analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

folio4digital1853066304.zip

Full analysis: https://app.any.run/tasks/31454ed7-12dc-48ad-ac3b-ca8e79d51334
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: April 15, 2019, 12:37:01
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
stealer
Indicators:
MIME: application/octet-stream
File info: data
MD5:

5E9FADB147C76CDF4D47222A3BCC99E7

SHA1:

5AB3A0F44D306707F10AB1521EB9BBBAAD27E6B0

SHA256:

C1145C022E49492E2EC736A7391EB44E95D9EED6D582FBE6D87FB659C1776A88

SSDEEP:

12288:ru0zOSY9oS1DTAK6+O890gfSt8AgFsfSfee+ZTUDrPEDPXGLYIN+:ru39oSdTAWO806SiAIjIXhD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • satfolio971232mx.exe (PID: 1820)

    • Loads dropped or rewritten executable

      • hardMN5sumer.exe (PID: 2460)

    • Stealing of credential data

      • hardMN5sumer.exe (PID: 2460)

    • Changes settings of System certificates

      • satfolio971232mx.exe (PID: 1820)

    • Writes to a start menu file

      • hardMN5sumer.exe (PID: 2460)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1432)
      • hardMN5sumer.exe (PID: 2460)

    • Starts Internet Explorer

      • satfolio971232mx.exe (PID: 1820)

    • Creates files in the user directory

      • satfolio971232mx.exe (PID: 1820)
      • hardMN5sumer.exe (PID: 2460)

    • Reads internet explorer settings

      • satfolio971232mx.exe (PID: 1820)

    • Adds / modifies Windows certificates

      • satfolio971232mx.exe (PID: 1820)

  • INFO

    • Changes internet zones settings

      • iexplore.exe (PID: 3652)

    • Reads internet explorer settings

      • iexplore.exe (PID: 1704)

    • Creates files in the user directory

      • iexplore.exe (PID: 1704)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 1704)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.txt | Text - UTF-8 encoded (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
6
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start notepad.exe no specs winrar.exe satfolio971232mx.exe iexplore.exe iexplore.exe hardmn5sumer.exe

Process information

PID
CMD
Path
Indicators
Parent process
2088"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\folio4digital1853066304.zip.txtC:\Windows\system32\NOTEPAD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1432"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Desktop\folio4digital1853066304.zip" C:\Users\admin\Desktop\folio4digital1853066304\C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
1820"C:\Users\admin\Desktop\folio4digital1853066304\satfolio971232mx.exe" C:\Users\admin\Desktop\folio4digital1853066304\satfolio971232mx.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3652"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
satfolio971232mx.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
1704"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3652 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2460"C:\Users\admin\AppData\Roaming\TadminII\hardMN5sumer.exe" C:\Users\admin\AppData\Roaming\TadminII\hardMN5sumer.exe
satfolio971232mx.exe
User:
admin
Integrity Level:
MEDIUM
Total events
1 263
Read events
1 150
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
4
Text files
19
Unknown types
8

Dropped files

PID
Process
Filename
Type
3652iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\favicon[1].ico —
MD5:—
SHA256:—
3652iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
1704iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\UAI16QC6\desktop.iniini
MD5:4A3DEB274BB5F0212C2419D3D8D08612
SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38
1704iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.datdat
MD5:C3A4E0087FCEEF70AB0ACE44276A57DA
SHA256:D5032284FBA3F75052E85C4696625FF14FD6BC32B2F3BD0D269B0F5CF3BFDACC
1704iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DATsmt
MD5:5B62C13D97D3E9A8A72D46CA5136DCAB
SHA256:4F053C5055E702BB748E9931D4931CC3474C241F98C488FD3D9F49D2B0DDB238
1432WinRAR.exeC:\Users\admin\Desktop\folio4digital1853066304\satfolio971232mx.exeexecutable
MD5:BBCFC5102912C01E8AE13AA6AFD6E7A1
SHA256:A1EB1A2DB57A54708251B2ABDA71B6543938A4F60334FD4FE74B369476669B8F
3652iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFA202A602B9825E2C.TMP —
MD5:—
SHA256:—
3652iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFAD155E7FC388658C.TMP —
MD5:—
SHA256:—
1704iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\4SBHNZX4\desktop.iniini
MD5:4A3DEB274BB5F0212C2419D3D8D08612
SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38
1704iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\41DR7T87\desktop.iniini
MD5:4A3DEB274BB5F0212C2419D3D8D08612
SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
8
DNS requests
6
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1820
satfolio971232mx.exe
GET
200
23.229.232.7:80
http://shcpsatgobmxfoliofiscal.com/contador/index.php
US
—
—
malicious
3652
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1820
satfolio971232mx.exe
23.229.232.7:80
shcpsatgobmxfoliofiscal.com
GoDaddy.com, LLC
US
malicious
3652
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
1820
satfolio971232mx.exe
52.95.165.50:443
s3-sa-east-1.amazonaws.com
—
US
shared
1704
iexplore.exe
13.32.219.100:443
www.sat.gob.mx
Amazon.com, Inc.
US
unknown
2460
hardMN5sumer.exe
18.231.115.111:8890
chbu4889a03kashtoas.hopto.org
Amazon.com, Inc.
BR
unknown

DNS requests

Domain
IP
Reputation
www.sat.gob.mx
  • 13.32.219.100
  • 13.32.219.75
  • 13.32.219.99
  • 13.32.219.119
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
s3-sa-east-1.amazonaws.com
  • 52.95.165.50
shared
shcpsatgobmxfoliofiscal.com
  • 23.229.232.7
malicious
noismxnc8xns8ymde5.serveminecraft.net
  • —
unknown
chbu4889a03kashtoas.hopto.org
  • 18.231.115.111
malicious

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
folio4digital1853066304.zip