URL: | https://eu-api.mimecast.com/m/attachment/jxTfI-poFUP5z5X1_kuoNSW4LbkKL829O6jZa8j5uJIqZV1LvGohP35qROF2-bTRkTDWV9JubgUGiaYDtv1E4kq8gjRp4x_S86j31JWMhzn31KcUK0EiaUGvm7QkjHZACmRvjy9Yd_7vP64mLEZRPpmkkPt9dgpo5O3VgcpSGrrlglmKq4NHF7gGXB4K4JHXJE1eUHF8LbRUqzQ4AlsRz2GvcK_nNw4Z2QlK2SVGqOo |
Full analysis: | https://app.any.run/tasks/4b5db900-1d5e-4248-972b-fbd6fe270064 |
Verdict: | Malicious activity |
Threats: | Ursnif is a banking Trojan that usually infects corporate victims. It is based on an old malware but was substantially updated over the years and became quite powerful. Today Ursnif is one of the most widely spread banking Trojans in the world. |
Analysis date: | February 18, 2019, 11:42:49 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MD5: | B5061D36DFD9F798C138402824DC42F2 |
SHA1: | 52015497EC76CC9C67552CED53A351E133637796 |
SHA256: | 9E0E080FF7FD2271A6344D73B264711FED19D23C055AC9625AE0825390C5E3DA |
SSDEEP: | 6:2gQLVGa34EkpYHuCR7/+liXTs7ARJj1iV191yESbGEim:27N33kWH9+oXw7AD1iV1ba2m |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2888 | "C:\Program Files\Google\Chrome\Application\chrome.exe" https://eu-api.mimecast.com/m/attachment/jxTfI-poFUP5z5X1_kuoNSW4LbkKL829O6jZa8j5uJIqZV1LvGohP35qROF2-bTRkTDWV9JubgUGiaYDtv1E4kq8gjRp4x_S86j31JWMhzn31KcUK0EiaUGvm7QkjHZACmRvjy9Yd_7vP64mLEZRPpmkkPt9dgpo5O3VgcpSGrrlglmKq4NHF7gGXB4K4JHXJE1eUHF8LbRUqzQ4AlsRz2GvcK_nNw4Z2QlK2SVGqOo | C:\Program Files\Google\Chrome\Application\chrome.exe | explorer.exe | |
User: admin Company: Google Inc. Integrity Level: MEDIUM Description: Google Chrome Version: 68.0.3440.106 | ||||
3616 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=68.0.3440.106 --initial-client-data=0x78,0x7c,0x80,0x74,0x84,0x6f3a00b0,0x6f3a00c0,0x6f3a00cc | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe |
User: admin Company: Google Inc. Integrity Level: MEDIUM Description: Google Chrome Version: 68.0.3440.106 | ||||
3048 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=2892 --on-initialized-event-handle=304 --parent-handle=308 /prefetch:6 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe |
User: admin Company: Google Inc. Integrity Level: MEDIUM Description: Google Chrome Version: 68.0.3440.106 | ||||
2188 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=980,14314600984727484759,16689743019633329455,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAACAAwBAAQAAAAAAAAAAAGAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --service-request-channel-token=B2E1C1888076D473A6BDD1020AE4BD29 --mojo-platform-channel-handle=1008 --ignored=" --type=renderer " /prefetch:2 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe |
User: admin Company: Google Inc. Integrity Level: LOW Description: Google Chrome Version: 68.0.3440.106 | ||||
2744 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=980,14314600984727484759,16689743019633329455,131072 --enable-features=PasswordImport --service-pipe-token=6594FA022F0CF9BA49D6BA57F21202F0 --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=6594FA022F0CF9BA49D6BA57F21202F0 --renderer-client-id=4 --mojo-platform-channel-handle=1892 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe |
User: admin Company: Google Inc. Integrity Level: LOW Description: Google Chrome Version: 68.0.3440.106 | ||||
3696 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=980,14314600984727484759,16689743019633329455,131072 --enable-features=PasswordImport --service-pipe-token=E5EAA1A6FB984A892442CB99A7F01DCE --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=E5EAA1A6FB984A892442CB99A7F01DCE --renderer-client-id=3 --mojo-platform-channel-handle=2160 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe |
User: admin Company: Google Inc. Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 68.0.3440.106 | ||||
1484 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=980,14314600984727484759,16689743019633329455,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=285F99C6C318085667DC280969952C23 --mojo-platform-channel-handle=3444 --ignored=" --type=renderer " /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe |
User: admin Company: Google Inc. Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 68.0.3440.106 | ||||
3216 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Downloads\Harmony_Clinical_Research.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | chrome.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
3248 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=980,14314600984727484759,16689743019633329455,131072 --enable-features=PasswordImport --disable-gpu-sandbox --gpu-preferences=KAAAAAAAAACAAwBAAQAAAAAAAAAAAGAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --service-request-channel-token=659A40BF590E47DD7ADB6A9080A32A2C --mojo-platform-channel-handle=1680 /prefetch:2 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe |
User: admin Company: Google Inc. Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 68.0.3440.106 | ||||
2700 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Rar$DIb3216.19959\Request14.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | WinRAR.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 |
(PID) Process: | (2888) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
Operation: | write | Name: | failed_count |
Value: 0 | |||
(PID) Process: | (2888) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
Operation: | write | Name: | state |
Value: 2 | |||
(PID) Process: | (2888) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
Operation: | write | Name: | state |
Value: 1 | |||
(PID) Process: | (2888) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96} |
Operation: | write | Name: | dr |
Value: 1 | |||
(PID) Process: | — | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes |
Operation: | write | Name: | 2888-13194963784686625 |
Value: 259 | |||
(PID) Process: | (2888) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome |
Operation: | write | Name: | UsageStatsInSample |
Value: 0 | |||
(PID) Process: | (2888) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes |
Operation: | delete value | Name: | 3516-13180984670829101 |
Value: 0 | |||
(PID) Process: | (2888) chrome.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96} |
Operation: | write | Name: | usagestats |
Value: 0 | |||
(PID) Process: | (2888) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes |
Operation: | delete value | Name: | 2888-13194963784686625 |
Value: 259 | |||
(PID) Process: | (2888) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96} |
Operation: | write | Name: | metricsid |
Value: |
PID | Process | Filename | Type | |
---|---|---|---|---|
2888 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\06d7c33a-d8ea-4a2e-8af5-3f1b2ae58bc3.tmp | — | |
MD5:— | SHA256:— | |||
2888 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB\000016.dbtmp | — | |
MD5:— | SHA256:— | |||
2888 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000016.dbtmp | — | |
MD5:— | SHA256:— | |||
2888 | chrome.exe | C:\Users\admin\AppData\Local\Temp\Cab6811.tmp | — | |
MD5:— | SHA256:— | |||
2888 | chrome.exe | C:\Users\admin\AppData\Local\Temp\Tar6812.tmp | — | |
MD5:— | SHA256:— | |||
2888 | chrome.exe | C:\Users\admin\AppData\Local\Temp\Cab6861.tmp | — | |
MD5:— | SHA256:— | |||
2888 | chrome.exe | C:\Users\admin\AppData\Local\Temp\Tar6862.tmp | — | |
MD5:— | SHA256:— | |||
2888 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\dd3285cb-9392-4c0c-b036-01e55cb62141.tmp | — | |
MD5:— | SHA256:— | |||
2888 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old~RF2465bf.TMP | text | |
MD5:197882774A7ECEC9046BC48F63189B66 | SHA256:27377B0D5F989997C2C3F74ACF163EED44B60631DDAA768F6655D7BE555742B2 | |||
2888 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old | text | |
MD5:197882774A7ECEC9046BC48F63189B66 | SHA256:27377B0D5F989997C2C3F74ACF163EED44B60631DDAA768F6655D7BE555742B2 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3576 | powershell.exe | GET | 404 | 46.173.219.104:80 | http://fihjamaal.com/puewpxmasl/suoepwxpamxapxlamslxdo.php?l=noos12.harz | RU | — | — | suspicious |
2888 | chrome.exe | GET | 200 | 67.27.149.126:80 | http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab | US | compressed | 55.2 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3576 | powershell.exe | 46.173.219.104:80 | fihjamaal.com | Garant-Park-Internet Ltd | RU | suspicious |
2888 | chrome.exe | 216.58.206.13:443 | accounts.google.com | Google Inc. | US | whitelisted |
2888 | chrome.exe | 172.217.22.67:443 | www.gstatic.com | Google Inc. | US | whitelisted |
2888 | chrome.exe | 195.130.217.73:443 | eu-api.mimecast.com | Mimecast Services Limited | GB | suspicious |
2888 | chrome.exe | 67.27.149.126:80 | www.download.windowsupdate.com | Level 3 Communications, Inc. | US | unknown |
2888 | chrome.exe | 172.217.16.131:443 | ssl.gstatic.com | Google Inc. | US | whitelisted |
2888 | chrome.exe | 216.58.207.67:443 | clientservices.googleapis.com | Google Inc. | US | whitelisted |
2888 | chrome.exe | 195.130.217.180:443 | eu-api.mimecast.com | Mimecast Services Limited | GB | suspicious |
Domain | IP | Reputation |
---|---|---|
eu-api.mimecast.com |
| suspicious |
www.gstatic.com |
| whitelisted |
clientservices.googleapis.com |
| whitelisted |
accounts.google.com |
| shared |
www.download.windowsupdate.com |
| whitelisted |
ssl.gstatic.com |
| whitelisted |
fihjamaal.com |
| suspicious |