File name:

Wire_Transfer_Debit _Advice_feebruaur19_2020.xxe

Full analysis: https://app.any.run/tasks/edfabb04-e20b-4a14-a369-9b1df4accfa4
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Malware Trends Tracker     >>>
Analysis date: February 21, 2020, 17:04:03
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
Indicators:
MIME: text/plain
File info: ASCII text, with CRLF line terminators
MD5:

78AEE4C0B2B74AC0C31C8208C270D447

SHA1:

8495E0E223019A23F24EAD380B07AC785A8F6FBE

SHA256:

9FF84134C08D66C3C1FB0942BFBD73373055BC1FF991C8EB55DA955BEC00DDA4

SSDEEP:

768:27/4pfmOlSuVy5e5uOGa+PrIsfyNPu7RT0+iLmQE1JjeQEWgs0d8SeQNtj+YKoKA:27wlmOll4e5uFIsG2FIKz4Wp0+ShiYKe

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Wire_Transfer_Debit _Advice_feebruaur19_2020.scr (PID: 2748)

    • Changes the autorun value in the registry

      • ieinstal.exe (PID: 2848)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3100)
      • ieinstal.exe (PID: 2848)

    • Creates files in the user directory

      • ieinstal.exe (PID: 2848)

    • Reads Internet Cache Settings

      • ieinstal.exe (PID: 2848)

  • INFO

    • Manual execution by user

      • Wire_Transfer_Debit _Advice_feebruaur19_2020.scr (PID: 2748)
      • taskmgr.exe (PID: 3296)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
4
Malicious processes
0
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe wire_transfer_debit _advice_feebruaur19_2020.scr no specs ieinstal.exe taskmgr.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2748"C:\Users\admin\Desktop\Wire_Transfer_Debit _Advice_feebruaur19_2020.scr" /SC:\Users\admin\Desktop\Wire_Transfer_Debit _Advice_feebruaur19_2020.scr—explorer.exe
User:
admin
Company:
Bamsdaar
Integrity Level:
MEDIUM
Description:
LEARIERLI
Exit code:
0
Version:
1.00
Modules
Images
c:\users\admin\desktop\wire_transfer_debit _advice_feebruaur19_2020.scr
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2848"C:\Users\admin\Desktop\Wire_Transfer_Debit _Advice_feebruaur19_2020.scr" /SC:\Program Files\internet explorer\ieinstal.exe
Wire_Transfer_Debit _Advice_feebruaur19_2020.scr
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer Add-on Installer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\system32\msvbvm60.dll
c:\program files\internet explorer\ieinstal.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
3100"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Wire_Transfer_Debit _Advice_feebruaur19_2020.xxe"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\comdlg32.dll
3296"C:\Windows\system32\taskmgr.exe" C:\Windows\system32\taskmgr.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Task Manager
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
523
Read events
481
Write events
42
Delete events
0

Modification events

(PID) Process:(3100) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3100) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3100) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3100) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Wire_Transfer_Debit _Advice_feebruaur19_2020.xxe
(PID) Process:(3100) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3100) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3100) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3100) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3100) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\DialogEditHistory\ExtrPath
Operation:writeName:0
Value:
C:\Users\admin\Desktop
(PID) Process:(2848) ieinstal.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:Noncontro4
Value:
C:\Users\admin\ristin\Toolboxsy8.scr
Executable files
2
Suspicious files
6
Text files
0
Unknown types
3

Dropped files

PID
Process
Filename
Type
2848ieinstal.exeC:\Users\admin\AppData\Local\Temp\Cab66C.tmp —
MD5:—
SHA256:—
2848ieinstal.exeC:\Users\admin\AppData\Local\Temp\Tar66D.tmp —
MD5:—
SHA256:—
2848ieinstal.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5457A8CE4B2A7499F8299A013B6E1C7C_CBB16B7A61CE4E298043181730D3CE9Bbinary
MD5:—
SHA256:—
3100WinRAR.exeC:\Users\admin\Desktop\Wire_Transfer_Debit _Advice_feebruaur19_2020.screxecutable
MD5:—
SHA256:—
2848ieinstal.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E3FCAD4A425A5F708A84C255989CBE2Cder
MD5:—
SHA256:—
2848ieinstal.exeC:\Users\admin\ristin\Toolboxsy8.screxecutable
MD5:—
SHA256:—
2848ieinstal.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850Dbinary
MD5:—
SHA256:—
2848ieinstal.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E3FCAD4A425A5F708A84C255989CBE2Cbinary
MD5:—
SHA256:—
2848ieinstal.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5457A8CE4B2A7499F8299A013B6E1C7C_CBB16B7A61CE4E298043181730D3CE9Bder
MD5:—
SHA256:—
2848ieinstal.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850Dder
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
4
DNS requests
6
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2848
ieinstal.exe
GET
200
151.139.128.14:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
US
der
727 b
whitelisted
2848
ieinstal.exe
GET
200
151.139.128.14:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEAt7Luhtp9V%2BIcfZTi4a23A%3D
US
der
471 b
whitelisted
2848
ieinstal.exe
GET
200
151.139.128.14:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEBPqKHBb9OztDDZjCYBhQzY%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2848
ieinstal.exe
198.54.120.206:443
docxuploads.com
Namecheap, Inc.
US
malicious
—
—
151.139.128.14:80
ocsp.usertrust.com
Highwinds Network Group, Inc.
US
suspicious
2848
ieinstal.exe
79.134.225.108:7522
ddns.thingsthings.xyz
Andreas Fink trading as Fink Telecom Services
CH
malicious

DNS requests

Domain
IP
Reputation
docxuploads.com
  • 198.54.120.206
malicious
ocsp.usertrust.com
  • 151.139.128.14
whitelisted
ocsp.sectigo.com
  • 151.139.128.14
whitelisted
ddns.thingsthings.xyz
  • 79.134.225.108
malicious

Threats

Found threats are available for the paid subscriptions
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Wire_Transfer_Debit _Advice_feebruaur19_2020.xxe