File name: | 7z8cLuhZ |
Full analysis: | https://app.any.run/tasks/5b4831f1-5467-4ce5-976a-35ed63ace6bb |
Verdict: | Malicious activity |
Threats: | Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns. |
Analysis date: | April 23, 2019, 08:49:29 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | 574EEEDEE2FDDBAE05C2F6006784B031 |
SHA1: | 2CF49197413B315B77A91955ACB7537AA15A99DA |
SHA256: | CDF7F52EF3A8B402731CD3468EAB6984609EF724613D2575AF84B6E94A320A54 |
SSDEEP: | 192:pant0pzmN9sWiE1Ef9crNhWAOaPsUoN/hZg+bdHTp84+bWOXwc9:YQLXE137HOaPsDbdHl8/1Xl9 |
.zip | | | ZIP compressed archive (100) |
---|
ZipRequiredVersion: | 20 |
---|---|
ZipBitFlag: | 0x0002 |
ZipCompression: | Deflated |
ZipModifyDate: | 2019:04:23 11:22:00 |
ZipCRC: | 0x647eb836 |
ZipCompressedSize: | 11790 |
ZipUncompressedSize: | 39576 |
ZipFileName: | INC_6883909564US_Apr_23_2019.js |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2596 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\7z8cLuhZ.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
2936 | "C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIa2596.39462\INC_6883909564US_Apr_23_2019.js" | C:\Windows\System32\WScript.exe | WinRAR.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 | ||||
2908 | "C:\Users\admin\AppData\Local\Temp\ggxq78bso.exe" | C:\Users\admin\AppData\Local\Temp\ggxq78bso.exe | — | WScript.exe |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
3868 | --e7c32588 | C:\Users\admin\AppData\Local\Temp\ggxq78bso.exe | ggxq78bso.exe | |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
1020 | "C:\Users\admin\AppData\Local\soundser\soundser.exe" | C:\Users\admin\AppData\Local\soundser\soundser.exe | ggxq78bso.exe | |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
2196 | --3ab57678 | C:\Users\admin\AppData\Local\soundser\soundser.exe | soundser.exe | |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
1248 | "C:\Users\admin\AppData\Local\soundser\86J3e9KwfSbqN.exe" | C:\Users\admin\AppData\Local\soundser\86J3e9KwfSbqN.exe | — | soundser.exe |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
1904 | --9961c78c | C:\Users\admin\AppData\Local\soundser\86J3e9KwfSbqN.exe | 86J3e9KwfSbqN.exe | |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
2308 | "C:\Users\admin\AppData\Local\soundser\soundser.exe" | C:\Users\admin\AppData\Local\soundser\soundser.exe | 86J3e9KwfSbqN.exe | |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
1532 | --3ab57678 | C:\Users\admin\AppData\Local\soundser\soundser.exe | soundser.exe | |
User: admin Integrity Level: MEDIUM |
(PID) Process: | (2596) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtBMP |
Value: | |||
(PID) Process: | (2596) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtIcon |
Value: | |||
(PID) Process: | (2596) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (2596) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\7z8cLuhZ.zip | |||
(PID) Process: | (2596) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | name |
Value: 120 | |||
(PID) Process: | (2596) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | size |
Value: 80 | |||
(PID) Process: | (2596) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | type |
Value: 120 | |||
(PID) Process: | (2596) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | mtime |
Value: 100 | |||
(PID) Process: | (2596) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E |
Operation: | write | Name: | @C:\Windows\System32\wshext.dll,-4804 |
Value: JScript Script File | |||
(PID) Process: | (2596) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2596 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DIa2596.39462\INC_6883909564US_Apr_23_2019.js | text | |
MD5:EF2D8A5FE1835C59FFB9A87BAB143AA9 | SHA256:5D89C4CB4860EA6552E5045A8C845FD5574AB20E6B186F5F5B3001FAAB57D558 | |||
2936 | WScript.exe | C:\Users\admin\AppData\Local\Temp\ggxq78bso.exe | executable | |
MD5:0AD37153765933B373E0A55D54BB635A | SHA256:B2BCB7FE83FFB8606BA25C652C5DFA2B2CF0DC694AF39285546D44910B39F208 | |||
2196 | soundser.exe | C:\Users\admin\AppData\Local\soundser\86J3e9KwfSbqN.exe | executable | |
MD5:1685459929809B2921B30325C75FEE14 | SHA256:714032B5E9C06FCFBC3014B8FAE232F26A7443B08321CE6F847ECB1EFF9E8AB5 | |||
2936 | WScript.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@insurgentguy[1].txt | text | |
MD5:1E0878793DE918D25236C3718E1B1D59 | SHA256:06431FE5D22CCF819A3749EAFA0F4DCCE129A96324D08ACD76EEB39F5B19BA47 | |||
3868 | ggxq78bso.exe | C:\Users\admin\AppData\Local\soundser\soundser.exe | executable | |
MD5:0AD37153765933B373E0A55D54BB635A | SHA256:B2BCB7FE83FFB8606BA25C652C5DFA2B2CF0DC694AF39285546D44910B39F208 | |||
1904 | 86J3e9KwfSbqN.exe | C:\Users\admin\AppData\Local\soundser\soundser.exe | executable | |
MD5:1685459929809B2921B30325C75FEE14 | SHA256:714032B5E9C06FCFBC3014B8FAE232F26A7443B08321CE6F847ECB1EFF9E8AB5 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2196 | soundser.exe | POST | — | 70.116.68.186:80 | http://70.116.68.186/cone/sym/ringin/ | US | — | — | malicious |
1532 | soundser.exe | POST | — | 68.229.130.39:80 | http://68.229.130.39/report/prep/ringin/merge/ | US | — | — | malicious |
2936 | WScript.exe | GET | 200 | 129.232.138.121:80 | http://insurgentguy.com/wp-admin/y_I/ | ZA | executable | 77.5 Kb | suspicious |
1532 | soundser.exe | POST | — | 70.116.68.186:80 | http://70.116.68.186/entries/ | US | — | — | malicious |
2196 | soundser.exe | POST | 200 | 190.112.228.47:443 | http://190.112.228.47:443/bml/forced/ringin/ | CW | binary | 85.8 Kb | malicious |
2196 | soundser.exe | POST | — | 68.229.130.39:80 | http://68.229.130.39/chunk/site/ringin/ | US | — | — | malicious |
1532 | soundser.exe | POST | 200 | 190.112.228.47:443 | http://190.112.228.47:443/publish/scripts/ | CW | binary | 66.3 Kb | malicious |
1532 | soundser.exe | POST | 200 | 190.112.228.47:443 | http://190.112.228.47:443/srvc/scripts/ringin/merge/ | CW | binary | 148 b | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2196 | soundser.exe | 68.229.130.39:80 | — | Cox Communications Inc. | US | malicious |
2196 | soundser.exe | 70.116.68.186:80 | — | Time Warner Cable Internet LLC | US | malicious |
2936 | WScript.exe | 129.232.138.121:80 | insurgentguy.com | HETZNER | ZA | suspicious |
1532 | soundser.exe | 68.229.130.39:80 | — | Cox Communications Inc. | US | malicious |
1532 | soundser.exe | 190.112.228.47:443 | — | Columbus Communications Curacao NV | CW | malicious |
2196 | soundser.exe | 190.112.228.47:443 | — | Columbus Communications Curacao NV | CW | malicious |
1532 | soundser.exe | 70.116.68.186:80 | — | Time Warner Cable Internet LLC | US | malicious |
Domain | IP | Reputation |
---|---|---|
insurgentguy.com |
| suspicious |
PID | Process | Class | Message |
---|---|---|---|
2936 | WScript.exe | Misc activity | SUSPICIOUS [PTsecurity] Cmd.Powershell.Download HTTP UserAgent (Win7) |
2936 | WScript.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
2936 | WScript.exe | A Network Trojan was detected | ET CURRENT_EVENTS Likely Evil EXE download from MSXMLHTTP non-exe extension M2 |
2936 | WScript.exe | Misc activity | ET INFO EXE - Served Attached HTTP |
2196 | soundser.exe | A Network Trojan was detected | MALWARE [PTsecurity] Feodo/Emotet |
2196 | soundser.exe | A Network Trojan was detected | MALWARE [PTsecurity] Feodo/Emotet |
2196 | soundser.exe | A Network Trojan was detected | MALWARE [PTsecurity] Feodo/Emotet |
2196 | soundser.exe | Potentially Bad Traffic | ET POLICY HTTP traffic on port 443 (POST) |
1532 | soundser.exe | A Network Trojan was detected | MALWARE [PTsecurity] Feodo/Emotet |
1532 | soundser.exe | A Network Trojan was detected | MALWARE [PTsecurity] Feodo/Emotet |