analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

FinCERT_BAPB_URL2019052401.zip

Full analysis: https://app.any.run/tasks/08e4223d-db79-45e3-bf6e-74b111f94ee6
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Analysis date: May 24, 2019, 07:05:22
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
loader
ransomware
troldesh
shade
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

CE05A678D6F56ECBE86AB33C4756C94D

SHA1:

8261C0BCE7D6D56D862F312E985A6F4DAF5A9981

SHA256:

CA3BDB13533F2A1E1B7987D9C6482917D7633C20438E52025CE3D9AB885E387A

SSDEEP:

48:9+XRZN/LjYs43y3NhL/BJc1YxOuyye+vVeBlU5sT3bS3JMLWhP6tqa7YYAvBH3sV:YXRbwJy3J/xOVB+vglU5CuZGma7Ybv2

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • rad9EA48.tmp (PID: 3484)
      • rad9B9C4.tmp (PID: 2648)
      • rad4EE5E.tmp (PID: 2888)
    • Downloads executable files from the Internet

      • WScript.exe (PID: 3888)
    • TROLDESH was detected

      • rad9EA48.tmp (PID: 3484)
    • Changes the autorun value in the registry

      • rad9EA48.tmp (PID: 3484)
  • SUSPICIOUS

    • Starts Internet Explorer

      • OUTLOOK.EXE (PID: 3940)
    • Reads Internet Cache Settings

      • OUTLOOK.EXE (PID: 3940)
    • Creates files in the user directory

      • OUTLOOK.EXE (PID: 3940)
    • Starts CMD.EXE for commands execution

      • WScript.exe (PID: 3888)
      • WScript.exe (PID: 2308)
      • WScript.exe (PID: 2480)
    • Starts application with an unusual extension

      • cmd.exe (PID: 1208)
      • cmd.exe (PID: 3628)
      • cmd.exe (PID: 4080)
    • Executable content was dropped or overwritten

      • WScript.exe (PID: 3888)
      • WScript.exe (PID: 2308)
      • rad9EA48.tmp (PID: 3484)
      • WScript.exe (PID: 2480)
    • Executes scripts

      • WinRAR.exe (PID: 3244)
    • Creates files in the program directory

      • rad9EA48.tmp (PID: 3484)
  • INFO

    • Manual execution by user

      • OUTLOOK.EXE (PID: 3940)
      • WinRAR.exe (PID: 3244)
      • WScript.exe (PID: 3888)
    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 3940)
    • Creates files in the user directory

      • iexplore.exe (PID: 2868)
    • Changes internet zones settings

      • iexplore.exe (PID: 4056)
    • Application launched itself

      • iexplore.exe (PID: 4056)
    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2868)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0001
ZipCompression: Deflated
ZipModifyDate: 2019:05:24 09:18:09
ZipCRC: 0xd5d824e0
ZipCompressedSize: 3120
ZipUncompressedSize: 4798
ZipFileName: [Content] ?⭮??⥫쭮 ??????.eml
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
55
Monitored processes
14
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe no specs outlook.exe iexplore.exe iexplore.exe winrar.exe no specs wscript.exe cmd.exe no specs #TROLDESH rad9ea48.tmp wscript.exe cmd.exe no specs rad9b9c4.tmp wscript.exe cmd.exe no specs rad4ee5e.tmp

Process information

PID
CMD
Path
Indicators
Parent process
2812"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\FinCERT_BAPB_URL2019052401.zip"C:\Program Files\WinRAR\WinRAR.exeexplorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3940"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE" /eml "C:\Users\admin\Desktop\[Content] «G¡«ß¿Gѽ8¡« ºá¬áºá.eml"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Version:
14.0.6025.1000
4056"C:\Program Files\Internet Explorer\iexplore.exe" https://lazovskiphoto.com/ural_zakaz.zipC:\Program Files\Internet Explorer\iexplore.exe
OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2868"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:4056 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3244"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\ural_zakaz.zip"C:\Program Files\WinRAR\WinRAR.exeexplorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3888"C:\Windows\System32\WScript.exe" "C:\Users\admin\Desktop\Подробности заказа ОАО Авиакомпания Уральские авиалинии.js" C:\Windows\System32\WScript.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
1208"C:\Windows\System32\cmd.exe" /c C:\Users\admin\AppData\Local\Temp\rad9EA48.tmpC:\Windows\System32\cmd.exeWScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3484C:\Users\admin\AppData\Local\Temp\rad9EA48.tmpC:\Users\admin\AppData\Local\Temp\rad9EA48.tmp
cmd.exe
User:
admin
Company:
Glarysoft Ltd
Integrity Level:
MEDIUM
Description:
Registry Defrag
Version:
5.0.0.14
2308"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIa3244.11717\Подробности заказа ОАО Авиакомпания Уральские авиалинии.js" C:\Windows\System32\WScript.exe
WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
3628"C:\Windows\System32\cmd.exe" /c C:\Users\admin\AppData\Local\Temp\rad9B9C4.tmpC:\Windows\System32\cmd.exeWScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Total events
3 407
Read events
2 821
Write events
0
Delete events
0

Modification events

No data
Executable files
5
Suspicious files
3
Text files
36
Unknown types
6

Dropped files

PID
Process
Filename
Type
3940OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVR556D.tmp.cvr
MD5:
SHA256:
4056iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\favicon[1].ico
MD5:
SHA256:
3940OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:6D3E05DBF4FD1A8607E4BC192E24B20C
SHA256:CD3B5B2D603CF0676FB7F9D366098867D647B1F16D1D041DCFB077663FE89F8E
4056iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
MD5:
SHA256:
2812WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2812.6300\[Content] «G¡«ß¿Gѽ8¡« ºá¬áºá.emleml
MD5:D594BE0629A10B8462D09369BAF862C9
SHA256:221C61091DDF7B6524C723D7B7BE17AC90498A03286AEF76A08953A37F22C915
4056iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF675F326E0047B416.TMP
MD5:
SHA256:
3940OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\{A11A6174-BF6C-456F-93E5-5E39D8B6FE7E}\{1C306CB1-771E-4B4B-A902-86E897877F5B}.pngimage
MD5:7D80C0A7E3849818695EAF4989186A3C
SHA256:72DC527D78A8E99331409803811CC2D287E812C008A1C869A6AEA69D7A44B597
2868iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\TG0P2AU7\desktop.iniini
MD5:4A3DEB274BB5F0212C2419D3D8D08612
SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38
4056iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Feeds Cache\desktop.iniini
MD5:4A3DEB274BB5F0212C2419D3D8D08612
SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38
2868iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\TG0P2AU7\ural_zakaz[1].zipcompressed
MD5:1C5EABD028AE0CFC096516E253B3914A
SHA256:7726D663ACE0F06C8794DC2764B4A91146A035431E9540360EB5D0205BD0CCB5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
6
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3940
OUTLOOK.EXE
GET
64.4.26.155:80
http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig
US
whitelisted
3888
WScript.exe
GET
200
62.173.145.104:80
http://www.zagogulina.com/1c.jpg
RU
executable
1.19 Mb
malicious
4056
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3940
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
Microsoft Corporation
US
whitelisted
154.35.32.5:443
Rethem Hosting LLC
US
suspicious
4056
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3484
rad9EA48.tmp
208.83.223.34:80
Applied Operations, LLC
US
malicious
3888
WScript.exe
62.173.145.104:80
www.zagogulina.com
JSC Internet-Cosmos
RU
malicious
2868
iexplore.exe
85.93.145.251:443
lazovskiphoto.com
JSC Internet-Cosmos
RU
unknown

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
lazovskiphoto.com
  • 85.93.145.251
unknown
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
www.zagogulina.com
  • 62.173.145.104
malicious

Threats

PID
Process
Class
Message
3888
WScript.exe
A Network Trojan was detected
ET CURRENT_EVENTS Likely Evil EXE download from MSXMLHTTP non-exe extension M2
3888
WScript.exe
A Network Trojan was detected
ET TROJAN JS/WSF Downloader Dec 08 2016 M4
3888
WScript.exe
Misc activity
SUSPICIOUS [PTsecurity] PE as Image Content type mismatch
2 ETPRO signatures available at the full report
No debug info