0761d457...5af4

VTI SCORE: 100/100

Dynamic Analysis Report

Classification: Trojan

ShrugTwo.exe

Windows Exe (x86-32)

Created at 2019-12-26T06:25:00

Remarks (1/1)

Auto Reboot Triggered (0x2000007): The operating system was rebooted during the analysis because the sample modified the master boot record (MBR).

Indicators

File (20)

Filename	Hash	Operations	Category
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi	MD5: daf31ce6baaaabf9f501ea0748e7cfca SHA1: 4f0624a0a24d7b0baae3460a54aa8bc93ae2c954 SHA256: 85b1a84219abaee39619085bd008da7969fe7f3e5ed02614b4c58202ebc73f4e SSDeep: 49152:fXUJS1kqAO3B+MD2TSUR+ouZDkyYzlsMV4qc5217qleSmLLd+:cwpAO3Bl6TjR+oBsXqv2mLLd+ ImpHash: None	Access, Create, Read, Write, Delete	Modified File
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi.SHRUG2	MD5: daf31ce6baaaabf9f501ea0748e7cfca SHA1: 4f0624a0a24d7b0baae3460a54aa8bc93ae2c954 SHA256: 85b1a84219abaee39619085bd008da7969fe7f3e5ed02614b4c58202ebc73f4e SSDeep: 49152:fXUJS1kqAO3B+MD2TSUR+ouZDkyYzlsMV4qc5217qleSmLLd+:cwpAO3Bl6TjR+oBsXqv2mLLd+ ImpHash: None	Access, Create	Dropped File
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml	MD5: 97f95a1413006993aa86d8e9c9b5d2f7 SHA1: 0d9a21041f235500d325d61f92c706d3a78e3fba SHA256: 6f48c2f51b6ff5eb0dfd86b3ec11b4a83f70ee70fbb32aa8d95ad433ed99402c SSDeep: 24:cLD3IRmPAmQE4XHGvhVjaAfTOeUucdTUQjBpAVjmxPOhqwOeHBFWyW/DM:cLD4kPAmf4XkVjAeUJbdCgxPYBfrW/DM ImpHash: None	Access, Create, Read, Write, Delete	Modified File
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml.SHRUG2	MD5: 97f95a1413006993aa86d8e9c9b5d2f7 SHA1: 0d9a21041f235500d325d61f92c706d3a78e3fba SHA256: 6f48c2f51b6ff5eb0dfd86b3ec11b4a83f70ee70fbb32aa8d95ad433ed99402c SSDeep: 24:cLD3IRmPAmQE4XHGvhVjaAfTOeUucdTUQjBpAVjmxPOhqwOeHBFWyW/DM:cLD4kPAmf4XkVjAeUJbdCgxPYBfrW/DM ImpHash: None	Access, Create	Dropped File
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml	-	Access, Create, Read
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml	MD5: 90532c7edb8c2b05f2de62cabbceb203 SHA1: e9669016ace035990a82deea73b6632487a2fb62 SHA256: 0a1b215995e2bdc60945af3e33781597d103a17b171d4872404ffaa024012f45 SSDeep: 24:cqKavICYJGi4D79Ax3wmA5t7zFWdlP6oQcRwCfbQaOS2Op91VE0vo0n//6E:coQe9Ax3wmAf8lGclfbQgHK0voo ImpHash: None	Access, Create, Read, Write, Delete	Modified File
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml.SHRUG2	MD5: 90532c7edb8c2b05f2de62cabbceb203 SHA1: e9669016ace035990a82deea73b6632487a2fb62 SHA256: 0a1b215995e2bdc60945af3e33781597d103a17b171d4872404ffaa024012f45 SSDeep: 24:cqKavICYJGi4D79Ax3wmA5t7zFWdlP6oQcRwCfbQaOS2Op91VE0vo0n//6E:coQe9Ax3wmAf8lGclfbQgHK0voo ImpHash: None	Access, Create	Dropped File
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml	MD5: 1a74e1c0bcee30df7ae6fff76907ca87 SHA1: 3bbe9249a4984e8bdeb407720880482c5012e8f4 SHA256: 748d8ddbb0fcd78000379cfa963ceb78e951feb91052529dcff5735ba755112d SSDeep: 48:cE/3UU+P/vTBsP7MSQTHMktt7m0rJxR9sW7xCm:cE/3URPxSYMkr7F9scxf ImpHash: None	Access, Create, Read, Write, Delete	Modified File
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml.SHRUG2	MD5: 1a74e1c0bcee30df7ae6fff76907ca87 SHA1: 3bbe9249a4984e8bdeb407720880482c5012e8f4 SHA256: 748d8ddbb0fcd78000379cfa963ceb78e951feb91052529dcff5735ba755112d SSDeep: 48:cE/3UU+P/vTBsP7MSQTHMktt7m0rJxR9sW7xCm:cE/3URPxSYMkr7F9scxf ImpHash: None	Access, Create	Dropped File
C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.msi	MD5: 80580f4710e354c4b400818abf56c3a5 SHA1: 5e877ac21301e2718e0b0ea5fbc869ca2a9e6c6a SHA256: 10f8322983d7007b9edfbfd71d21377f881a43682b38253891e9031d9cf0b1e5 SSDeep: 49152:tCrfsJRPh3CpXcMntD6KCKgtKt9iK3SznG73QSKSRzrAqdzdFmJD:tC7s0t288Kt9iK3SDG73QSjA0dFmJD ImpHash: None	Access, Create, Read, Write	Modified File
C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml	MD5: 06120ebd1dce88b90b7a88471fbe5fc3 SHA1: 4b5025f09286437cb2226dbe6319b09c264f65d4 SHA256: b906f722257ea40454050f1a764f2cee0892171ec8cb20f125f407e797f4f9fe SSDeep: 48:ciM1UiPYAqxZtEsHUpwx7Nj81gDef8RQV:chbPYAQtvqwDjqgDNe ImpHash: None	Access, Create, Read, Write, Delete	Modified File
C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml.SHRUG2	MD5: 06120ebd1dce88b90b7a88471fbe5fc3 SHA1: 4b5025f09286437cb2226dbe6319b09c264f65d4 SHA256: b906f722257ea40454050f1a764f2cee0892171ec8cb20f125f407e797f4f9fe SSDeep: 48:ciM1UiPYAqxZtEsHUpwx7Nj81gDef8RQV:chbPYAQtvqwDjqgDNe ImpHash: None	Access, Create	Dropped File
C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.msi	-	Access, Create, Read
C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml	MD5: 83f5316be92c6d9c6f99a709c29c2549 SHA1: b0daec1ffe1b2a6fdb38d5f338066aef0f58c834 SHA256: 1bee2a3c13d4290ab0570461c31b7f5de70616e1d9671353246f80706dc60505 SSDeep: 48:cJPVZNMcWJ6pW5I5zldrJZlQUF28D69tAx0kP0Ij7sgoOua+uw4pDTQbk+/QDjSQ:cJ9Qc68zrx/l6sx0kPbXsts+u9TB+/WR ImpHash: None	Access, Create, Write, Delete	Modified File
C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml.SHRUG2	MD5: 83f5316be92c6d9c6f99a709c29c2549 SHA1: b0daec1ffe1b2a6fdb38d5f338066aef0f58c834 SHA256: 1bee2a3c13d4290ab0570461c31b7f5de70616e1d9671353246f80706dc60505 SSDeep: 48:cJPVZNMcWJ6pW5I5zldrJZlQUF28D69tAx0kP0Ij7sgoOua+uw4pDTQbk+/QDjSQ:cJ9Qc68zrx/l6sx0kPbXsts+u9TB+/WR ImpHash: None	Access, Create	Dropped File
C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.msi	-	Access, Create, Read
C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml	-	Access
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop	-	Access
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ShrugTwo.exe.config	-	Access
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config	-	Access, Read

Registry (45)

Registry Key Name	Operations
HKEY_CURRENT_USER	Access
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Access
HKEY_CURRENT_USER\ShrugTwo	Access, Create
HKEY_CURRENT_USER\ShrugTwo\cryiv	Access, Read, Write
HKEY_CURRENT_USER\ShrugTwo\crykey	Access, Read, Write
HKEY_CURRENT_USER\ShrugTwo\identifier	Access, Read, Write
HKEY_CURRENT_USER\ShrugTwo\installdate	Access, Read, Write
HKEY_CURRENT_USER\Software\Microsoft\Command Processor	Access
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\AutoRun	Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\CompletionChar	Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DefaultColor	Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DelayedExpansion	Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DisableUNCCheck	Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\EnableExtensions	Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\PathCompletionChar	Access, Read
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System	Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework	Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\LegacyWPADSupport	Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319	Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319\HWRPortReuseOnSocketBind	Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time	Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time\Dynamic DST	Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time\Dynamic DST\2007	Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time\Dynamic DST\2008	Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time\Dynamic DST\FirstEntry	Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time\Dynamic DST\LastEntry	Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time\MUI_Display	Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time\MUI_Dlt	Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time\MUI_Std	Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time\TZI	Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Access
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	Access
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework	Access
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\DbgJITDebugLaunchSetting	Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\DbgManagedDebugger	Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\AutoRun	Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\CompletionChar	Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DefaultColor	Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DelayedExpansion	Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DisableUNCCheck	Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\EnableExtensions	Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\PathCompletionChar	Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion	Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\InstallationType	Access, Read

Domain (2)

Domain	Sources
clients3.google.com	PCAP, Function Log
clients.l.google.com	PCAP, Function Log

URL (1)

URL	Operations	Category
http://clients3.google.com/generate_204	GET	Contacted

IP (1)

IP	Protocols	Sources
216.58.206.14	DNS, HTTP, TCP	PCAP, Function Log

Export to TXT Export to JSON

Function Logfile

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".

Remarks (1/1)

Indicators

Before

After