File name:

Mercury.C.exe

Full analysis: https://app.any.run/tasks/9f0cbf3f-b78e-4dd1-bbd2-1abfa33015bb
Verdict: Malicious activity
Analysis date: December 07, 2024, 16:55:43
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
upx
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed, 3 sections
MD5:

F7B55502A71CEF2D1E70D88AEEB63D73

SHA1:

BFD5A73A583A78464CB9F46D3799F6C9F47663FF

SHA256:

9EB6551959A913DE98898302EC764841BE357C0786038BDFA1C3D7F269D490A6

SSDEEP:

49152:li2bdYx6l+9MYW3VU0F0Wnn9VSKCjBVBC0sIRwkuFNmC39CXhvIV4kjyiYpeWqzW:licg6l+mYWm0Fx9VSKarsfTgJ+ByLpvH

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 6428)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Mercury.C.exe (PID: 6228)

    • Reads security settings of Internet Explorer

      • Mercury.C.exe (PID: 6228)

    • Runs WScript without displaying logo

      • wscript.exe (PID: 6428)

    • The process executes VB scripts

      • Mercury.C.exe (PID: 6228)
      • wscript.exe (PID: 6428)

    • Application launched itself

      • wscript.exe (PID: 6428)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • wscript.exe (PID: 6888)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 6428)
      • wscript.exe (PID: 6888)

    • Writes binary data to a Stream object (SCRIPT)

      • wscript.exe (PID: 6888)

  • INFO

    • Create files in a temporary directory

      • Mercury.C.exe (PID: 6228)

    • Checks supported languages

      • Mercury.C.exe (PID: 6228)
      • mbr.exe (PID: 6916)
      • bytebeat.exe (PID: 6936)
      • ColorA.exe (PID: 6968)
      • GlitchB.exe (PID: 5748)

    • The process uses the downloaded file

      • Mercury.C.exe (PID: 6228)
      • wscript.exe (PID: 6428)

    • Reads the computer name

      • Mercury.C.exe (PID: 6228)
      • bytebeat.exe (PID: 6936)

    • Process checks computer location settings

      • Mercury.C.exe (PID: 6228)

    • Reads Microsoft Office registry keys

      • wscript.exe (PID: 6428)

    • UPX packer has been detected

      • Mercury.C.exe (PID: 6228)

    • Reads security settings of Internet Explorer

      • wscript.exe (PID: 6428)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (64.1)
.dll | Win32 Dynamic Link Library (generic) (15.5)
.exe | Win32 Executable (generic) (10.6)
.exe | Generic Win/DOS Executable (4.7)
.exe | DOS Executable Generic (4.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:02:01 20:46:09+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 2.5
CodeSize: 1060864
InitializedDataSize: 8192
UninitializedDataSize: 61440
EntryPoint: 0x111570
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 3.6.6.6
ProductVersionNumber: 3.6.6.6
FileFlagsMask: 0x003f
FileFlags: Debug, Pre-release, Private build
FileOS: Windows 16-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
FileVersion: 3.6.6.6
ProductVersion: 3.6.6.6
ProductName: MercuryRemastered
InternalName: death
FileDescription: Mercury Trojan variant C
CompanyName: HorrorTrojans
LegalCopyright: 2022
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
137
Monitored processes
8
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start mercury.c.exe wscript.exe no specs wscript.exe no specs mbr.exe no specs bytebeat.exe no specs colora.exe no specs glitchb.exe no specs mercury.c.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
5340"C:\Users\admin\AppData\Local\Temp\Mercury.C.exe" C:\Users\admin\AppData\Local\Temp\Mercury.C.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\mercury.c.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
5748"C:\Users\admin\AppData\Local\Temp\53FF.tmp\GlitchB.exe" C:\Users\admin\AppData\Local\Temp\53FF.tmp\GlitchB.exe—wscript.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\53ff.tmp\glitchb.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\gdi32.dll
6228"C:\Users\admin\AppData\Local\Temp\Mercury.C.exe" C:\Users\admin\AppData\Local\Temp\Mercury.C.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\mercury.c.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\gdi32.dll
6428"C:\WINDOWS\sysnative\wscript.exe" C:\Users\admin\AppData\Local\Temp\53FF.tmp\5400.tmp\5401.vbs //Nologo C:\Windows\System32\wscript.exe—Mercury.C.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft ® Windows Based Script Host
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
6888"C:\WINDOWS\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\53FF.tmp\t.vbs" C:\Windows\System32\wscript.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6916"C:\Users\admin\AppData\Local\Temp\53FF.tmp\mbr.exe" C:\Users\admin\AppData\Local\Temp\53FF.tmp\mbr.exe—wscript.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\53ff.tmp\mbr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6936"C:\Users\admin\AppData\Local\Temp\53FF.tmp\bytebeat.exe" C:\Users\admin\AppData\Local\Temp\53FF.tmp\bytebeat.exe—wscript.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\53ff.tmp\bytebeat.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6968"C:\Users\admin\AppData\Local\Temp\53FF.tmp\ColorA.exe" C:\Users\admin\AppData\Local\Temp\53FF.tmp\ColorA.exe—wscript.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\53ff.tmp\colora.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\gdi32.dll
Total events
2 124
Read events
2 123
Write events
1
Delete events
0

Modification events

(PID) Process:(6428) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vbs\OpenWithProgids
Operation:writeName:VBSFile
Value:
Executable files
7
Suspicious files
2
Text files
209
Unknown types
0

Dropped files

PID
Process
Filename
Type
6916mbr.exe\Device\Harddisk0\DR0 —
MD5:—
SHA256:—
6228Mercury.C.exeC:\Users\admin\AppData\Local\Temp\53FF.tmp\bytebeat.cpptext
MD5:661EF63AF49D0535151DE251603FA846
SHA256:55C63887EAEF6D2DAF1DC697A3D824008AA7BFEBC81AC4E7E574596440E5595A
6228Mercury.C.exeC:\Users\admin\AppData\Local\Temp\53FF.tmp\bsod.exeexecutable
MD5:A0778D97321E407D5EEFA6FDAFE8C984
SHA256:3665036C52175AD759E0305FB5CB02B11AA0F812DF245BA3E4FDDE89C4E4A272
6228Mercury.C.exeC:\Users\admin\AppData\Local\Temp\53FF.tmp\5400.tmp\5401.vbsbinary
MD5:D46581BCD1BA3407E08E4D766F248FF7
SHA256:8F0943DAAA9EEAA2886E6EC36A144DC74E5036A30BE7514A0AE736CE03DA145E
6228Mercury.C.exeC:\Users\admin\AppData\Local\Temp\53FF.tmp\zoomlines.exeexecutable
MD5:AB1658BFE290E1990199DF2F7ED460D0
SHA256:EA1FA5233612BB4D60B01D81E3C41C4DD7187BE78E0552A49121843CE06F2BC4
6228Mercury.C.exeC:\Users\admin\AppData\Local\Temp\53FF.tmp\GlitchB.cpptext
MD5:AB9B1236ECF727A56C97729EF989FF61
SHA256:D7FD6D05AD1EE75CA8524B319FF9803EC0908C2A3DE6EC51CD6F9367F93799B5
6228Mercury.C.exeC:\Users\admin\AppData\Local\Temp\53FF.tmp\bsod.cpptext
MD5:CA73D197DEF1B095BC712CBEC6168FE2
SHA256:72BB7E3AE6DA142F61E824951DC4ADD9B1851C010CCABF6C68671AF0C970ECCB
6228Mercury.C.exeC:\Users\admin\AppData\Local\Temp\53FF.tmp\mbr.exeexecutable
MD5:DD85E30EF70C4F0425837A3FE17DBC1D
SHA256:356E86A7609E3475E6D5AACE81F673607061C551F91F57B87C3ECBD3943D4181
6228Mercury.C.exeC:\Users\admin\AppData\Local\Temp\53FF.tmp\bytebeat.exeexecutable
MD5:6DBA963D56AE1FCDFD6E840A52416801
SHA256:EB3940FB1F2A0B16F5E58C7F4B707FB26B6EE08EBE7F5C43B9C02FCF02FE4506
6228Mercury.C.exeC:\Users\admin\AppData\Local\Temp\53FF.tmp\ColorA.exeexecutable
MD5:D50FBC1A509EF70153D458AA657A1416
SHA256:F41D9FDCDCEBF89EA570158E5D00AFF3A7F31970E92B929258777A1BB52D328D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
32
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.16.164.9:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5036
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5036
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6336
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3040
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.16.164.9:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5064
SearchApp.exe
2.23.209.144:443
www.bing.com
Akamai International B.V.
GB
whitelisted
1176
svchost.exe
40.126.32.134:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1176
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 2.16.164.9
  • 2.16.164.106
whitelisted
www.microsoft.com
  • 88.221.169.152
  • 23.52.120.96
whitelisted
google.com
  • 142.250.186.46
whitelisted
www.bing.com
  • 2.23.209.144
  • 2.23.209.160
  • 2.23.209.154
  • 2.23.209.181
  • 2.23.209.156
  • 2.23.209.150
  • 2.23.209.176
  • 2.23.209.158
  • 2.23.209.149
whitelisted
login.live.com
  • 40.126.32.134
  • 40.126.32.72
  • 40.126.32.133
  • 40.126.32.136
  • 20.190.160.14
  • 20.190.160.17
  • 40.126.32.138
  • 40.126.32.68
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
go.microsoft.com
  • 23.32.186.57
whitelisted
arc.msn.com
  • 20.105.99.58
whitelisted
fd.api.iris.microsoft.com
  • 20.223.36.55
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Mercury.C.exe