analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
download:

uc

Full analysis: https://app.any.run/tasks/f04fc987-387e-49fb-9cb9-a5d8211e6934
Verdict: Malicious activity
Analysis date: May 15, 2019, 19:55:45
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

D1A31ACA2A26878914FE05416DEBA1F5

SHA1:

9144A485183DE48BFC5147149F46AD18A7D473B9

SHA256:

BD54F41A3D5981F80F2B05F272E397693B546F74E1F00BC75646EBF73C2ECB47

SSDEEP:

768:lGIMuJkvBMUv36ZpuWRyzntvqdIs9gia/dGy49w:QI0aUv36UrtvEIs9/a0W

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 3928)
      • cmd.exe (PID: 3832)

    • Changes the autorun value in the registry

      • WScript.exe (PID: 236)
      • wscript.exe (PID: 2416)
      • WScript.exe (PID: 3796)
      • wscript.exe (PID: 2956)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 3076)
      • schtasks.exe (PID: 272)

    • Writes to a start menu file

      • WScript.exe (PID: 236)
      • wscript.exe (PID: 2416)
      • WScript.exe (PID: 3796)
      • wscript.exe (PID: 2956)

  • SUSPICIOUS

    • Application launched itself

      • WScript.exe (PID: 236)
      • wscript.exe (PID: 2416)
      • WScript.exe (PID: 3796)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 2956)
      • wscript.exe (PID: 1892)

    • Creates files in the user directory

      • WScript.exe (PID: 236)
      • wscript.exe (PID: 2956)

    • Executes scripts

      • WScript.exe (PID: 236)
      • WinRAR.exe (PID: 3376)
      • wscript.exe (PID: 2416)
      • WScript.exe (PID: 3796)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
12
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs wscript.exe wscript.exe wscript.exe cmd.exe no specs schtasks.exe no specs wscript.exe no specs cmd.exe no specs schtasks.exe no specs wscript.exe wscript.exe no specs wscript.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3376"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\uc.rar"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
236"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIa3376.17763\embargo de cuenta corriente sobre giro en mora.vbs" C:\Windows\System32\WScript.exe
WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
2956"C:\Windows\System32\wscript.exe" //B "C:\Users\admin\AppData\Roaming\hDJmPnyWmy.vbs"C:\Windows\System32\wscript.exe
WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Version:
5.8.7600.16385
2416"C:\Windows\System32\wscript.exe" //B "C:\Users\admin\AppData\Local\Temp\embargo de cuenta corriente sobre giro en mora.vbs"C:\Windows\System32\wscript.exe
WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Version:
5.8.7600.16385
3928"C:\Windows\system32\cmd.exe" /c schtasks /create /sc minute /mo 30 /tn Skypee /tr "C:\Users\admin\AppData\Local\Temp\meee.vbs"C:\Windows\system32\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3076schtasks /create /sc minute /mo 30 /tn Skypee /tr "C:\Users\admin\AppData\Local\Temp\meee.vbs"C:\Windows\system32\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1892"C:\Windows\System32\wscript.exe" //B "C:\Users\admin\AppData\Roaming\hDJmPnyWmy.vbs"C:\Windows\System32\wscript.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Version:
5.8.7600.16385
3832"C:\Windows\system32\cmd.exe" /c schtasks /create /sc minute /mo 30 /tn Skypee /tr "C:\Users\admin\AppData\Local\Temp\meee.vbs"C:\Windows\system32\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
272schtasks /create /sc minute /mo 30 /tn Skypee /tr "C:\Users\admin\AppData\Local\Temp\meee.vbs"C:\Windows\system32\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3796"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIa3376.19356\embargo de cuenta corriente sobre giro en mora.vbs" C:\Windows\System32\WScript.exe
WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Total events
1 116
Read events
1 026
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
0
Text files
13
Unknown types
0

Dropped files

PID
Process
Filename
Type
3376WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa3376.19356\embargo de cuenta corriente sobre giro en mora.vbstext
MD5:76140B0D6A69694F10DB1DCF05643DDA
SHA256:7F288652DAD3B00A4C47F2478EBD381155C42D01C151329F656FAF9CACF3048F
236WScript.exeC:\Users\admin\AppData\Roaming\hDJmPnyWmy.vbstext
MD5:AD663CC85C0CA80579B9E9F287C13F61
SHA256:DDFB8FB437DA3406AAD5FFEA4BE12AA94497F0C2DD05D4C886F49F5B9601D2EA
2956wscript.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hDJmPnyWmy.vbstext
MD5:AD663CC85C0CA80579B9E9F287C13F61
SHA256:DDFB8FB437DA3406AAD5FFEA4BE12AA94497F0C2DD05D4C886F49F5B9601D2EA
1892wscript.exeC:\Users\admin\AppData\Local\Temp\meee.vbstext
MD5:862AC5C5963DEE1ADF7079700B9B72C7
SHA256:C5729F125CAA32F23039388E039867744318B22B21DAD5BCE92E94549F5D00C2
236WScript.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\embargo de cuenta corriente sobre giro en mora.vbstext
MD5:76140B0D6A69694F10DB1DCF05643DDA
SHA256:7F288652DAD3B00A4C47F2478EBD381155C42D01C151329F656FAF9CACF3048F
3376WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa3376.17763\embargo de cuenta corriente sobre giro en mora.vbstext
MD5:76140B0D6A69694F10DB1DCF05643DDA
SHA256:7F288652DAD3B00A4C47F2478EBD381155C42D01C151329F656FAF9CACF3048F
2956wscript.exeC:\Users\admin\AppData\Local\Temp\meee.vbstext
MD5:862AC5C5963DEE1ADF7079700B9B72C7
SHA256:C5729F125CAA32F23039388E039867744318B22B21DAD5BCE92E94549F5D00C2
236WScript.exeC:\Users\admin\AppData\Local\Temp\embargo de cuenta corriente sobre giro en mora.vbstext
MD5:76140B0D6A69694F10DB1DCF05643DDA
SHA256:7F288652DAD3B00A4C47F2478EBD381155C42D01C151329F656FAF9CACF3048F
2416wscript.exeC:\Users\admin\AppData\Roaming\hDJmPnyWmy.vbstext
MD5:AD663CC85C0CA80579B9E9F287C13F61
SHA256:DDFB8FB437DA3406AAD5FFEA4BE12AA94497F0C2DD05D4C886F49F5B9601D2EA
2416wscript.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\embargo de cuenta corriente sobre giro en mora.vbstext
MD5:76140B0D6A69694F10DB1DCF05643DDA
SHA256:7F288652DAD3B00A4C47F2478EBD381155C42D01C151329F656FAF9CACF3048F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
15
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2416
wscript.exe
POST
—
192.169.69.25:5561
http://ofinuevamayo.duckdns.org:5561/is-ready
US
—
—
malicious
2416
wscript.exe
POST
—
192.169.69.25:5561
http://ofinuevamayo.duckdns.org:5561/is-ready
US
—
—
malicious
2416
wscript.exe
POST
—
192.169.69.25:5561
http://ofinuevamayo.duckdns.org:5561/is-ready
US
—
—
malicious
2416
wscript.exe
POST
—
192.169.69.25:5561
http://ofinuevamayo.duckdns.org:5561/is-ready
US
—
—
malicious
2416
wscript.exe
POST
—
192.169.69.25:5561
http://ofinuevamayo.duckdns.org:5561/is-ready
US
—
—
malicious
2416
wscript.exe
POST
—
192.169.69.25:5561
http://ofinuevamayo.duckdns.org:5561/is-ready
US
—
—
malicious
2416
wscript.exe
POST
—
192.169.69.25:5561
http://ofinuevamayo.duckdns.org:5561/is-ready
US
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2416
wscript.exe
192.169.69.25:5561
ofinuevamayo.duckdns.org
Wowrack.com
US
malicious
2956
wscript.exe
23.105.131.223:6677
brothersjoy.nl
Nobis Technology Group, LLC
US
malicious

DNS requests

Domain
IP
Reputation
brothersjoy.nl
  • 23.105.131.223
unknown
ofinuevamayo.duckdns.org
  • 192.169.69.25
malicious

Threats

PID
Process
Class
Message
—
—
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
uc