analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://jqueryextd.at/5c21f3dbf01e0.js

Full analysis: https://app.any.run/tasks/ccdaf632-cce4-49ca-8301-fe285394d6ec
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Malware Trends Tracker     >>>
Analysis date: May 24, 2019, 07:06:05
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
Indicators:
MD5:

7A6C08B1B57057D9831D662FE3BE2442

SHA1:

D88915FA36240B06483EF1FEB6214C62559BCE92

SHA256:

D5E842D78149DA547ED1D595F05BBF498480D5597FB5E6F46DC3288821C7796F

SSDEEP:

3:N8TyLwxAbhLu:2TyLMAdLu

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connects to CnC server

      • iexplore.exe (PID: 2676)

  • SUSPICIOUS

    • Executes scripts

      • iexplore.exe (PID: 3532)

  • INFO

    • Creates files in the user directory

      • iexplore.exe (PID: 2676)
      • iexplore.exe (PID: 3532)

    • Changes internet zones settings

      • iexplore.exe (PID: 3532)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2676)
      • iexplore.exe (PID: 3532)

    • Application launched itself

      • iexplore.exe (PID: 3532)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
34
Monitored processes
3
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe wscript.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3532"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2676"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3532 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3312"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\5c21f3dbf01e0[1].js" C:\Windows\System32\WScript.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Total events
638
Read events
586
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
1
Text files
13
Unknown types
7

Dropped files

PID
Process
Filename
Type
3532iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\favicon[1].ico —
MD5:—
SHA256:—
3532iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
3532iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFF0C1F91B8AA63602.TMP —
MD5:—
SHA256:—
2676iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.datdat
MD5:5A1FCC2DDB230BC209727B31759EF262
SHA256:751088C92DE88B00E5652089F21869AB5BC300A96621EAE5652846FDCBEF5475
2676iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\A0DBOB8D\5c21f3dbf01e0[1].jstext
MD5:D95E0C5C4E0961BCFB3A9EF7B84A6A9A
SHA256:A5CD9877579F235C92CC6FFF64C32ADDD9A753B2BA2890781492AD1CD2FE8099
2676iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\JavaDeployReg.logtext
MD5:5E209E4BE0AF94DE404D41F0F72D6C74
SHA256:52EB0376D841022D1674516BB72B47A65B144752678BE256A2FA7473ED602635
2676iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012019052420190525\index.datdat
MD5:6B1500311B8EF6E25D3402573B851CB9
SHA256:FEC496F3841468ACFE7C9BCC79D5D8591E141F1A0AE204B65C79FF6D2AF0B6CA
2676iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.datdat
MD5:B0B6FD381D54988E9663AD0E8B32CFE0
SHA256:6511A0942F2257961AC7FD0C42765F6F91BC9BE12B16A2F88AD3D6AA9EB48A49
3532iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012019052420190525\index.datdat
MD5:F338A99B0D9552FD19EA3BD47391E689
SHA256:F3488C93F7A00C9FF9FF10083DB0A89439F093D062B22097D4A7778C8A9FE380
3532iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\5c21f3dbf01e0[1].jstext
MD5:D95E0C5C4E0961BCFB3A9EF7B84A6A9A
SHA256:A5CD9877579F235C92CC6FFF64C32ADDD9A753B2BA2890781492AD1CD2FE8099
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
2
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3532
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2676
iexplore.exe
93.187.129.248:443
jqueryextd.at
—
—
malicious
3532
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
jqueryextd.at
  • 93.187.129.248
malicious

Threats

PID
Process
Class
Message
—
—
A Network Trojan was detected
ET TROJAN MirrorThief CnC in DNS Lookup
2676
iexplore.exe
A Network Trojan was detected
ET TROJAN Observed Malicious SSL Cert (MirrorThief CnC)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://jqueryextd.at/5c21f3dbf01e0.js