download: | lTXDXOa54miw |
Full analysis: | https://app.any.run/tasks/0a3715b2-fc5e-4831-9f8b-1ef73882570d |
Verdict: | Malicious activity |
Threats: | Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns. |
Analysis date: | April 23, 2019, 14:41:02 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | E768D12DBEEED289DE6C9E2CA85DBC8B |
SHA1: | 4A8E18C92F2F3C15B9D430C1FD96A09F4E7CA27F |
SHA256: | CD01AB1E508197F7F16B871983F35BB9B9FBD942BD2571B9745BC8E65850BDA5 |
SSDEEP: | 192:xXpcAInnWK45PMsM/HzR/FkQ/J8GsAn4vbneZXpo9eMaMOLW/0vclO0pnXwsb/d:xXpcJnZt7R/FkQ/Jb4CBpo97aMXnh/d |
.zip | | | ZIP compressed archive (100) |
---|
ZipRequiredVersion: | 20 |
---|---|
ZipBitFlag: | 0x0002 |
ZipCompression: | Deflated |
ZipModifyDate: | 2019:04:20 20:06:01 |
ZipCRC: | 0x744bd4f7 |
ZipCompressedSize: | 11473 |
ZipUncompressedSize: | 39395 |
ZipFileName: | Document_7436570266US_Apr_20_2019.js |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2804 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\lTXDXOa54miw.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
2472 | "C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIa2804.49134\Document_7436570266US_Apr_20_2019.js" | C:\Windows\System32\WScript.exe | WinRAR.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 |
(PID) Process: | (2804) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtBMP |
Value: | |||
(PID) Process: | (2804) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtIcon |
Value: | |||
(PID) Process: | (2804) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (2804) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\lTXDXOa54miw.zip | |||
(PID) Process: | (2804) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | name |
Value: 120 | |||
(PID) Process: | (2804) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | size |
Value: 80 | |||
(PID) Process: | (2804) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | type |
Value: 120 | |||
(PID) Process: | (2804) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | mtime |
Value: 100 | |||
(PID) Process: | (2804) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E |
Operation: | write | Name: | @C:\Windows\System32\wshext.dll,-4804 |
Value: JScript Script File | |||
(PID) Process: | (2804) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2804 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DIa2804.49134\Document_7436570266US_Apr_20_2019.js | text | |
MD5:85ED645C9A46521018E97ABBC4605395 | SHA256:79C6CC4ED2307AD107C2B7018B2CE8ED6887F85C1034C6C04766C255C1932D06 | |||
2472 | WScript.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat | dat | |
MD5:D7A950FEFD60DBAA01DF2D85FEFB3862 | SHA256:75D0B1743F61B76A35B1FEDD32378837805DE58D79FA950CB6E8164BFA72073A |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2472 | WScript.exe | GET | 404 | 154.0.168.111:80 | http://kbnsa.com/_OLDNEW/o_lk/ | ZA | xml | 345 b | suspicious |
2472 | WScript.exe | GET | 404 | 80.94.52.80:80 | http://reckon.sk/e107_admin/LP_Rl/ | SK | xml | 345 b | suspicious |
2472 | WScript.exe | GET | 404 | 212.85.121.252:80 | http://projekthd.com/pub/j_y/ | PL | xml | 345 b | malicious |
2472 | WScript.exe | GET | 404 | 69.41.190.114:80 | http://johnstranovsky.com/96t8b-z2ns7-galcijo/H_p/ | US | xml | 345 b | suspicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2472 | WScript.exe | 69.41.190.114:80 | johnstranovsky.com | WZ Communications Inc. | US | suspicious |
2472 | WScript.exe | 212.85.121.252:80 | projekthd.com | home.pl S.A. | PL | malicious |
2472 | WScript.exe | 80.94.52.80:80 | reckon.sk | Trestel SK, a.s. | SK | suspicious |
2472 | WScript.exe | 154.0.168.111:80 | kbnsa.com | Afrihost | ZA | suspicious |
Domain | IP | Reputation |
---|---|---|
johnstranovsky.com |
| suspicious |
kbnsa.com |
| suspicious |
arjanlame.com |
| unknown |
reckon.sk |
| suspicious |
projekthd.com |
| malicious |
PID | Process | Class | Message |
---|---|---|---|
2472 | WScript.exe | Misc activity | SUSPICIOUS [PTsecurity] Cmd.Powershell.Download HTTP UserAgent (Win7) |
2472 | WScript.exe | Misc activity | SUSPICIOUS [PTsecurity] Cmd.Powershell.Download HTTP UserAgent (Win7) |
2472 | WScript.exe | Misc activity | SUSPICIOUS [PTsecurity] Cmd.Powershell.Download HTTP UserAgent (Win7) |
2472 | WScript.exe | Misc activity | SUSPICIOUS [PTsecurity] Cmd.Powershell.Download HTTP UserAgent (Win7) |