analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
download:

messg.jpg

Full analysis: https://app.any.run/tasks/c851b915-6201-407b-bc43-166dc927a7c7
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: February 11, 2019, 01:13:03
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ransomware
troldesh
shade
evasion
trojan
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

87AB5F476D4351224D893E267CC30D3B

SHA1:

22E1FEFD40BDE744C165D316DB26E88B5F4E6E70

SHA256:

CA233059D5F7370DFDADF37D8F6B27EBF72DDAF6458613C2084B705727CF68AB

SSDEEP:

24576:pnaaSYiqG1mIwV5eyX5VFGlzXXeYbi5wYHjJ+bfb:pnaDpqii5rXpGl7X4DJ+bD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • messg.jpg.exe (PID: 3112)

    • TROLDESH was detected

      • messg.jpg.exe (PID: 3112)

    • Runs app for hidden code execution

      • messg.jpg.exe (PID: 3112)

    • Deletes shadow copies

      • messg.jpg.exe (PID: 3112)

    • Dropped file may contain instructions of ransomware

      • messg.jpg.exe (PID: 3112)

    • Actions looks like stealing of personal data

      • messg.jpg.exe (PID: 3112)

    • Modifies files in Chrome extension folder

      • messg.jpg.exe (PID: 3112)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • messg.jpg.exe (PID: 3112)

    • Creates files in the program directory

      • messg.jpg.exe (PID: 3112)

    • Connects to unusual port

      • messg.jpg.exe (PID: 3112)

    • Checks for external IP

      • messg.jpg.exe (PID: 3112)

    • Creates files in the user directory

      • messg.jpg.exe (PID: 3112)

    • Starts CMD.EXE for commands execution

      • messg.jpg.exe (PID: 3112)

    • Starts application with an unusual extension

      • cmd.exe (PID: 3392)

    • Creates files like Ransomware instruction

      • messg.jpg.exe (PID: 3112)

  • INFO

    • Dropped object may contain URL to Tor Browser

      • messg.jpg.exe (PID: 3112)

    • Dropped object may contain TOR URL's

      • messg.jpg.exe (PID: 3112)

    • Dropped object may contain Bitcoin addresses

      • messg.jpg.exe (PID: 3112)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

Comments: -
ProductVersion: 2012
ProductName: AdminToys Suite
OriginalFileName: -
LegalTrademarks: All trademarks are the property of their respective owners.
LegalCopyright: Copyright © 2008-2013 Lovelysoft. All rights reserved
InternalName: -
FileVersion: 1.8.0.1800
FileDescription: Logged On User AppStarter Service
CompanyName: Lovelysoft
CharacterSet: Windows, Latin1
LanguageCode: English (U.S.)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 1.8.0.1800
FileVersionNumber: 1.8.0.1800
Subsystem: Windows GUI
SubsystemVersion: 5
ImageVersion: -
OSVersion: 5
EntryPoint: 0x1f80
UninitializedDataSize: -
InitializedDataSize: 1221120
CodeSize: 14336
LinkerVersion: 9
PEType: PE32
TimeStamp: 2019:02:07 14:43:21+01:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 07-Feb-2019 13:43:21
Detected languages:
  • English - United States
  • Russian - Russia
CompanyName: Lovelysoft
FileDescription: Logged On User AppStarter Service
FileVersion: 1.8.0.1800
InternalName: -
LegalCopyright: Copyright © 2008-2013 Lovelysoft. All rights reserved
LegalTrademarks: All trademarks are the property of their respective owners.
OriginalFilename: -
ProductName: AdminToys Suite
ProductVersion: 2012
Comments: -

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000D8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 07-Feb-2019 13:43:21
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x000037B3
0x00003800
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.31543
.rdata
0x00005000
0x00001BCC
0x00001C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.66861
.data
0x00007000
0x00122764
0x00122400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
6.67495
.CRT
0x0012A000
0x00000004
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
0.0572566
.rsrc
0x0012B000
0x000DCBC0
0x00005C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.16836

Resources

Title
Entropy
Size
Codepage
Language
Type
1
3.4321
952
UNKNOWN
English - United States
RT_VERSION
2
2.80231
308
UNKNOWN
UNKNOWN
RT_CURSOR
3
3.00046
308
UNKNOWN
UNKNOWN
RT_CURSOR
4
2.56318
308
UNKNOWN
UNKNOWN
RT_CURSOR
5
2.6949
308
UNKNOWN
UNKNOWN
RT_CURSOR
6
2.62527
308
UNKNOWN
UNKNOWN
RT_CURSOR
7
2.91604
308
UNKNOWN
UNKNOWN
RT_CURSOR
8
2.63385
744
UNKNOWN
Russian - Russia
RT_ICON
9
2.23817
296
UNKNOWN
Russian - Russia
RT_ICON
4079
2.52096
142
UNKNOWN
UNKNOWN
RT_STRING

Imports

ADVAPI32.dll
GDI32.dll
IMM32.dll
KERNEL32.dll
USER32.dll
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
6
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #TROLDESH messg.jpg.exe vssadmin.exe no specs vssadmin.exe vssvc.exe no specs cmd.exe no specs chcp.com no specs

Process information

PID
CMD
Path
Indicators
Parent process
3112"C:\Users\admin\AppData\Local\Temp\messg.jpg.exe" C:\Users\admin\AppData\Local\Temp\messg.jpg.exe
explorer.exe
User:
admin
Company:
Lovelysoft
Integrity Level:
MEDIUM
Description:
Logged On User AppStarter Service
Version:
1.8.0.1800
Modules
Images
c:\users\admin\appdata\local\temp\messg.jpg.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2812C:\Windows\system32\vssadmin.exe List ShadowsC:\Windows\system32\vssadmin.exe—messg.jpg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Command Line Interface for Microsoft® Volume Shadow Copy Service
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssadmin.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
3052"C:\Windows\system32\vssadmin.exe" Delete Shadows /All /QuietC:\Windows\system32\vssadmin.exe
messg.jpg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Command Line Interface for Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssadmin.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
3840C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3392C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe—messg.jpg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\user32.dll
2064chcpC:\Windows\system32\chcp.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Change CodePage Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\chcp.com
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
105
Read events
83
Write events
22
Delete events
0

Modification events

(PID) Process:(3112) messg.jpg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\System32\Configuration
Operation:writeName:xi
Value:
906D0F2E2F604F839E04
(PID) Process:(3112) messg.jpg.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Client Server Runtime Subsystem
Value:
"C:\ProgramData\Windows\csrss.exe"
(PID) Process:(3112) messg.jpg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\System32\Configuration
Operation:writeName:xVersion
Value:
4.0.0.1
(PID) Process:(3112) messg.jpg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\System32\Configuration
Operation:writeName:xmail
Value:
1
(PID) Process:(3112) messg.jpg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\System32\Configuration
Operation:writeName:xmode
Value:
0
(PID) Process:(3112) messg.jpg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\System32\Configuration
Operation:writeName:xpk
Value:
-----BEGIN PUBLIC KEY----- MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEA8mn4F2LJ2xbiQ2U0nRya c1tR+wN6CcLUa3lCLO+4Hj4gGGvPGugPV/9l2cAkeQZahnqlgKG51eaFO1UYdmPs zyNfi9qlgFndoFL8XsxFHJ4C9BqqlIpD15pglgrubqX0lZGlI27dXh4bu3fA9zrI ULugLryqMmIId6MDIY2WalR+7Vpq8ATM6VN1/+CKBDEcdHeWsNScgxtKOVa20E60 qOWxzdUoCeMHgMr+Q8kzPQzreyejLbBZL9cXTxstXJVsA64ge/G71oZlLU7j2Ujp EHkXR4G0I5QBEQu62K0R+cz3FqxP6CN6Pm1MJb8XHkU54FYsVsLsk5nasUMUZ9Uq 5ikgVEO65k7bgwi9nGZsyDlWDOwbGuSRreLAVKeCDiO2jfSBOTH16gIyT9rE7UDj 6SRe2guJhe2sqwXpwgmTJsWffQmzg5vQwWrL4UXUASCWvtODBBTq8jGom9T5Aet/ gsLcsM1ozqI961wp6RZPO1WluzsxvpDT4bCJmc5D6dp/AgMBAAE= -----END PUBLIC KEY-----
(PID) Process:(3112) messg.jpg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\System32\Configuration
Operation:writeName:xstate
Value:
3
(PID) Process:(3112) messg.jpg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\System32\Configuration
Operation:writeName:xcnt
Value:
0
(PID) Process:(3112) messg.jpg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\System32\Configuration
Operation:writeName:xstate
Value:
4
(PID) Process:(3112) messg.jpg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\System32\Configuration
Operation:writeName:shst
Value:
4
Executable files
1
Suspicious files
1 088
Text files
47
Unknown types
34

Dropped files

PID
Process
Filename
Type
3112messg.jpg.exeC:\Users\admin\AppData\Local\Temp\6893A5D897\state.tmp —
MD5:—
SHA256:—
3112messg.jpg.exeC:\Users\admin\AppData\Local\Temp\6893A5D897\unverified-microdesc-consensus.tmp —
MD5:—
SHA256:—
3112messg.jpg.exeC:\Users\admin\AppData\Local\Temp\6893A5D897\cached-certs.tmp —
MD5:—
SHA256:—
3112messg.jpg.exeC:\Users\admin\AppData\Local\Temp\6893A5D897\cached-microdesc-consensus.tmp —
MD5:—
SHA256:—
3112messg.jpg.exeC:\Users\Public\Videos\Sample Videos\Wildlife.wmv —
MD5:—
SHA256:—
3112messg.jpg.exeC:\Users\Public\Videos\Sample Videos\vgciLuCxy0rctXUEqPBrummV6-ieDu13EC8ZUdVMYgM=.906D0F2E2F604F839E04.crypted000007 —
MD5:—
SHA256:—
3112messg.jpg.exeC:\Users\Public\Pictures\Sample Pictures\Tulips.jpg —
MD5:—
SHA256:—
3112messg.jpg.exeC:\Users\admin\AppData\Local\Temp\6893A5~1\cached-microdesc-consensustext
MD5:8DFB74771F898EF503799E451350398A
SHA256:CFFB81D6201F057116D6D733BA9483FA388713AB95C4D975C7F112FE2E1A39BA
3112messg.jpg.exeC:\Users\Public\Pictures\Sample Pictures\Penguins.jpg —
MD5:—
SHA256:—
3112messg.jpg.exeC:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
16
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3112
messg.jpg.exe
GET
403
104.16.154.36:80
http://whatismyipaddress.com/
US
text
100 b
shared
3112
messg.jpg.exe
GET
403
104.16.154.36:80
http://whatismyipaddress.com/
US
text
100 b
shared
3112
messg.jpg.exe
GET
403
104.16.154.36:80
http://whatismyipaddress.com/
US
text
100 b
shared
3112
messg.jpg.exe
GET
403
104.16.154.36:80
http://whatismyipaddress.com/
US
text
100 b
shared
3112
messg.jpg.exe
GET
200
104.18.34.131:80
http://whatsmyip.net/
US
html
7.35 Kb
shared
3112
messg.jpg.exe
GET
403
104.16.154.36:80
http://whatismyipaddress.com/
US
text
100 b
shared
3112
messg.jpg.exe
GET
403
104.16.154.36:80
http://whatismyipaddress.com/
US
text
100 b
shared
3112
messg.jpg.exe
GET
403
104.16.154.36:80
http://whatismyipaddress.com/
US
text
100 b
shared
3112
messg.jpg.exe
GET
403
104.16.154.36:80
http://whatismyipaddress.com/
US
text
100 b
shared
3112
messg.jpg.exe
GET
403
104.16.154.36:80
http://whatismyipaddress.com/
US
text
100 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3112
messg.jpg.exe
86.59.21.38:443
—
Tele2 Telecommunication GmbH
AT
malicious
3112
messg.jpg.exe
194.109.206.212:443
—
Xs4all Internet BV
NL
malicious
3112
messg.jpg.exe
136.243.131.29:9001
—
Hetzner Online GmbH
DE
suspicious
3112
messg.jpg.exe
5.45.111.149:443
—
netcup GmbH
DE
suspicious
3112
messg.jpg.exe
188.40.238.144:9001
—
Hetzner Online GmbH
DE
suspicious
3112
messg.jpg.exe
104.16.154.36:80
whatismyipaddress.com
Cloudflare Inc
US
shared
3112
messg.jpg.exe
104.18.34.131:80
whatsmyip.net
Cloudflare Inc
US
shared

DNS requests

Domain
IP
Reputation
whatismyipaddress.com
  • 104.16.154.36
  • 104.16.155.36
shared
whatsmyip.net
  • 104.18.34.131
  • 104.18.35.131
shared

Threats

PID
Process
Class
Message
3112
messg.jpg.exe
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 649
3112
messg.jpg.exe
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 530
3112
messg.jpg.exe
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 122
3112
messg.jpg.exe
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 258
3112
messg.jpg.exe
Misc activity
ET POLICY TLS possible TOR SSL traffic
3112
messg.jpg.exe
Misc activity
ET POLICY TLS possible TOR SSL traffic
3112
messg.jpg.exe
A Network Trojan was detected
MALWARE [PTsecurity] Shade/Troldesh Ransomware External IP Check
3112
messg.jpg.exe
A Network Trojan was detected
MALWARE [PTsecurity] Shade/Troldesh Ransomware External IP Check
3112
messg.jpg.exe
A Network Trojan was detected
MALWARE [PTsecurity] Shade/Troldesh Ransomware External IP Check
3112
messg.jpg.exe
A Network Trojan was detected
MALWARE [PTsecurity] Shade/Troldesh Ransomware External IP Check
21 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
messg.jpg