analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

FinCERT_BAPB_MLW2019052301.zip

Full analysis: https://app.any.run/tasks/dd441379-e2b1-41a3-a08b-ce8a89859372
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: May 24, 2019, 10:23:16
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ransomware
troldesh
shade
trojan
loader
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

13E9762B4035888030FF03B243004CED

SHA1:

D888BE9D764174643A93BAD8001257BE19371BE6

SHA256:

F761C7CCAB27D649C830D9C721857DD7D453A02D44834F46B6A38941A3BA7339

SSDEEP:

384:wwZma/0GtxSw2nYtO8As0O/HB1WWJM5tYrMSq://p8w2nYtPw4TWWmfY5q

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes settings of System certificates

      • WScript.exe (PID: 3636)
      • WScript.exe (PID: 3880)

    • Application was dropped or rewritten from another process

      • radF4B7F.tmp (PID: 3136)
      • rad6C440.tmp (PID: 3668)
      • rad95C67.tmp (PID: 1584)

    • Changes the autorun value in the registry

      • radF4B7F.tmp (PID: 3136)

    • TROLDESH was detected

      • radF4B7F.tmp (PID: 3136)

    • Downloads executable files from the Internet

      • WScript.exe (PID: 2300)

  • SUSPICIOUS

    • Creates files in the user directory

      • WScript.exe (PID: 3636)
      • OUTLOOK.EXE (PID: 3460)

    • Reads Internet Cache Settings

      • OUTLOOK.EXE (PID: 3460)
      • OUTLOOK.EXE (PID: 772)

    • Adds / modifies Windows certificates

      • WScript.exe (PID: 3636)
      • WScript.exe (PID: 3880)

    • Executes scripts

      • WinRAR.exe (PID: 3640)
      • WinRAR.exe (PID: 3720)

    • Executable content was dropped or overwritten

      • WScript.exe (PID: 3636)
      • WScript.exe (PID: 3880)
      • radF4B7F.tmp (PID: 3136)
      • WScript.exe (PID: 2300)

    • Starts CMD.EXE for commands execution

      • WScript.exe (PID: 3636)
      • WScript.exe (PID: 3880)
      • WScript.exe (PID: 2300)

    • Starts application with an unusual extension

      • cmd.exe (PID: 300)
      • cmd.exe (PID: 4064)
      • cmd.exe (PID: 2412)

    • Creates files in the program directory

      • radF4B7F.tmp (PID: 3136)

  • INFO

    • Manual execution by user

      • OUTLOOK.EXE (PID: 3460)
      • WinRAR.exe (PID: 3640)
      • WScript.exe (PID: 3636)
      • OUTLOOK.EXE (PID: 772)
      • WinRAR.exe (PID: 3720)

    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 3460)
      • OUTLOOK.EXE (PID: 772)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0001
ZipCompression: Deflated
ZipModifyDate: 2019:05:23 09:30:17
ZipCRC: 0x4531921c
ZipCompressedSize: 4479
ZipUncompressedSize: 7476
ZipFileName: [Content] ?⭮??⥫쭮 ??????.eml
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
59
Monitored processes
14
Malicious processes
5
Suspicious processes
3

Behavior graph

Click at the process to see the details
start winrar.exe no specs outlook.exe winrar.exe no specs wscript.exe cmd.exe no specs wscript.exe #TROLDESH radf4b7f.tmp cmd.exe no specs rad6c440.tmp outlook.exe winrar.exe no specs wscript.exe cmd.exe no specs rad95c67.tmp

Process information

PID
CMD
Path
Indicators
Parent process
1216"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\FinCERT_BAPB_MLW2019052301.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3460"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE" /eml "C:\Users\admin\Desktop\[Content] «G¡«ß¿Gѽ8¡« ºá¬áºá.eml"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Exit code:
0
Version:
14.0.6025.1000
3640"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\azur2305.rar"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
3636"C:\Windows\System32\WScript.exe" "C:\Users\admin\Desktop\Подробности заказа ООО АЗУР эйр.js" C:\Windows\System32\WScript.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
300"C:\Windows\System32\cmd.exe" /c C:\Users\admin\AppData\Local\Temp\radF4B7F.tmpC:\Windows\System32\cmd.exe—WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3880"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIb3640.45983\Подробности заказа ООО АЗУР эйр.js" C:\Windows\System32\WScript.exe
WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
3136C:\Users\admin\AppData\Local\Temp\radF4B7F.tmpC:\Users\admin\AppData\Local\Temp\radF4B7F.tmp
cmd.exe
User:
admin
Company:
Glarysoft Ltd
Integrity Level:
MEDIUM
Description:
Registry Defrag
Version:
5.0.0.14
4064"C:\Windows\System32\cmd.exe" /c C:\Users\admin\AppData\Local\Temp\rad6C440.tmpC:\Windows\System32\cmd.exe—WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3668C:\Users\admin\AppData\Local\Temp\rad6C440.tmpC:\Users\admin\AppData\Local\Temp\rad6C440.tmp
cmd.exe
User:
admin
Company:
Glarysoft Ltd
Integrity Level:
MEDIUM
Description:
Registry Defrag
Exit code:
0
Version:
5.0.0.14
772"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE" /eml "C:\Users\admin\Desktop\[SPAM_FortiGuard] «G¡«ß¿Gѽ8¡« ºá¬áºá(1).eml"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Version:
14.0.6025.1000
Total events
4 314
Read events
3 415
Write events
0
Delete events
0

Modification events

No data
Executable files
7
Suspicious files
4
Text files
44
Unknown types
4

Dropped files

PID
Process
Filename
Type
1216WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1216.42755\[Content] «G¡«ß¿Gѽ8¡« ºá¬áºá.eml —
MD5:—
SHA256:—
3460OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVR8A32.tmp.cvr —
MD5:—
SHA256:—
3460OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\GBZTWZ3X\azur2305 (2).rar\:Zone.Identifier:$DATA —
MD5:—
SHA256:—
3640WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3640.45541\Подробности заказа ООО АЗУР эйр.js —
MD5:—
SHA256:—
3460OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:B967F24FC693C2F7C1FF667AF470647D
SHA256:258078FD0DA5F99D12BAFDE3707E4CAB0D3D42E9F813F860CC2F1B838B405587
3460OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\GBZTWZ3X\azur2305.rarcompressed
MD5:67161766B5A9EB927E585EF95FEF64CC
SHA256:3DB2AB10F88490C0FDCF3E6CFD8C60B0FDDE82BF08511C3D4D5BD00464548B25
3640WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIb3640.45983\Подробности заказа ООО АЗУР эйр.jstext
MD5:D6434A90EF0C37B3D504FE73260B36D5
SHA256:2F04A22F2FBFB94BD1DA2EA3B00153E2AECA95D71894D1F1A8A53D06D86B7A1E
3136radF4B7F.tmpC:\Users\admin\AppData\Local\Temp\6893A5D897\state.tmp —
MD5:—
SHA256:—
3460OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\~DFB19DD1E5A5907A06.TMP —
MD5:—
SHA256:—
3636WScript.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\1c[1].jpgexecutable
MD5:C722F0A20113BB1488382DAEFDA9A358
SHA256:3D4D462DBC7DBFD12AF693F8176E9FD6814560ED763448FA75FA6DAD026567F4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
7
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
772
OUTLOOK.EXE
GET
—
64.4.26.155:80
http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig
US
—
—
whitelisted
3460
OUTLOOK.EXE
GET
—
64.4.26.155:80
http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig
US
—
—
whitelisted
2300
WScript.exe
GET
200
79.98.28.30:80
http://dideleszuvys.lt/administrator/backups/1c.jpg
LT
executable
1.19 Mb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3136
radF4B7F.tmp
154.35.32.5:443
—
Rethem Hosting LLC
US
suspicious
3136
radF4B7F.tmp
208.83.223.34:80
—
Applied Operations, LLC
US
malicious
3636
WScript.exe
85.93.145.251:443
lotteryold.flemart.ru
JSC Internet-Cosmos
RU
unknown
772
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
Microsoft Corporation
US
whitelisted
3460
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
Microsoft Corporation
US
whitelisted
3880
WScript.exe
85.93.145.251:443
lotteryold.flemart.ru
JSC Internet-Cosmos
RU
unknown
2300
WScript.exe
79.98.28.30:80
dideleszuvys.lt
UAB Rakrejus
LT
suspicious

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
lotteryold.flemart.ru
  • 85.93.145.251
unknown
dideleszuvys.lt
  • 79.98.28.30
malicious

Threats

PID
Process
Class
Message
2300
WScript.exe
Misc activity
ET INFO Packed Executable Download
2300
WScript.exe
A Network Trojan was detected
ET CURRENT_EVENTS Likely Evil EXE download from MSXMLHTTP non-exe extension M2
2300
WScript.exe
A Network Trojan was detected
ET TROJAN JS/WSF Downloader Dec 08 2016 M4
2300
WScript.exe
Misc activity
SUSPICIOUS [PTsecurity] PE as Image Content type mismatch
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
FinCERT_BAPB_MLW2019052301.zip