File name:

sbb.zip

Full analysis: https://app.any.run/tasks/a7cb40f1-9da2-4893-a467-b739c2efc43f
Verdict: Malicious activity
Analysis date: April 30, 2024, 13:21:16
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

E3B8CF3E1885A9EB785688C1C4BAD529

SHA1:

43EFA66E10573FC9D711E086B6E27E2C3E11448F

SHA256:

FD8ACAD5370AB0CC1664BAB1EE2706447E994D4BEB875D5ACC538B44291B573F

SSDEEP:

768:lWa0u++yNJqYNfejLHjh2lp2NnzsVqKh4ebsHdg:lsFNJpNkfh2l46Vzh46sHu

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual execution from MS Office

      • EXCEL.EXE (PID: 4028)

    • Accesses environment variables (SCRIPT)

      • wscript.exe (PID: 124)

    • Gets %appdata% folder path (SCRIPT)

      • wscript.exe (PID: 124)

    • Gets TEMP folder path (SCRIPT)

      • wscript.exe (PID: 124)

    • Creates internet connection object (SCRIPT)

      • wscript.exe (PID: 124)

    • Opens an HTTP connection (SCRIPT)

      • wscript.exe (PID: 124)

    • Sends HTTP request (SCRIPT)

      • wscript.exe (PID: 124)

    • Unusual connection from system programs

      • wscript.exe (PID: 124)

    • Creates a new registry key or changes the value of an existing one (SCRIPT)

      • wscript.exe (PID: 124)

    • Checks whether a specified folder exists (SCRIPT)

      • wscript.exe (PID: 124)

    • Opens a text file (SCRIPT)

      • wscript.exe (PID: 124)

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 124)

    • Deletes a file (SCRIPT)

      • wscript.exe (PID: 124)

    • Actions looks like stealing of personal data

      • wscript.exe (PID: 124)

  • SUSPICIOUS

    • The process executes JS scripts

      • EXCEL.EXE (PID: 4028)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • wscript.exe (PID: 124)

    • Creates a Stream, which may work with files, input/output devices, pipes, or TCP/IP sockets (SCRIPT)

      • wscript.exe (PID: 124)

    • Writes binary data to a Stream object (SCRIPT)

      • wscript.exe (PID: 124)

    • Saves data to a binary file (SCRIPT)

      • wscript.exe (PID: 124)

    • Changes charset (SCRIPT)

      • wscript.exe (PID: 124)

    • Reads data from a file (SCRIPT)

      • wscript.exe (PID: 124)

    • Checks for external IP

      • wscript.exe (PID: 124)

    • Device Retrieving External IP Address Detected

      • wscript.exe (PID: 124)

    • Checks whether a specific file exists (SCRIPT)

      • wscript.exe (PID: 124)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 124)

    • Uses TASKKILL.EXE to kill Browsers

      • wscript.exe (PID: 124)

    • Reads the Internet Settings

      • wscript.exe (PID: 124)
      • rundll32.exe (PID: 2708)
      • rundll32.exe (PID: 304)

    • Reads settings of System Certificates

      • certutil.exe (PID: 692)

    • Reads Microsoft Outlook installation path

      • rundll32.exe (PID: 304)
      • rundll32.exe (PID: 2708)

    • Reads data from a binary Stream object (SCRIPT)

      • wscript.exe (PID: 124)

  • INFO

    • Reads Microsoft Office registry keys

      • WinRAR.exe (PID: 3980)

    • The process uses the downloaded file

      • EXCEL.EXE (PID: 4028)
      • FlashUtil32_32_0_0_453_ActiveX.exe (PID: 3584)

    • Checks proxy server information

      • wscript.exe (PID: 124)
      • rundll32.exe (PID: 2708)
      • rundll32.exe (PID: 304)

    • Manual execution by a user

      • iexplore.exe (PID: 2260)
      • rundll32.exe (PID: 304)
      • wmpnscfg.exe (PID: 2484)
      • rundll32.exe (PID: 2708)

    • Reads the bytes from the current stream and writes them to another stream(SCRIPT)

      • wscript.exe (PID: 124)

    • Reads security settings of Internet Explorer

      • rundll32.exe (PID: 2708)
      • rundll32.exe (PID: 304)

    • Application launched itself

      • iexplore.exe (PID: 2260)

    • Reads the computer name

      • wmpnscfg.exe (PID: 2484)

    • Checks supported languages

      • wmpnscfg.exe (PID: 2484)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2016:08:05 04:43:48
ZipCRC: 0x38288afb
ZipCompressedSize: 24669
ZipUncompressedSize: 28170
ZipFileName: sbb.xlsx
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
56
Monitored processes
14
Malicious processes
4
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe no specs excel.exe no specs wscript.exe taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs certutil.exe no specs iexplore.exe iexplore.exe wmpnscfg.exe no specs rundll32.exe no specs flashutil32_32_0_0_453_activex.exe no specs rundll32.exe no specs iexplore.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
124"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\SBB_CH~1.JS" C:\Windows\System32\wscript.exe
EXCEL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
304"C:\Windows\system32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,4C:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
328"C:\Windows\System32\taskkill.exe" /F /im iexplore.exeC:\Windows\System32\taskkill.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
568"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2260 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
692"C:\Windows\System32\certutil.exe" -addstore -f -user "ROOT" "C:\Users\admin\AppData\Local\Temp\cert.der"C:\Windows\System32\certutil.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
CertUtil.exe
Exit code:
0
Version:
6.1.7601.18151 (win7sp1_gdr.130512-1533)
Modules
Images
c:\windows\system32\certutil.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\certcli.dll
c:\windows\system32\atl.dll
1680"C:\Windows\System32\taskkill.exe" /F /im firefox.exeC:\Windows\System32\taskkill.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
2260"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2316"C:\Windows\System32\taskkill.exe" /F /im chrome.exeC:\Windows\System32\taskkill.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
2484"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2708"C:\Windows\system32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,4C:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
Total events
57 309
Read events
56 626
Write events
429
Delete events
254

Modification events

(PID) Process:(3980) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3980) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3980) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3980) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3980) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3980) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(3980) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\sbb.zip
(PID) Process:(3980) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3980) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3980) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
0
Suspicious files
81
Text files
243
Unknown types
5

Dropped files

PID
Process
Filename
Type
4028EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVRB344.tmp.cvr —
MD5:—
SHA256:—
124wscript.exeC:\Users\admin\AppData\Local\Temp\cert.derbinary
MD5:F71620B34287228CC2F47EAD67C8F839
SHA256:84B9EAF464DB84027C3518408E8A74EF0D922F596CD7F9EFC7BBFB3168D8E2A3
2260iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\urlblockindex[1].binbinary
MD5:FA518E3DFAE8CA3A0E495460FD60C791
SHA256:775853600060162C4B4E5F883F9FD5A278E61C471B3EE1826396B6D129499AA7
4028EXCEL.EXEC:\Users\admin\AppData\Local\Temp\SBB_CH~1.JS:Zone.Identifiertext
MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
124wscript.exeC:\Users\admin\AppData\Local\Temp\ps.ps1binary
MD5:858F0B6985956DE8FE89C4858377F1F4
SHA256:BCE95ECD0C33A1A14FF5F9C8956B01E2401F6C52CF5455EBAFD083C22B490630
568iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\NPT3CSDC.htmhtml
MD5:4F8E702CC244EC5D4DE32740C0ECBD97
SHA256:9E17CB15DD75BBBD5DBB984EDA674863C3B10AB72613CF8A39A00C3E11A8492A
124wscript.exeC:\Users\admin\AppData\Local\Temp\psf.ps1binary
MD5:7ED6126CEEF36FBE8D6AEFAC0B9AA2EF
SHA256:E05D102184297D1D25AD1676E4682A2F6A6F45A04A4BA51A6A03718564B8D2D0
124wscript.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs.jstext
MD5:A4C0253717519EB0B07D5D8DD14F5D02
SHA256:115B88AA451EA9D5CD010C60DB4B97759E55ECE806CF6C4EBA737C6290C0D044
4028EXCEL.EXEC:\Users\admin\AppData\Local\Temp\SBB_CH~1.JSbinary
MD5:8B2EF48B351BD42D39EC9B8EA81CBE1F
SHA256:E30911AA372A348A675C595584B2BCBB786FDC9482ADB52B72ACFA01D9AF47E2
2260iexplore.exeC:\Users\admin\AppData\Local\Temp\StructuredQuery.logtext
MD5:35B5122FC89CC5385DDCDD967F38B08F
SHA256:327027C0B54C7190F8CDE40D09E5EFA37DF08B4D5BC26176E222CA90572ADDEC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
286
DNS requests
51
Threats
18

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
124
wscript.exe
GET
200
104.26.13.205:80
http://api.ipify.org/
unknown
—
—
unknown
124
wscript.exe
GET
200
104.26.13.205:80
http://api.ipify.org/
unknown
—
—
unknown
124
wscript.exe
GET
200
104.26.13.205:80
http://api.ipify.org/
unknown
—
—
unknown
568
iexplore.exe
GET
301
125.212.247.176:80
http://tinhte.vn/
unknown
—
—
unknown
124
wscript.exe
GET
200
104.26.13.205:80
http://api.ipify.org/
unknown
—
—
unknown
124
wscript.exe
GET
200
104.26.13.205:80
http://api.ipify.org/
unknown
—
—
unknown
2260
iexplore.exe
GET
304
173.222.108.147:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?714da040d5683210
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
124
wscript.exe
104.26.13.205:80
api.ipify.org
CLOUDFLARENET
US
unknown
2260
iexplore.exe
49.13.77.253:443
zgu5v7fzwito746r.onion.to
Hetzner Online GmbH
DE
unknown
2260
iexplore.exe
2.19.120.21:443
www.bing.com
Akamai International B.V.
DE
unknown
568
iexplore.exe
13.107.5.80:443
api.bing.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
568
iexplore.exe
125.212.247.176:80
tinhte.vn
CHT Compamy Ltd
VN
unknown
840
svchost.exe
49.13.77.253:443
zgu5v7fzwito746r.onion.to
Hetzner Online GmbH
DE
unknown
568
iexplore.exe
125.212.247.176:443
tinhte.vn
CHT Compamy Ltd
VN
unknown

DNS requests

Domain
IP
Reputation
api.ipify.org
  • 104.26.13.205
  • 172.67.74.152
  • 104.26.12.205
shared
zgu5v7fzwito746r.onion.to
  • 49.13.77.253
unknown
www.bing.com
  • 2.19.120.21
  • 2.19.120.29
whitelisted
tinhte.vn
  • 125.212.247.176
  • 171.244.37.50
  • 171.244.37.40
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
ieonline.microsoft.com
  • 204.79.197.200
whitelisted
cdnjs.cloudflare.com
  • 104.17.24.14
  • 104.17.25.14
whitelisted
ajax.googleapis.com
  • 142.250.74.202
whitelisted

Threats

PID
Process
Class
Message
1088
svchost.exe
Misc activity
ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup
124
wscript.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup api.ipify.org
124
wscript.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External IP Lookup by HTTP (api .ipify .org)
124
wscript.exe
Device Retrieving External IP Address Detected
SUSPICIOUS [ANY.RUN] Received IP address from server as result of HTTP request
1088
svchost.exe
Potentially Bad Traffic
ET DNS Query for .to TLD
1088
svchost.exe
Potentially Bad Traffic
ET POLICY DNS Query to .onion proxy Domain (onion.to)
—
—
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup api.ipify.org
—
—
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External IP Lookup by HTTP (api .ipify .org)
—
—
Device Retrieving External IP Address Detected
SUSPICIOUS [ANY.RUN] Received IP address from server as result of HTTP request
—
—
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup api.ipify.org
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
sbb.zip