| File name: | info.7z |
| Full analysis: | https://app.any.run/tasks/ca3dd6fd-abb4-4756-abc8-b0fe6b63746d |
| Verdict: | Malicious activity |
| Threats: | Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying. |
| Analysis date: | January 22, 2019, 14:18:24 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-7z-compressed |
| File info: | 7-zip archive data, version 0.4 |
| MD5: | E4ACA0E75CE5FEF5239B5389F55DB1D2 |
| SHA1: | 20314BF69F3663D9DD86C9C636CEE62DA9E014AF |
| SHA256: | 94E0641A5CB532E3EFEC0621FEC603469E55BAEE27F09AB0FF7B410AF1F0AC1E |
| SSDEEP: | 48:8E1HOJJzJFsWmB9b130WYlfReY+ETTKJWxu3bUPD5iD4JuK/eC/qpdelcIdbA0Ha:iJVcJVmfRXxSCMKIdelLdbxBVpplQ |
MALICIOUS
Changes settings of System certificates
- WScript.exe (PID: 3156)
Application was dropped or rewritten from another process
- rad9537E.tmp (PID: 2212)
Changes the autorun value in the registry
- rad9537E.tmp (PID: 2212)
TROLDESH was detected
- rad9537E.tmp (PID: 2212)
Deletes shadow copies
- rad9537E.tmp (PID: 2212)
Dropped file may contain instructions of ransomware
- rad9537E.tmp (PID: 2212)
Runs app for hidden code execution
- rad9537E.tmp (PID: 2212)
Actions looks like stealing of personal data
- rad9537E.tmp (PID: 2212)
Modifies files in Chrome extension folder
- rad9537E.tmp (PID: 2212)
SUSPICIOUS
Executes scripts
- WinRAR.exe (PID: 2612)
Application launched itself
- WinRAR.exe (PID: 3244)
- WinRAR.exe (PID: 2448)
Adds / modifies Windows certificates
- WScript.exe (PID: 3156)
Executable content was dropped or overwritten
- WScript.exe (PID: 3156)
- rad9537E.tmp (PID: 2212)
Starts CMD.EXE for commands execution
- WScript.exe (PID: 3156)
- rad9537E.tmp (PID: 2212)
Starts application with an unusual extension
- cmd.exe (PID: 3476)
- cmd.exe (PID: 2844)
Creates files in the program directory
- rad9537E.tmp (PID: 2212)
Connects to unusual port
- rad9537E.tmp (PID: 2212)
Checks for external IP
- rad9537E.tmp (PID: 2212)
Creates files like Ransomware instruction
- rad9537E.tmp (PID: 2212)
Creates files in the user directory
- rad9537E.tmp (PID: 2212)
INFO
Dropped object may contain URL to Tor Browser
- rad9537E.tmp (PID: 2212)
Dropped object may contain TOR URL's
- rad9537E.tmp (PID: 2212)
Dropped object may contain Bitcoin addresses
- rad9537E.tmp (PID: 2212)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .7z | | | 7-Zip compressed archive (v0.4) (57.1) |
|---|---|---|
| .7z | | | 7-Zip compressed archive (gen) (42.8) |
Total processes
60
Monitored processes
13
Malicious processes
6
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 780 | chcp | C:\Windows\system32\chcp.com | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Change CodePage Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2212 | C:\Users\admin\AppData\Local\Temp\rad9537E.tmp | C:\Users\admin\AppData\Local\Temp\rad9537E.tmp | cmd.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: setip/Unikstall Exit code: 0 Version: 51.1052.0.0 Modules
| |||||||||||||||
| 2404 | "C:\Windows\system32\vssadmin.exe" Delete Shadows /All /Quiet | C:\Windows\system32\vssadmin.exe | rad9537E.tmp | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Command Line Interface for Microsoft® Volume Shadow Copy Service Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2448 | "C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\Rar$DIb3244.23058\info.zip | C:\Program Files\WinRAR\WinRAR.exe | — | WinRAR.exe | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 Modules
| |||||||||||||||
| 2588 | C:\Windows\system32\vssvc.exe | C:\Windows\system32\vssvc.exe | — | services.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft® Volume Shadow Copy Service Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2612 | "C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\Rar$DIa2448.25045\info.zip | C:\Program Files\WinRAR\WinRAR.exe | — | WinRAR.exe | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 Modules
| |||||||||||||||
| 2792 | "C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\README9.txt | C:\Windows\system32\NOTEPAD.EXE | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Notepad Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2844 | C:\Windows\system32\cmd.exe | C:\Windows\system32\cmd.exe | — | rad9537E.tmp | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 3156 | "C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIa2612.25842\Информация.js" | C:\Windows\System32\WScript.exe | WinRAR.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 Modules
| |||||||||||||||
| 3244 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\info.7z" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 Modules
| |||||||||||||||
Total events
1 464
Read events
1 369
Write events
94
Delete events
1
Modification events
| (PID) Process: | (3244) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (3244) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (3244) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (3244) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\Desktop\info.7z | |||
| (PID) Process: | (3244) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (3244) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (3244) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (3244) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (3244) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface |
| Operation: | write | Name: | ShowPassword |
Value: 1 | |||
| (PID) Process: | (3244) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
Executable files
3
Suspicious files
1 104
Text files
45
Unknown types
25
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2212 | rad9537E.tmp | C:\Users\admin\AppData\Local\Temp\6893A5D897\state.tmp | — | |
MD5:— | SHA256:— | |||
| 2212 | rad9537E.tmp | C:\Users\admin\AppData\Local\Temp\6893A5D897\unverified-microdesc-consensus.tmp | — | |
MD5:— | SHA256:— | |||
| 2212 | rad9537E.tmp | C:\Users\admin\AppData\Local\Temp\6893A5~1\unverified-microdesc-consensus | — | |
MD5:— | SHA256:— | |||
| 2212 | rad9537E.tmp | C:\Users\admin\AppData\Local\Temp\6893A5D897\cached-certs.tmp | — | |
MD5:— | SHA256:— | |||
| 2212 | rad9537E.tmp | C:\Users\admin\AppData\Local\Temp\6893A5D897\cached-microdesc-consensus.tmp | — | |
MD5:— | SHA256:— | |||
| 2212 | rad9537E.tmp | C:\Users\admin\AppData\Local\Temp\6893A5~1\cached-certs | text | |
MD5:— | SHA256:— | |||
| 2212 | rad9537E.tmp | C:\Users\Public\Videos\Sample Videos\Wildlife.wmv | — | |
MD5:— | SHA256:— | |||
| 2212 | rad9537E.tmp | C:\Users\Public\Videos\Sample Videos\88lYT6KszEfo7o6jMcNXxdbNYb1Na6zuGkMwTyq4Jyo=.906D0F2E2F604F839E04.crypted000007 | — | |
MD5:— | SHA256:— | |||
| 2212 | rad9537E.tmp | C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg | — | |
MD5:— | SHA256:— | |||
| 2212 | rad9537E.tmp | C:\ProgramData\Windows\csrss.exe | executable | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
16
DNS requests
3
Threats
37
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2212 | rad9537E.tmp | GET | 403 | 104.16.17.96:80 | http://whatismyipaddress.com/ | US | text | 100 b | shared |
2212 | rad9537E.tmp | GET | 403 | 104.16.17.96:80 | http://whatismyipaddress.com/ | US | text | 100 b | shared |
2212 | rad9537E.tmp | GET | 403 | 104.16.17.96:80 | http://whatismyipaddress.com/ | US | text | 100 b | shared |
2212 | rad9537E.tmp | GET | 403 | 104.16.17.96:80 | http://whatismyipaddress.com/ | US | text | 100 b | shared |
2212 | rad9537E.tmp | GET | 200 | 104.18.34.131:80 | http://whatsmyip.net/ | US | html | 7.35 Kb | shared |
2212 | rad9537E.tmp | GET | 403 | 104.16.17.96:80 | http://whatismyipaddress.com/ | US | text | 100 b | shared |
2212 | rad9537E.tmp | GET | 403 | 104.16.17.96:80 | http://whatismyipaddress.com/ | US | text | 100 b | shared |
2212 | rad9537E.tmp | GET | 403 | 104.16.17.96:80 | http://whatismyipaddress.com/ | US | text | 100 b | shared |
2212 | rad9537E.tmp | GET | 403 | 104.16.17.96:80 | http://whatismyipaddress.com/ | US | text | 100 b | shared |
2212 | rad9537E.tmp | GET | 403 | 104.16.17.96:80 | http://whatismyipaddress.com/ | US | text | 100 b | shared |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3156 | WScript.exe | 5.196.70.112:443 | www.wcrgrele.com | OVH SAS | FR | unknown |
2212 | rad9537E.tmp | 171.25.193.9:80 | — | Foreningen for digitala fri- och rattigheter | SE | malicious |
2212 | rad9537E.tmp | 163.172.56.248:8443 | — | Online S.a.s. | FR | suspicious |
2212 | rad9537E.tmp | 87.118.84.158:443 | — | Keyweb AG | DE | suspicious |
2212 | rad9537E.tmp | 142.93.232.80:443 | — | — | CA | suspicious |
2212 | rad9537E.tmp | 104.16.17.96:80 | whatismyipaddress.com | Cloudflare Inc | US | shared |
2212 | rad9537E.tmp | 104.18.34.131:80 | whatsmyip.net | Cloudflare Inc | US | shared |
DNS requests
Domain | IP | Reputation |
|---|---|---|
www.wcrgrele.com |
| unknown |
whatismyipaddress.com |
| shared |
whatsmyip.net |
| shared |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2212 | rad9537E.tmp | Misc Attack | ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 173 |
2212 | rad9537E.tmp | Misc activity | ET POLICY TLS possible TOR SSL traffic |
2212 | rad9537E.tmp | Misc Attack | ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 642 |
2212 | rad9537E.tmp | Misc Attack | ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 131 |
2212 | rad9537E.tmp | Misc Attack | ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 167 |
2212 | rad9537E.tmp | A Network Trojan was detected | MALWARE [PTsecurity] Shade/Troldesh Ransomware External IP Check |
2212 | rad9537E.tmp | A Network Trojan was detected | MALWARE [PTsecurity] Shade/Troldesh Ransomware External IP Check |
2212 | rad9537E.tmp | A Network Trojan was detected | MALWARE [PTsecurity] Shade/Troldesh Ransomware External IP Check |
2212 | rad9537E.tmp | A Network Trojan was detected | MALWARE [PTsecurity] Shade/Troldesh Ransomware External IP Check |
2212 | rad9537E.tmp | A Network Trojan was detected | MALWARE [PTsecurity] Shade/Troldesh Ransomware External IP Check |
21 ETPRO signatures available at the full report