analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

IMG-00312190000E.IMG

Full analysis: https://app.any.run/tasks/6ea19fbe-9f78-4b44-971d-496aa158c565
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Malware Trends Tracker     >>>
Analysis date: June 19, 2019, 14:45:07
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
Indicators:
MIME: application/x-iso9660-image
File info: UDF filesystem data (version 1.5) 'DESKTOP'
MD5:

B08AB21DD846E474155140E0FA762279

SHA1:

459AD7E2A6CBB9FE07166080F5ACCA7B40841C0D

SHA256:

FE9230A31E167D3CC56A0E04A313DEE338A2062F22AFA8F1FBA889F3A43DE0FE

SSDEEP:

3072:gABgfE10QQY9WsZCK9iLLkUJBTU4RMj0kNXfnduOIR2Tsni912s91hfHd1Kn:rSfE1eY9KFLLkU7TUgMjJXfndyzniz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • IMG-0031219000E.exe (PID: 2628)
      • IMG-0031219000E.exe (PID: 2316)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2932)
      • IMG-0031219000E.exe (PID: 2628)

    • Application launched itself

      • IMG-0031219000E.exe (PID: 2628)

    • Starts CMD.EXE for self-deleting

      • IMG-0031219000E.exe (PID: 2316)

    • Starts CMD.EXE for commands execution

      • IMG-0031219000E.exe (PID: 2316)

  • INFO

    • Manual execution by user

      • IMG-0031219000E.exe (PID: 2628)
      • taskmgr.exe (PID: 2196)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.iso | ISO 9660 CD image (27.6)
.atn | Photoshop Action (27.1)
.gmc | Game Music Creator Music (6.1)

EXIF

ISO

VolumeName: DESKTOP
VolumeBlockCount: 599
VolumeBlockSize: 2048
RootDirectoryCreateDate: 2019:06:19 21:32:22+08:00
VolumeSetName: UNDEFINED
Software: IMGBURN V2.5.8.0 - THE ULTIMATE IMAGE BURNER!
VolumeCreateDate: 2019:06:19 21:32:22.00+08:00
VolumeModifyDate: 2019:06:19 21:32:22.00+08:00

Composite

VolumeSize: 1198 kB
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
7
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start rundll32.exe no specs winrar.exe img-0031219000e.exe taskmgr.exe no specs img-0031219000e.exe cmd.exe no specs ping.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3716"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\Desktop\IMG-00312190000E.IMG.isoC:\Windows\system32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2932"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\IMG-00312190000E.IMG.iso"C:\Program Files\WinRAR\WinRAR.exe
rundll32.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
2628"C:\Users\admin\Desktop\IMG-00312190000E.IMG\IMG-0031219000E.exe" C:\Users\admin\Desktop\IMG-00312190000E.IMG\IMG-0031219000E.exe
explorer.exe
User:
admin
Company:
BahraniApps
Integrity Level:
HIGH
Description:
GifCam
Exit code:
0
Version:
5.5.0.0
2196"C:\Windows\system32\taskmgr.exe" /4C:\Windows\system32\taskmgr.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Task Manager
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2316"C:/Users/admin/Desktop/IMG-00312190000E.IMG/IMG-0031219000E.exe"C:\Users\admin\Desktop\IMG-00312190000E.IMG\IMG-0031219000E.exe
IMG-0031219000E.exe
User:
admin
Company:
BahraniApps
Integrity Level:
HIGH
Description:
GifCam
Exit code:
0
Version:
5.5.0.0
2856"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\admin\Desktop\IMG-00312190000E.IMG\IMG-0031219000E.exe"C:\Windows\system32\cmd.exe—IMG-0031219000E.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1576ping 127.0.0.1 C:\Windows\system32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
593
Read events
473
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
2932WinRAR.exeC:\Users\admin\Desktop\IMG-00312190000E.IMG\IMG-0031219000E.exeexecutable
MD5:A74AC42FA5528343FB07F60066BD1470
SHA256:E5211267B4FFAB20A231BDB3488D0724E7B77603F4201A8DCD90434A0D2C30E2
2316IMG-0031219000E.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\gate[1].phptext
MD5:C6F82C6A4584B854A8A910E9B873C62F
SHA256:316C49AD87C8FE8A2E084EEABB3DB58C5CA563CF598D2A022DE613833929555E
2628IMG-0031219000E.exeC:\Users\admin\AppData\Local\Temp\svhost.exeexecutable
MD5:32827E69B293B99013BBBE37D029245D
SHA256:9250B89157770E3AB59A2C7E2DD6B12B3C61D9B7C6620C3B4727E4BFFF10F01F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2316
IMG-0031219000E.exe
GET
200
49.51.0.125:80
http://benten09.futbol/BOH9KGa4jvUsU4jL/gate.php
CN
text
8 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2316
IMG-0031219000E.exe
49.51.0.125:80
benten09.futbol
Tencent Building, Kejizhongyi Avenue
CN
malicious

DNS requests

Domain
IP
Reputation
benten09.futbol
  • 49.51.0.125
malicious
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

PID
Process
Class
Message
2316
IMG-0031219000E.exe
A Network Trojan was detected
ET TROJAN Generic gate[.].php GET with minimal headers
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
IMG-00312190000E.IMG