analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

22334 08-11-2018.vbs.zip

Full analysis: https://app.any.run/tasks/14411adf-e7cc-499e-9c13-8b75b4d33d7e
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Analysis date: November 08, 2018, 18:48:59
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
opendir
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

12E335007881A84EB0F1FBC8F39508A3

SHA1:

4956DEC4CC84D1B3FB4665F75167736BA72EEC7D

SHA256:

9E6D14C1BAA2BC9B3A0801ABCB8C8C893AEAC8B1DBFC92FFDD4E114E3FF19DD0

SSDEEP:

192:wuRB/bdRLiOe1YC9Qh2UdeLzGFpJHQbtlRwI1oS3eu+ctBi:1jJ4qh2eeLaFp5QbZwELOuzy

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Writes to a start menu file

      • WScript.exe (PID: 2504)
    • Connects to CnC server

      • WScript.exe (PID: 2504)
    • Uses Task Scheduler to run other applications

      • WScript.exe (PID: 2504)
    • Changes the autorun value in the registry

      • WScript.exe (PID: 2504)
  • SUSPICIOUS

    • Creates files in the user directory

      • WScript.exe (PID: 2504)
    • Executes scripts

      • WinRAR.exe (PID: 780)
    • Connects to server without host name

      • WScript.exe (PID: 2504)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: 22334 08-11-2018.vbs
ZipUncompressedSize: 196308
ZipCompressedSize: 9205
ZipCRC: 0x29dd1718
ZipModifyDate: 2018:11:08 19:44:04
ZipCompression: Deflated
ZipBitFlag: 0x0001
ZipRequiredVersion: 788
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs winrar.exe no specs wscript.exe schtasks.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1148"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\22334 08-11-2018.vbs.zip"C:\Program Files\WinRAR\WinRAR.exeexplorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
780"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\22334 08-11-2018.vbs.zip"C:\Program Files\WinRAR\WinRAR.exeexplorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
2504"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIb780.49697\22334 08-11-2018.vbs" C:\Windows\System32\WScript.exe
WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Version:
5.8.7600.16385
3312"C:\Windows\System32\schtasks.exe" /create /sc ONLOGON /RL HIGHEST /tn 22334 08-11-2018.vbs /tr "C:\Users\admin\AppData\Roaming\22334 08-11-2018.vbs"C:\Windows\System32\schtasks.exeWScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
2147500037
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
935
Read events
867
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
0
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
2504WScript.exeC:\Users\admin\AppData\Roaming\22334 08-11-2018.vbstext
MD5:BB80DBE97E0F516C2B5E3CB36D94D904
SHA256:7EA16560A534250469B12852EFE7F68E416CC34FBB833BCADBE207330F1F233A
780WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIb780.49697\22334 08-11-2018.vbstext
MD5:BB80DBE97E0F516C2B5E3CB36D94D904
SHA256:7EA16560A534250469B12852EFE7F68E416CC34FBB833BCADBE207330F1F233A
2504WScript.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\22334 08-11-2018.vbstext
MD5:BB80DBE97E0F516C2B5E3CB36D94D904
SHA256:7EA16560A534250469B12852EFE7F68E416CC34FBB833BCADBE207330F1F233A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
0
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2504
WScript.exe
POST
200
139.59.71.220:80
http://139.59.71.220/version.php
IN
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2504
WScript.exe
139.59.71.220:80
Digital Ocean, Inc.
IN
malicious

DNS requests

No data

Threats

Found threats are available for the paid subscriptions
1 ETPRO signatures available at the full report
No debug info