED37783PDF.exe (PID: 1812)
      • TICKET 83992883992AIR8389494VERVED37783PDF.exe (PID: 1380)
      • TICKET 83992883992AIR8389494VERVED37783PDF.exe (PID: 1076)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
54
Monitored processes
15
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winrar.exe ticket 83992883992air8389494verved37783pdf.exe ticket 83992883992air8389494verved37783pdf.exe no specs ticket 83992883992air8389494verved37783pdf.exe no specs ticket 83992883992air8389494verved37783pdf.exe schtasks.exe no specs #NANOCORE ticket 83992883992air8389494verved37783pdf.exe vbc.exe vbc.exe no specs schtasks.exe no specs ticket 83992883992air8389494verved37783pdf.exe no specs schtasks.exe no specs ticket 83992883992air8389494verved37783pdf.exe no specs schtasks.exe no specs ticket 83992883992air8389494verved37783pdf.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
584"C:\Users\admin\Desktop\TICKET 83992883992AIR8389494VERVED37783PDF.exe"C:\Users\admin\Desktop\TICKET 83992883992AIR8389494VERVED37783PDF.exe—TICKET 83992883992AIR8389494VERVED37783PDF.exe
User:
admin
Integrity Level:
HIGH
Description:
WCF Discovery Client
Exit code:
0
Version:
1.4.4.0
Modules
Images
c:\users\admin\desktop\ticket 83992883992air8389494verved37783pdf.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1076"C:\Users\admin\Desktop\TICKET 83992883992AIR8389494VERVED37783PDF.exe" C:\Users\admin\Desktop\TICKET 83992883992AIR8389494VERVED37783PDF.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
WCF Discovery Client
Exit code:
0
Version:
1.4.4.0
Modules
Images
c:\users\admin\desktop\ticket 83992883992air8389494verved37783pdf.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1156"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\EzvLxlvnUHcS" /XML "C:\Users\admin\AppData\Local\Temp\tmpABD3.tmp"C:\Windows\System32\schtasks.exe—TICKET 83992883992AIR8389494VERVED37783PDF.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1380"C:\Users\admin\Desktop\TICKET 83992883992AIR8389494VERVED37783PDF.exe" C:\Users\admin\Desktop\TICKET 83992883992AIR8389494VERVED37783PDF.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
WCF Discovery Client
Exit code:
0
Version:
1.4.4.0
Modules
Images
c:\users\admin\desktop\ticket 83992883992air8389494verved37783pdf.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1660"c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe" /shtml "C:\Users\admin\AppData\Local\Temp\osp0rviw.flj"c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
TICKET 83992883992AIR8389494VERVED37783PDF.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual Basic Command Line Compiler
Exit code:
0
Version:
8.0.50727.5420
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
1812"C:\Users\admin\Desktop\TICKET 83992883992AIR8389494VERVED37783PDF.exe" C:\Users\admin\Desktop\TICKET 83992883992AIR8389494VERVED37783PDF.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
WCF Discovery Client
Exit code:
0
Version:
1.4.4.0
Modules
Images
c:\users\admin\desktop\ticket 83992883992air8389494verved37783pdf.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2088"C:\Users\admin\Desktop\TICKET 83992883992AIR8389494VERVED37783PDF.exe" C:\Users\admin\Desktop\TICKET 83992883992AIR8389494VERVED37783PDF.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
WCF Discovery Client
Exit code:
0
Version:
1.4.4.0
Modules
Images
c:\users\admin\desktop\ticket 83992883992air8389494verved37783pdf.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2268"C:\Users\admin\Desktop\TICKET 83992883992AIR8389494VERVED37783PDF.exe"C:\Users\admin\Desktop\TICKET 83992883992AIR8389494VERVED37783PDF.exe—TICKET 83992883992AIR8389494VERVED37783PDF.exe
User:
admin
Integrity Level:
MEDIUM
Description:
WCF Discovery Client
Exit code:
0
Version:
1.4.4.0
Modules
Images
c:\users\admin\desktop\ticket 83992883992air8389494verved37783pdf.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2324"c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe" /shtml "C:\Users\admin\AppData\Local\Temp\zhjdtomb.a13"c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe—TICKET 83992883992AIR8389494VERVED37783PDF.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual Basic Command Line Compiler
Exit code:
0
Version:
8.0.50727.5420
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
2464"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\EzvLxlvnUHcS" /XML "C:\Users\admin\AppData\Local\Temp\tmpDF67.tmp"C:\Windows\System32\schtasks.exe—TICKET 83992883992AIR8389494VERVED37783PDF.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
Total events
762
Read events
724
Write events
38
Delete events
0

Modification events

(PID) Process:(3392) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3392) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3392) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3392) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\d2df2d27-d7a5-434d-890b-2b17a6764520.rar
(PID) Process:(3392) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3392) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3392) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3392) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3392) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\DialogEditHistory\ExtrPath
Operation:writeName:0
Value:
C:\Users\admin\Desktop
(PID) Process:(3392) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
Executable files
3
Suspicious files
4
Text files
3
Unknown types
1

Dropped files

PID
Process
Filename
Type
2552TICKET 83992883992AIR8389494VERVED37783PDF.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\settings.bak —
MD5:—
SHA256:—
1660vbc.exeC:\Users\admin\AppData\Local\Temp\osp0rviw.flj —
MD5:—
SHA256:—
2324vbc.exeC:\Users\admin\AppData\Local\Temp\zhjdtomb.a13 —
MD5:—
SHA256:—
1812TICKET 83992883992AIR8389494VERVED37783PDF.exeC:\Users\admin\AppData\Local\Temp\tmpDF67.tmp —
MD5:—
SHA256:—
3392WinRAR.exeC:\Users\admin\Desktop\TICKET 83992883992AIR8389494VERVED37783PDF.exeexecutable
MD5:—
SHA256:—
2552TICKET 83992883992AIR8389494VERVED37783PDF.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\run.datbinary
MD5:—
SHA256:—
2088TICKET 83992883992AIR8389494VERVED37783PDF.exeC:\Users\admin\AppData\Roaming\EzvLxlvnUHcS.exeexecutable
MD5:—
SHA256:—
2088TICKET 83992883992AIR8389494VERVED37783PDF.exeC:\Users\admin\AppData\Local\Temp\tmp2DF9.tmpxml
MD5:—
SHA256:—
2552TICKET 83992883992AIR8389494VERVED37783PDF.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\TCP Monitor\tcpmon.exeexecutable
MD5:—
SHA256:—
1380TICKET 83992883992AIR8389494VERVED37783PDF.exeC:\Users\admin\AppData\Local\Temp\tmpABD3.tmpxml
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
0
Threats
45

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2552
TICKET 83992883992AIR8389494VERVED37783PDF.exe
178.239.21.116:1186
—
Telekomunikacije Republike Srpske akcionarsko drustvo Banja Luka
BA
malicious

DNS requests

No data

Threats

PID
Process
Class
Message
2552
TICKET 83992883992AIR8389494VERVED37783PDF.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 60B
2552
TICKET 83992883992AIR8389494VERVED37783PDF.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
2552
TICKET 83992883992AIR8389494VERVED37783PDF.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
2552
TICKET 83992883992AIR8389494VERVED37783PDF.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 64B
2552
TICKET 83992883992AIR8389494VERVED37783PDF.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
2552
TICKET 83992883992AIR8389494VERVED37783PDF.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 64B
2552
TICKET 83992883992AIR8389494VERVED37783PDF.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
2552
TICKET 83992883992AIR8389494VERVED37783PDF.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
2552
TICKET 83992883992AIR8389494VERVED37783PDF.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 64B
2552
TICKET 83992883992AIR8389494VERVED37783PDF.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
25 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
TICKET%2083992883992AIR8389494VERVED37783PDF.7z