File name: | agent.rar |
Full analysis: | https://app.any.run/tasks/9c6b434d-9605-4124-b3d4-fd3b00f1babf |
Verdict: | Malicious activity |
Analysis date: | May 20, 2019, 19:27:08 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-rar |
File info: | RAR archive data, v5 |
MD5: | 229FB6FD6E1C55C18DB0F5B8475053BF |
SHA1: | 62745C1648A6F4C17D24105036D98E1FD63A8F68 |
SHA256: | B08F784FDC96DBE317D083B1A0C0BB781A85C462136DB242D20D12E44B7AD8F8 |
SSDEEP: | 96:VBwnRCVV/1EIX5mNmHuhpIeiZUGrvwPHdfNuPiwwTnOmWfodtg8QMy434i:vV/SoFuhZPTuP3gnP6MR |
.rar | | | RAR compressed archive (v5.0) (61.5) |
---|---|---|
.rar | | | RAR compressed archive (gen) (38.4) |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2716 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\agent.rar" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 | ||||
2680 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "-file" "C:\Users\admin\Desktop\poisonfrog.ps1" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
1636 | "C:\Windows\system32\schtasks.exe" /create /F /sc minute /mo 10 /tn \UpdateTasks\UpdateTask /tr "wscript /b \"C:\Users\Public\Public\UpdateTask.vbs\"" | C:\Windows\system32\schtasks.exe | — | powershell.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Manages scheduled tasks Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3304 | "C:\Windows\system32\schtasks.exe" /create /F /ru SYSTEM /sc minute /mo 10 /tn \UpdateTasks\UpdateTaskHosts /tr "wscript /b \"C:\Users\Public\Public\UpdateTask.vbs\"" | C:\Windows\system32\schtasks.exe | — | powershell.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Manages scheduled tasks Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2160 | "C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /s | C:\Windows\system32\mmc.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Management Console Exit code: 3221226540 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2644 | "C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /s | C:\Windows\system32\mmc.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft Management Console Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3984 | C:\Windows\system32\wscript.EXE /b "C:\Users\Public\Public\UpdateTask.vbs" | C:\Windows\system32\wscript.EXE | — | taskeng.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 | ||||
2176 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -file C:\Users\Public\Public\hUpdater.ps1 | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | wscript.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2236 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -file C:\Users\Public\Public\dUpdater.ps1 | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | wscript.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2772 | "C:\Program Files\Notepad++\notepad++.exe" "C:\Users\admin\Desktop\poisonfrog.ps1" | C:\Program Files\Notepad++\notepad++.exe | explorer.exe | |
User: admin Company: Don HO [email protected] Integrity Level: MEDIUM Description: Notepad++ : a free (GNU) source code editor Exit code: 0 Version: 7.51 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2716 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2716.45140\agent\poisonfrog.ps1 | — | |
MD5:— | SHA256:— | |||
2680 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\PTD6UFE0H01Q1YWHSV0G.temp | — | |
MD5:— | SHA256:— | |||
2176 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\RJZNPF054GQA6QWCZ3YF.temp | — | |
MD5:— | SHA256:— | |||
2236 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1OUHQ1MEAJ1VSPH6RA94.temp | — | |
MD5:— | SHA256:— | |||
2236 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF1426df.TMP | binary | |
MD5:33B4C42BAF9E3CA295E3BDCD51C02EAF | SHA256:B4273C31A01B0B90869574075D54D52E8098519587F61AE756B69729D0AF86A5 | |||
2176 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF1426b1.TMP | binary | |
MD5:33B4C42BAF9E3CA295E3BDCD51C02EAF | SHA256:B4273C31A01B0B90869574075D54D52E8098519587F61AE756B69729D0AF86A5 | |||
2772 | notepad++.exe | C:\Users\admin\AppData\Roaming\Notepad++\session.xml | text | |
MD5:C94AD405497A0BE8A3A587A773DAC21D | SHA256:E8E3C17F6CB65737A6EC4545E85C4A5933DC1F29E54255DDFA76DB5428754726 | |||
2680 | powershell.exe | C:\Users\Public\Public\dUpdater.ps1 | text | |
MD5:CD0BBFF03CE7946CD7C9DC339726D90A | SHA256:B1D621091740E62C84FC8C62BCDAD07873C8B61B83FABA36097EF150FD6EC768 | |||
2680 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:33B4C42BAF9E3CA295E3BDCD51C02EAF | SHA256:B4273C31A01B0B90869574075D54D52E8098519587F61AE756B69729D0AF86A5 | |||
2644 | mmc.exe | C:\Users\admin\AppData\Roaming\Microsoft\MMC\taskschd | xml | |
MD5:D4FC298CF49C1A5FF0C5A3BC872F4C8C | SHA256:12D8942972568A5CA8CDCA8A5B9860CD6779A68FD872D055ED3A9728925AC2FC |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 2.21.242.197:80 | http://isrg.trustid.ocsp.identrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D | NL | der | 1.37 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
4040 | gup.exe | 37.59.28.236:443 | notepad-plus-plus.org | OVH SAS | FR | whitelisted |
— | — | 2.21.242.197:80 | isrg.trustid.ocsp.identrust.com | Akamai International B.V. | NL | whitelisted |
Domain | IP | Reputation |
---|---|---|
myleftheart.com |
| malicious |
000atag012D1030AF4862A047.myleftheart.com |
| unknown |
at000ag12D100361BA287.myleftheart.com |
| unknown |
000a0tag12D1037FB239CA017.myleftheart.com |
| unknown |
notepad-plus-plus.org |
| whitelisted |
isrg.trustid.ocsp.identrust.com |
| whitelisted |
Process | Message |
---|---|
mmc.exe | Constructor: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
|
mmc.exe | OnInitialize: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
|
mmc.exe | AddIcons: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
|
mmc.exe | ProcessCommandLineArguments: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
|
notepad++.exe | VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
|
notepad++.exe | VerifyLibrary: certificate revocation checking is disabled
|
notepad++.exe | 42C4C5846BB675C74E2B2C90C69AB44366401093
|