| File name: | 1.7z |
| Full analysis: | https://app.any.run/tasks/7cb4c3ea-f051-4fd5-9af5-829a1faa015e |
| Verdict: | Malicious activity |
| Threats: | Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying. |
| Analysis date: | September 30, 2019, 10:51:14 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-7z-compressed |
| File info: | 7-zip archive data, version 0.4 |
| MD5: | 65736C14F30022B07255522684E759D2 |
| SHA1: | EB368669F35F0B01A922D9710CBE8075B66E1063 |
| SHA256: | B4AFDC6B4B5C6AA200EDEA731577362442A008AD22DBD91A5F32516837B71137 |
| SSDEEP: | 384:25lo2u5zj+XFc1FNV4RG0E48dxYmHSlx37Ez4JGfE+f:0oz5v+1CNV4Ro48d6mH2xHJk |
MALICIOUS
Application was dropped or rewritten from another process
- rad5C146.tmp (PID: 3308)
Changes the autorun value in the registry
- rad5C146.tmp (PID: 3308)
TROLDESH was detected
- rad5C146.tmp (PID: 3308)
Downloads executable files from the Internet
- WScript.exe (PID: 2344)
Actions looks like stealing of personal data
- rad5C146.tmp (PID: 3308)
Modifies files in Chrome extension folder
- rad5C146.tmp (PID: 3308)
SUSPICIOUS
Reads Internet Cache Settings
- OUTLOOK.EXE (PID: 2368)
Executes scripts
- WinRAR.exe (PID: 2684)
Creates files in the user directory
- OUTLOOK.EXE (PID: 2368)
Starts application with an unusual extension
- cmd.exe (PID: 2416)
Starts CMD.EXE for commands execution
- WScript.exe (PID: 2344)
Creates files in the program directory
- rad5C146.tmp (PID: 3308)
Executable content was dropped or overwritten
- WScript.exe (PID: 2344)
- rad5C146.tmp (PID: 3308)
Checks for external IP
- rad5C146.tmp (PID: 3308)
INFO
Reads Microsoft Office registry keys
- OUTLOOK.EXE (PID: 2368)
Dropped object may contain URL to Tor Browser
- rad5C146.tmp (PID: 3308)
Dropped object may contain TOR URL's
- rad5C146.tmp (PID: 3308)
Dropped object may contain Bitcoin addresses
- rad5C146.tmp (PID: 3308)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .7z | | | 7-Zip compressed archive (v0.4) (57.1) |
|---|---|---|
| .7z | | | 7-Zip compressed archive (gen) (42.8) |
Total processes
46
Monitored processes
7
Malicious processes
6
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2344 | "C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIb2684.24431\Информация о заказе.2019-0812.docx.js" | C:\Windows\System32\WScript.exe | WinRAR.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 Modules
| |||||||||||||||
| 2368 | "C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE" /eml "C:\Users\admin\AppData\Local\Temp\Rar$DIb2900.22843\FW_ Относительно заказа.eml" | C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE | WinRAR.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Exit code: 0 Version: 14.0.6025.1000 Modules
| |||||||||||||||
| 2416 | "C:\Windows\System32\cmd.exe" /c C:\Users\admin\AppData\Local\Temp\rad5C146.tmp | C:\Windows\System32\cmd.exe | — | WScript.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2684 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\0AUMKWMY\Фокин86.rar" | C:\Program Files\WinRAR\WinRAR.exe | — | OUTLOOK.EXE | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 Modules
| |||||||||||||||
| 2900 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\1.7z" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 Modules
| |||||||||||||||
| 3308 | C:\Users\admin\AppData\Local\Temp\rad5C146.tmp | C:\Users\admin\AppData\Local\Temp\rad5C146.tmp | cmd.exe | ||||||||||||
User: admin Company: IObit Integrity Level: MEDIUM Description: Send Bug Report Exit code: 0 Version: 1.1.0.53 Modules
| |||||||||||||||
| 3860 | C:\Windows\system32\vssadmin.exe List Shadows | C:\Windows\system32\vssadmin.exe | — | rad5C146.tmp | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Command Line Interface for Microsoft® Volume Shadow Copy Service Exit code: 2 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
2 485
Read events
2 030
Write events
436
Delete events
19
Modification events
| (PID) Process: | (2900) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (2900) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (2900) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\72\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (2900) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface |
| Operation: | write | Name: | ShowPassword |
Value: 0 | |||
| (PID) Process: | (2900) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\1.7z | |||
| (PID) Process: | (2900) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (2900) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (2900) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (2900) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (2368) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1033 |
Value: Off | |||
Executable files
3
Suspicious files
1 079
Text files
66
Unknown types
17
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2368 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVRDFCE.tmp.cvr | — | |
MD5:— | SHA256:— | |||
| 2368 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\0AUMKWMY\Фокин86 (2).rar\:Zone.Identifier:$DATA | — | |
MD5:— | SHA256:— | |||
| 3308 | rad5C146.tmp | C:\Users\admin\AppData\Local\Temp\6893A5D897\state.tmp | — | |
MD5:— | SHA256:— | |||
| 3308 | rad5C146.tmp | C:\Users\admin\AppData\Local\Temp\6893A5D897\unverified-microdesc-consensus.tmp | — | |
MD5:— | SHA256:— | |||
| 2684 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DIb2684.24431\Информация о заказе.2019-0812.docx.js | text | |
MD5:— | SHA256:— | |||
| 3308 | rad5C146.tmp | C:\Users\admin\AppData\Local\Temp\6893A5D897\cached-certs.tmp | — | |
MD5:— | SHA256:— | |||
| 2900 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DIb2900.22843\FW_ Относительно заказа.eml | text | |
MD5:— | SHA256:— | |||
| 3308 | rad5C146.tmp | C:\Users\admin\AppData\Local\Temp\6893A5D897\cached-microdesc-consensus.tmp | — | |
MD5:— | SHA256:— | |||
| 2368 | OUTLOOK.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm | pgc | |
MD5:— | SHA256:— | |||
| 2368 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\0AUMKWMY\Фокин86.rar | compressed | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
22
TCP/UDP connections
30
DNS requests
6
Threats
89
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2368 | OUTLOOK.EXE | GET | — | 64.4.26.155:80 | http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig | US | — | — | whitelisted |
2344 | WScript.exe | GET | 200 | 93.191.156.58:80 | http://dunkans.dk/blogs/media/1c.jpg | DK | executable | 1004 Kb | malicious |
3308 | rad5C146.tmp | GET | 403 | 104.16.155.36:80 | http://whatismyipaddress.com/ | US | text | 100 b | shared |
3308 | rad5C146.tmp | GET | 403 | 104.16.155.36:80 | http://whatismyipaddress.com/ | US | text | 100 b | shared |
3308 | rad5C146.tmp | GET | 403 | 104.16.155.36:80 | http://whatismyipaddress.com/ | US | text | 100 b | shared |
3308 | rad5C146.tmp | GET | 403 | 104.16.155.36:80 | http://whatismyipaddress.com/ | US | text | 100 b | shared |
3308 | rad5C146.tmp | GET | 200 | 104.18.34.131:80 | http://whatsmyip.net/ | US | html | 7.16 Kb | shared |
3308 | rad5C146.tmp | GET | 403 | 104.16.155.36:80 | http://whatismyipaddress.com/ | US | text | 100 b | shared |
3308 | rad5C146.tmp | GET | 403 | 104.16.155.36:80 | http://whatismyipaddress.com/ | US | text | 100 b | shared |
3308 | rad5C146.tmp | GET | 200 | 104.18.34.131:80 | http://whatsmyip.net/ | US | html | 7.16 Kb | shared |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2368 | OUTLOOK.EXE | 64.4.26.155:80 | config.messenger.msn.com | Microsoft Corporation | US | whitelisted |
2344 | WScript.exe | 93.191.156.58:80 | dunkans.dk | Zitcom A/S | DK | malicious |
3308 | rad5C146.tmp | 128.31.0.39:9101 | — | Massachusetts Institute of Technology | US | malicious |
3308 | rad5C146.tmp | 208.83.223.34:80 | — | Applied Operations, LLC | US | malicious |
3308 | rad5C146.tmp | 194.109.206.212:443 | — | Xs4all Internet BV | NL | malicious |
3308 | rad5C146.tmp | 131.188.40.189:443 | — | Verein zur Foerderung eines Deutschen Forschungsnetzes e.V. | DE | malicious |
3308 | rad5C146.tmp | 171.25.193.9:80 | — | Foreningen for digitala fri- och rattigheter | SE | malicious |
3308 | rad5C146.tmp | 185.171.130.240:9001 | — | Unet B.V. | NL | suspicious |
3308 | rad5C146.tmp | 104.238.188.98:443 | — | Choopa, LLC | FR | suspicious |
3308 | rad5C146.tmp | 195.154.241.125:443 | — | Online S.a.s. | FR | malicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
config.messenger.msn.com |
| whitelisted |
dunkans.dk |
| malicious |
dns.msftncsi.com |
| shared |
whatismyipaddress.com |
| shared |
whatsmyip.net |
| shared |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2344 | WScript.exe | A Network Trojan was detected | ET CURRENT_EVENTS Likely Evil EXE download from MSXMLHTTP non-exe extension M2 |
2344 | WScript.exe | A Network Trojan was detected | ET TROJAN JS/WSF Downloader Dec 08 2016 M4 |
2344 | WScript.exe | A Network Trojan was detected | AV POLICY EXE or DLL in HTTP Image Content Inbound - Likely Malicious |
2344 | WScript.exe | Misc activity | SUSPICIOUS [PTsecurity] PE as Image Content type mismatch |
3308 | rad5C146.tmp | Misc activity | ET POLICY TLS possible TOR SSL traffic |
3308 | rad5C146.tmp | Potential Corporate Privacy Violation | POLICY [PTsecurity] TOR SSL connection |
3308 | rad5C146.tmp | Misc Attack | ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 120 |
3308 | rad5C146.tmp | Misc Attack | ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 179 |
3308 | rad5C146.tmp | Misc activity | ET POLICY TLS possible TOR SSL traffic |
3308 | rad5C146.tmp | Potential Corporate Privacy Violation | POLICY [PTsecurity] TOR SSL connection |
52 ETPRO signatures available at the full report