analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

37854.zip

Full analysis: https://app.any.run/tasks/62eb65fe-0e2b-48d6-96d0-847f9bac03ec
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: February 21, 2020, 18:03:59
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
qbot
trojan
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

AC415B87760932C5FACD828CCA687B27

SHA1:

0B2849B140A2C9B60721909C20C83664D6423BC4

SHA256:

C0FD3CE2EB0AEB7FD75BE46D9F0BF660CCD58D68D839CEC8FE1EA89F319A86FB

SSDEEP:

49152:DeEZi41WcIiQfiTqNB188m1P8GAk9KcvEV5HEm/02kTi4C6p:De0i4YccfiTqNB7m1EGAZPDHEa6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Downloads executable files from the Internet

      • WScript.exe (PID: 1504)
      • WScript.exe (PID: 3028)
      • WScript.exe (PID: 2276)
      • WScript.exe (PID: 3444)

    • Application was dropped or rewritten from another process

      • Figure3D.exe (PID: 1232)
      • Figure3D.exe (PID: 2376)
      • ytfovlym.exe (PID: 3952)
      • ytfovlym.exe (PID: 2484)
      • Figure3D.exe (PID: 3620)

    • QBOT was detected

      • Figure3D.exe (PID: 2376)

    • Runs PING.EXE for delay simulation

      • cmd.exe (PID: 2664)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WScript.exe (PID: 3028)
      • WScript.exe (PID: 1504)
      • Figure3D.exe (PID: 2376)
      • WScript.exe (PID: 3444)
      • WScript.exe (PID: 2276)
      • cmd.exe (PID: 2664)

    • Executes scripts

      • WinRAR.exe (PID: 1756)

    • Creates files in the user directory

      • Figure3D.exe (PID: 2376)

    • Application launched itself

      • Figure3D.exe (PID: 2376)
      • ytfovlym.exe (PID: 3952)

    • Starts itself from another location

      • Figure3D.exe (PID: 2376)

    • Starts CMD.EXE for commands execution

      • Figure3D.exe (PID: 2376)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • cmd.exe (PID: 2664)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2020:02:21 17:01:01
ZipCRC: 0xd7b9b4c7
ZipCompressedSize: 2738419
ZipUncompressedSize: 5432133
ZipFileName: JVC_37478.vbs
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
48
Monitored processes
13
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start winrar.exe no specs wscript.exe wscript.exe wscript.exe wscript.exe #QBOT figure3d.exe figure3d.exe ytfovlym.exe cmd.exe ping.exe no specs ytfovlym.exe explorer.exe no specs figure3d.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1756"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\37854.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3028"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIa1756.27256\JVC_37478.vbs" C:\Windows\System32\WScript.exe
WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
1504"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIa1756.31100\JVC_37478.vbs" C:\Windows\System32\WScript.exe
WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
3444"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIa1756.34403\JVC_37478.vbs" C:\Windows\System32\WScript.exe
WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Version:
5.8.7600.16385
2276"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIa1756.34439\JVC_37478.vbs" C:\Windows\System32\WScript.exe
WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Version:
5.8.7600.16385
2376C:\Users\admin\AppData\Local\Temp\Figure3D.exeC:\Users\admin\AppData\Local\Temp\Figure3D.exe
WScript.exe
User:
admin
Company:
NirSoft
Integrity Level:
MEDIUM
Description:
ProduKey
Exit code:
0
Version:
7.13
1232C:\Users\admin\AppData\Local\Temp\Figure3D.exe /CC:\Users\admin\AppData\Local\Temp\Figure3D.exe
Figure3D.exe
User:
admin
Company:
NirSoft
Integrity Level:
MEDIUM
Description:
ProduKey
Exit code:
0
Version:
7.13
3952C:\Users\admin\AppData\Roaming\Microsoft\Zulycjadyc\ytfovlym.exeC:\Users\admin\AppData\Roaming\Microsoft\Zulycjadyc\ytfovlym.exe
Figure3D.exe
User:
admin
Company:
NirSoft
Integrity Level:
MEDIUM
Description:
ProduKey
Exit code:
0
Version:
7.13
2664"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\admin\AppData\Local\Temp\Figure3D.exe"C:\Windows\System32\cmd.exe
Figure3D.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3948ping.exe -n 6 127.0.0.1 C:\Windows\system32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
802
Read events
785
Write events
0
Delete events
0

Modification events

No data
Executable files
6
Suspicious files
3
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
1756WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa1756.27256\JVC_37478.vbs —
MD5:—
SHA256:—
1756WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa1756.31100\JVC_37478.vbs —
MD5:—
SHA256:—
1756WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa1756.34403\JVC_37478.vbs —
MD5:—
SHA256:—
1756WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa1756.34439\JVC_37478.vbs —
MD5:—
SHA256:—
3144explorer.exeC:\Users\admin\AppData\Roaming\Microsoft\Zulycjadyc\ytfovlym.datbinary
MD5:BDED34D8917B6D577810A93FF807B636
SHA256:6611A217E9FA2DA4B6F93FD1FEF679E00D0FC9BEDD433972F18C6EB048E48B69
2376Figure3D.exeC:\Users\admin\AppData\Roaming\Microsoft\Zulycjadyc\ytfovlym.datbinary
MD5:A822918FACFD5A670ECCA8EDD9794A8E
SHA256:0558D533F73A293FD770EB147A83CE09238619E6EA57ECB90BD78796E6D38FE6
1504WScript.exeC:\Users\admin\AppData\Local\Temp\Figure3D.exeexecutable
MD5:FCDD3312253B315BE67C6380E5ACE3AA
SHA256:620600A0EA6159CA65C002E38EC92716D314F7643B969AE5673DF114F69943BC
3444WScript.exeC:\Users\admin\AppData\Local\Temp\Figure3D.exeexecutable
MD5:FCDD3312253B315BE67C6380E5ACE3AA
SHA256:620600A0EA6159CA65C002E38EC92716D314F7643B969AE5673DF114F69943BC
3028WScript.exeC:\Users\admin\AppData\Local\Temp\Figure3D.exeexecutable
MD5:FCDD3312253B315BE67C6380E5ACE3AA
SHA256:620600A0EA6159CA65C002E38EC92716D314F7643B969AE5673DF114F69943BC
2376Figure3D.exeC:\Users\admin\AppData\Roaming\Microsoft\Zulycjadyc\ytfovlym.exeexecutable
MD5:FCDD3312253B315BE67C6380E5ACE3AA
SHA256:620600A0EA6159CA65C002E38EC92716D314F7643B969AE5673DF114F69943BC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
4
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1504
WScript.exe
GET
200
104.154.229.109:80
http://a.kitchencabinetryprofessionals.com/background.png?uid=TQBpAGMAcgBvAHMAbwBmAHQAIABXAGkAbgBkAG8AdwBzACAANwAgAFAAcgBvAGYAZQBzAHMAaQBvAG4AYQBsACAA
US
executable
320 Kb
malicious
3028
WScript.exe
GET
200
104.154.229.109:80
http://a.kitchencabinetryprofessionals.com/background.png?uid=TQBpAGMAcgBvAHMAbwBmAHQAIABXAGkAbgBkAG8AdwBzACAANwAgAFAAcgBvAGYAZQBzAHMAaQBvAG4AYQBsACAA
US
executable
320 Kb
malicious
3444
WScript.exe
GET
200
104.154.229.109:80
http://a.kitchencabinetryprofessionals.com/background.png?uid=TQBpAGMAcgBvAHMAbwBmAHQAIABXAGkAbgBkAG8AdwBzACAANwAgAFAAcgBvAGYAZQBzAHMAaQBvAG4AYQBsACAA
US
executable
320 Kb
malicious
2276
WScript.exe
GET
200
104.154.229.109:80
http://a.kitchencabinetryprofessionals.com/background.png?uid=TQBpAGMAcgBvAHMAbwBmAHQAIABXAGkAbgBkAG8AdwBzACAANwAgAFAAcgBvAGYAZQBzAHMAaQBvAG4AYQBsACAA
US
executable
320 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1504
WScript.exe
104.154.229.109:80
a.kitchencabinetryprofessionals.com
Google Inc.
US
unknown
3028
WScript.exe
104.154.229.109:80
a.kitchencabinetryprofessionals.com
Google Inc.
US
unknown
3444
WScript.exe
104.154.229.109:80
a.kitchencabinetryprofessionals.com
Google Inc.
US
unknown
2276
WScript.exe
104.154.229.109:80
a.kitchencabinetryprofessionals.com
Google Inc.
US
unknown

DNS requests

Domain
IP
Reputation
a.kitchencabinetryprofessionals.com
  • 104.154.229.109
malicious

Threats

PID
Process
Class
Message
3028
WScript.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3028
WScript.exe
A Network Trojan was detected
AV POLICY EXE or DLL in HTTP Image Content Inbound - Likely Malicious
3028
WScript.exe
Misc activity
ET INFO EXE - Served Attached HTTP
3028
WScript.exe
Misc activity
SUSPICIOUS [PTsecurity] PE as Image Content type mismatch
1504
WScript.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
1504
WScript.exe
A Network Trojan was detected
AV POLICY EXE or DLL in HTTP Image Content Inbound - Likely Malicious
1504
WScript.exe
Misc activity
ET INFO EXE - Served Attached HTTP
1504
WScript.exe
Misc activity
SUSPICIOUS [PTsecurity] PE as Image Content type mismatch
3444
WScript.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3444
WScript.exe
A Network Trojan was detected
AV POLICY EXE or DLL in HTTP Image Content Inbound - Likely Malicious
Process
Message
Figure3D.exe
ZBZQBZ
Figure3D.exe
ZBZQBZ
ytfovlym.exe
ZBZQBZ
ytfovlym.exe
ZBZQBZ
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
37854.zip