download: | nXmxD-DJCeUscKWkI6l3U_lZXrDSlYS-p1 |
Full analysis: | https://app.any.run/tasks/7cadca88-00a6-4742-9065-24cb2341462a |
Verdict: | Malicious activity |
Analysis date: | April 23, 2019, 14:48:11 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | 162677E4D48B6FC74EA8C7A98705611D |
SHA1: | 7CA0049F8133234A7C30340BEADE6F0BF55FA639 |
SHA256: | C18D47740BA70F61A79F72FF242FF711C19F7E3E66F916D6713B919215B2672E |
SSDEEP: | 192:fXpcAInnWK45PMsM/HzR/FkQ/J8GsAn4vbneZXpo9eMaMOLW/0vclO0pnXwsb/H:fXpcJnZt7R/FkQ/Jb4CBpo97aMXnh/H |
.zip | | | ZIP compressed archive (100) |
---|
ZipRequiredVersion: | 20 |
---|---|
ZipBitFlag: | 0x0002 |
ZipCompression: | Deflated |
ZipModifyDate: | 2019:04:19 15:54:14 |
ZipCRC: | 0x744bd4f7 |
ZipCompressedSize: | 11473 |
ZipUncompressedSize: | 39395 |
ZipFileName: | LLC_915317353932US_Apr_19_2019.js |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2180 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\nXmxD-DJCeUscKWkI6l3U_lZXrDSlYS-p1.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
2324 | "C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIa2180.42315\LLC_915317353932US_Apr_19_2019.js" | C:\Windows\System32\WScript.exe | WinRAR.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 |
(PID) Process: | (2180) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtBMP |
Value: | |||
(PID) Process: | (2180) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtIcon |
Value: | |||
(PID) Process: | (2180) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (2180) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\nXmxD-DJCeUscKWkI6l3U_lZXrDSlYS-p1.zip | |||
(PID) Process: | (2180) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | name |
Value: 120 | |||
(PID) Process: | (2180) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | size |
Value: 80 | |||
(PID) Process: | (2180) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | type |
Value: 120 | |||
(PID) Process: | (2180) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | mtime |
Value: 100 | |||
(PID) Process: | (2180) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E |
Operation: | write | Name: | @C:\Windows\System32\wshext.dll,-4804 |
Value: JScript Script File | |||
(PID) Process: | (2180) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2180 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DIa2180.42315\LLC_915317353932US_Apr_19_2019.js | text | |
MD5:85ED645C9A46521018E97ABBC4605395 | SHA256:79C6CC4ED2307AD107C2B7018B2CE8ED6887F85C1034C6C04766C255C1932D06 | |||
2324 | WScript.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat | dat | |
MD5:D7A950FEFD60DBAA01DF2D85FEFB3862 | SHA256:75D0B1743F61B76A35B1FEDD32378837805DE58D79FA950CB6E8164BFA72073A |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2324 | WScript.exe | GET | 404 | 80.94.52.80:80 | http://reckon.sk/e107_admin/LP_Rl/ | SK | xml | 345 b | suspicious |
2324 | WScript.exe | GET | 404 | 69.41.190.114:80 | http://johnstranovsky.com/96t8b-z2ns7-galcijo/H_p/ | US | xml | 345 b | suspicious |
2324 | WScript.exe | GET | 404 | 154.0.168.111:80 | http://kbnsa.com/_OLDNEW/o_lk/ | ZA | xml | 345 b | suspicious |
2324 | WScript.exe | GET | 404 | 212.85.121.252:80 | http://projekthd.com/pub/j_y/ | PL | xml | 345 b | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2324 | WScript.exe | 69.41.190.114:80 | johnstranovsky.com | WZ Communications Inc. | US | suspicious |
2324 | WScript.exe | 80.94.52.80:80 | reckon.sk | Trestel SK, a.s. | SK | suspicious |
2324 | WScript.exe | 154.0.168.111:80 | kbnsa.com | Afrihost | ZA | suspicious |
2324 | WScript.exe | 212.85.121.252:80 | projekthd.com | home.pl S.A. | PL | malicious |
Domain | IP | Reputation |
---|---|---|
johnstranovsky.com |
| suspicious |
kbnsa.com |
| suspicious |
arjanlame.com |
| unknown |
reckon.sk |
| suspicious |
projekthd.com |
| malicious |
PID | Process | Class | Message |
---|---|---|---|
2324 | WScript.exe | Misc activity | SUSPICIOUS [PTsecurity] Cmd.Powershell.Download HTTP UserAgent (Win7) |
2324 | WScript.exe | Misc activity | SUSPICIOUS [PTsecurity] Cmd.Powershell.Download HTTP UserAgent (Win7) |
2324 | WScript.exe | Misc activity | SUSPICIOUS [PTsecurity] Cmd.Powershell.Download HTTP UserAgent (Win7) |
2324 | WScript.exe | Misc activity | SUSPICIOUS [PTsecurity] Cmd.Powershell.Download HTTP UserAgent (Win7) |