| File name: | video_785.zip |
| Full analysis: | https://app.any.run/tasks/8583e5af-28af-4c70-9d44-bb36e44a1478 |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | November 15, 2018, 03:52:08 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v2.0 to extract |
| MD5: | CADD402BC7075CF34B00D4A85033FE25 |
| SHA1: | 660104B0E443AC6A1EDE62A9D59E673841C83A73 |
| SHA256: | F79A3EF929FB4AEBFECAD8EE8E014FA25413DE28F46214114B9BCE217EC81B32 |
| SSDEEP: | 6144:D3HpWpVUoeA2rTEMDXFkCsGQNI08EbaaZo4UjyxG7GNCr3Co04AUEeN2rDk43:AlesMDeCsLNP8EbJo4UuSGMPrl92rDf |
MALICIOUS
Application was dropped or rewritten from another process
- Video.5682770.mp4.exe (PID: 3204)
- 7za.exe (PID: 3684)
- worker.exe (PID: 2904)
MINER was detected
- worker.exe (PID: 2904)
Changes the autorun value in the registry
- Video.5682770.mp4.exe (PID: 3204)
- chrome.exe (PID: 588)
Downloads executable files from the Internet
- Video.5682770.mp4.exe (PID: 3204)
Connects to CnC server
- worker.exe (PID: 2904)
SUSPICIOUS
Executable content was dropped or overwritten
- WinRAR.exe (PID: 3176)
- 7za.exe (PID: 3684)
- Video.5682770.mp4.exe (PID: 3204)
Creates files in the user directory
- Video.5682770.mp4.exe (PID: 3204)
- 7za.exe (PID: 3684)
Reads Internet Cache Settings
- rundll32.exe (PID: 3944)
- rundll32.exe (PID: 2496)
Uses RUNDLL32.EXE to load library
- Video.5682770.mp4.exe (PID: 3204)
Connects to unusual port
- worker.exe (PID: 2904)
INFO
Drop XMRig executable file
- 7za.exe (PID: 3684)
Application launched itself
- chrome.exe (PID: 588)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .zip | | | ZIP compressed archive (100) |
|---|
EXIF
ZIP
| ZipRequiredVersion: | 20 |
|---|---|
| ZipBitFlag: | - |
| ZipCompression: | Deflated |
| ZipModifyDate: | 2017:12:19 06:22:26 |
| ZipCRC: | 0x5bc1f23d |
| ZipCompressedSize: | 483914 |
| ZipUncompressedSize: | 974336 |
| ZipFileName: | Video.5682770.mp4.exe |
Total processes
49
Monitored processes
16
Malicious processes
4
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 588 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --enable-automation --disable-infobars --load-extension=C:\Users\admin\AppData\Roaming\admin | C:\Program Files\Google\Chrome\Application\chrome.exe | Video.5682770.mp4.exe | ||||||||||||
User: admin Company: Google Inc. Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 68.0.3440.106 Modules
| |||||||||||||||
| 2456 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=880,2613070851812258193,11392223958177617259,131072 --enable-features=PasswordImport --disable-gpu-sandbox --gpu-preferences=KAAAAAAAAACAAwBAAQAAAAAAAAAAAGAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --service-request-channel-token=1D9DAA26C2F69B3E48761A93F8A583AC --mojo-platform-channel-handle=3980 /prefetch:2 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 68.0.3440.106 Modules
| |||||||||||||||
| 2484 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-automation --field-trial-handle=880,2613070851812258193,11392223958177617259,131072 --enable-features=PasswordImport --service-pipe-token=995267E5DE4BD1AA5796B27C38B1C180 --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=995267E5DE4BD1AA5796B27C38B1C180 --renderer-client-id=3 --mojo-platform-channel-handle=2532 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 68.0.3440.106 Modules
| |||||||||||||||
| 2496 | "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\WININET.dll",DispatchAPICall 1 | C:\Windows\system32\rundll32.exe | — | Video.5682770.mp4.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2660 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-automation --field-trial-handle=880,2613070851812258193,11392223958177617259,131072 --enable-features=PasswordImport --disable-gpu-compositing --service-pipe-token=6080CFA4D0319A0EFB9E0743779B7DDF --lang=en-US --instant-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=6080CFA4D0319A0EFB9E0743779B7DDF --renderer-client-id=7 --mojo-platform-channel-handle=3192 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 68.0.3440.106 Modules
| |||||||||||||||
| 2700 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=880,2613070851812258193,11392223958177617259,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAACAAwBAAQAAAAAAAAAAAGAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --service-request-channel-token=C5968B943597BB95B04425F33D230C9F --mojo-platform-channel-handle=824 --ignored=" --type=renderer " /prefetch:2 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 68.0.3440.106 Modules
| |||||||||||||||
| 2752 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-automation --field-trial-handle=880,2613070851812258193,11392223958177617259,131072 --enable-features=PasswordImport --service-pipe-token=4D984EEE0492F403D38A6365E4A2610C --lang=en-US --instant-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=4D984EEE0492F403D38A6365E4A2610C --renderer-client-id=5 --mojo-platform-channel-handle=1868 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 68.0.3440.106 Modules
| |||||||||||||||
| 2840 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=2964 --on-initialized-event-handle=296 --parent-handle=300 /prefetch:6 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 68.0.3440.106 Modules
| |||||||||||||||
| 2904 | C:\Users\admin\AppData\Roaming\admin\worker.exe | C:\Users\admin\AppData\Roaming\admin\worker.exe | Video.5682770.mp4.exe | ||||||||||||
User: admin Company: www.xmrig.com Integrity Level: MEDIUM Description: XMRig CPU miner Exit code: 0 Version: 2.8.3 Modules
| |||||||||||||||
| 3012 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-automation --field-trial-handle=880,2613070851812258193,11392223958177617259,131072 --enable-features=PasswordImport --service-pipe-token=B53616FBBAE5D5068E25E6F70350B885 --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=B53616FBBAE5D5068E25E6F70350B885 --renderer-client-id=6 --mojo-platform-channel-handle=2592 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 68.0.3440.106 Modules
| |||||||||||||||
Total events
873
Read events
766
Write events
103
Delete events
4
Modification events
| (PID) Process: | (3176) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (3176) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (3176) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (3176) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\video_785.zip | |||
| (PID) Process: | (3176) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (3176) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (3176) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (3176) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (3204) Video.5682770.mp4.exe | Key: | HKEY_CURRENT_USER\Software\Codec |
| Operation: | write | Name: | Installed |
Value: Yes | |||
| (PID) Process: | (3176) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
Executable files
5
Suspicious files
15
Text files
51
Unknown types
2
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 588 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB\LOG.old | — | |
MD5:— | SHA256:— | |||
| 588 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG.old | — | |
MD5:— | SHA256:— | |||
| 588 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB\LOG.old~RF16decc.TMP | — | |
MD5:— | SHA256:— | |||
| 3204 | Video.5682770.mp4.exe | C:\Users\admin\AppData\Roaming\admin\files.7z | compressed | |
MD5:— | SHA256:— | |||
| 3204 | Video.5682770.mp4.exe | C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk | lnk | |
MD5:— | SHA256:— | |||
| 588 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\d90ecd4a-a293-46a6-b161-0ab695962b8e.tmp | — | |
MD5:— | SHA256:— | |||
| 3684 | 7za.exe | C:\Users\admin\AppData\Roaming\admin\config.json | text | |
MD5:— | SHA256:— | |||
| 2904 | worker.exe | C:\Users\admin\AppData\Roaming\admin\config.json | text | |
MD5:— | SHA256:— | |||
| 3176 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa3176.45758\Video.5682770.mp4.exe | executable | |
MD5:— | SHA256:— | |||
| 588 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Thumbnails\LOG.old | — | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
19
DNS requests
14
Threats
11
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3204 | Video.5682770.mp4.exe | GET | 200 | 159.89.28.40:80 | http://yumuy.johet.bid/api/cherry/login.php | US | — | — | malicious |
3204 | Video.5682770.mp4.exe | GET | 200 | 159.89.28.40:80 | http://yumuy.johet.bid/api/cherry/files.7z | US | compressed | 1.38 Mb | malicious |
588 | chrome.exe | GET | 200 | 159.89.28.40:80 | http://plugin.odure.ecaha.bid/bgifgdxe | US | text | 353 b | malicious |
588 | chrome.exe | GET | 200 | 159.89.28.40:80 | http://plugin.odure.ecaha.bid/config | US | text | 657 b | malicious |
588 | chrome.exe | GET | 200 | 159.89.28.40:80 | http://plugin.odure.ecaha.bid/check | US | text | 22 b | malicious |
3204 | Video.5682770.mp4.exe | GET | 200 | 159.89.28.40:80 | http://yumuy.johet.bid/api/cherry/7za.exe | US | executable | 674 Kb | malicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
588 | chrome.exe | 216.58.206.10:443 | safebrowsing.googleapis.com | Google Inc. | US | whitelisted |
3204 | Video.5682770.mp4.exe | 159.89.28.40:80 | yumuy.johet.bid | — | US | suspicious |
588 | chrome.exe | 216.58.206.4:443 | www.google.com | Google Inc. | US | whitelisted |
588 | chrome.exe | 172.217.18.170:443 | www.googleapis.com | Google Inc. | US | whitelisted |
588 | chrome.exe | 159.89.28.40:80 | yumuy.johet.bid | — | US | suspicious |
588 | chrome.exe | 216.58.206.14:443 | apis.google.com | Google Inc. | US | whitelisted |
588 | chrome.exe | 216.58.206.13:443 | accounts.google.com | Google Inc. | US | whitelisted |
2904 | worker.exe | 37.187.163.200:3333 | pool.monero.hashvault.pro | OVH SAS | FR | suspicious |
588 | chrome.exe | 172.217.18.3:443 | www.google.de | Google Inc. | US | whitelisted |
588 | chrome.exe | 216.58.206.3:443 | clientservices.googleapis.com | Google Inc. | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
yumuy.johet.bid |
| malicious |
pool.monero.hashvault.pro |
| malicious |
clientservices.googleapis.com |
| whitelisted |
safebrowsing.googleapis.com |
| whitelisted |
www.google.de |
| whitelisted |
www.gstatic.com |
| whitelisted |
www.googleapis.com |
| whitelisted |
accounts.google.com |
| shared |
www.google.com |
| malicious |
plugin.odure.ecaha.bid |
| malicious |
Threats
PID | Process | Class | Message |
|---|---|---|---|
3204 | Video.5682770.mp4.exe | Potential Corporate Privacy Violation | ET POLICY Autoit Windows Automation tool User-Agent in HTTP Request - Possibly Hostile |
3204 | Video.5682770.mp4.exe | A Network Trojan was detected | ET INFO AutoIt User Agent Downloading EXE |
3204 | Video.5682770.mp4.exe | A Network Trojan was detected | ET CURRENT_EVENTS SUSPICIOUS Firesale gTLD EXE DL with no Referer June 13 2016 |
3204 | Video.5682770.mp4.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
2904 | worker.exe | Potential Corporate Privacy Violation | ET POLICY Cryptocurrency Miner Checkin |
2904 | worker.exe | Misc activity | SUSPICIOUS [PTsecurity] CoinMiner CryptoNight XMRig JSON_RPC Client Login |
2904 | worker.exe | Misc activity | SUSPICIOUS [PTsecurity] Riskware/CoinMiner JSON_RPC Response |
2904 | worker.exe | Misc activity | SUSPICIOUS [PTsecurity] CoinMiner CryptoNight algo JSON_RPC server Response |
2904 | worker.exe | Misc activity | SUSPICIOUS [PTsecurity] Riskware/CoinMiner JSON_RPC Response |
2904 | worker.exe | Misc activity | SUSPICIOUS [PTsecurity] CoinMiner CryptoNight algo JSON_RPC server Response |
1 ETPRO signatures available at the full report