a7aae835...4d15 | IOCs
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification: Trojan, Dropper, Downloader, Spyware, Backdoor, Exploit

a7aae83573aa9a682ce9733468882e841564f41ec4aa004cb795b98fd4834d15 (SHA256)

SS BRAID PO.doc.rtf

RTF Document

Created at 2018-09-05 20:13:00

...

Notifications (2/2)

The maximum number of reputation URL requests (25 per analysis) was exceeded. As a result, the reputation status could not be queried for all contacted URLs. In order to get the reputation status for all contacted URLs, please increase the 'Max URL Requests' setting in the system configurations.

The overall sleep time of all monitored processes was truncated from "16 minutes, 44 seconds" to "2 minutes, 10 seconds" to reveal dormant functionality.

Indicators

File (64)
»
Filename Hash Operations Source
C:\Program Files (x86)\Mozilla Firefox\mozsqlite3.dll - Access
C:\Program Files (x86)\Mozilla Firefox\nss3.dll - Access
C:\Program Files (x86)\Mozilla Firefox\sqlite3.dll - Access
C:\Program Files (x86)\Mozilla Thunderbird - Access
C:\Program Files (x86)\Sea Monkey\nss3.dll - Access
C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\CertificateTransparency\Login Data - Access
C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\CertificateTransparency\Web Data - Access
C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\Crashpad\Login Data - Access
C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\Crashpad\Web Data - Access
C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\Default\Login Data - Access
C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\Default\Web Data - Access
C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\EVWhitelist\Login Data - Access
C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\EVWhitelist\Web Data - Access
C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\FileTypePolicies\Login Data - Access
C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\FileTypePolicies\Web Data - Access
C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\OriginTrials\Login Data - Access
C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\OriginTrials\Web Data - Access
C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\PepperFlash\Login Data - Access
C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\PepperFlash\Web Data - Access
C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\pnacl\Login Data - Access
C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\pnacl\Web Data - Access
C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant\Login Data - Access
C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant\Web Data - Access
C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\SwReporter\Login Data - Access
C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\SwReporter\Web Data - Access
C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\WidevineCdm\Login Data - Access
C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\WidevineCdm\Web Data - Access
C:\Users\aETAdzjz\AppData\Local\Microsoft\Windows Mail\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount - Access, Read
C:\Users\aETAdzjz\AppData\Local\Microsoft\Windows Mail\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount - Access, Read
C:\Users\aETAdzjz\AppData\Local\Microsoft\Windows Mail\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount - Access, Read
C:\Users\aETAdzjz\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - Access, Read
C:\Users\aETAdzjz\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012018090520180906\index.dat - Access, Read
C:\Users\aETAdzjz\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat - Access, Read
C:\Users\aETAdzjz\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012017070320170710\index.dat - Access, Read
C:\Users\aETAdzjz\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012017071220170713\index.dat - Access, Read
C:\Users\aETAdzjz\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat - Access
C:\Users\aETAdzjz\AppData\Local\Microsoft\Windows\WebCache\WebCacheV24.dat - Access
C:\Users\aETAdzjz\AppData\Local\Temp\ - Access
C:\Users\aETAdzjz\AppData\Local\Temp\holdermail.txt - Access
C:\Users\aETAdzjz\AppData\Local\Temp\holderwb.txt - Access
C:\Users\aETAdzjz\AppData\Local\Temp\wallet.dat - Access
C:\Users\aETAdzjz\AppData\Roaming\.minecraft\lastlogin - Access
C:\Users\aETAdzjz\AppData\Roaming\Apple Computer\Preferences\keychain.plist - Access
C:\Users\aETAdzjz\AppData\Roaming\bitcoin\wallet.dat - Access
C:\Users\aETAdzjz\AppData\Roaming\jagex_cache\regPin\YKYD69Q_Pin0.jpeg - Access
C:\Users\aETAdzjz\AppData\Roaming\jsjhdhdhdhjfjhhf.exe MD5: e2c7b5d78675bbccc85af58db4711648
SHA1: f9865f7d0fa19d942aa9be0a57580af0c7ad07f1
SHA256: 411ad7a95a34da04211b3887c3c2ab4b08359363fb1c4baf22fb323af6d9e408
SSDeep: 12288:7KrQPt9tEZjhY8LbbEjLQvJ2o/X8FMidEdwccqA5LboI5dg7taDncJGM:2EtkbwjaMo/sFDdewV5t5duADcJGM
ImpHash: f34d5f2d4577ed6d9ceec516c1f5a744 		Access Created File
C:\Users\aETAdzjz\AppData\Roaming\jsjhdhdhdhjfjhhf.exe.config - Access
C:\Users\aETAdzjz\AppData\Roaming\jsjhdhdhdhjfjhhf.exe:Zone.Identifier - Access
C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup - Access
C:\Users\aETAdzjz\AppData\Roaming\Mozilla\Firefox\profiles.ini - Access
C:\Users\aETAdzjz\AppData\Roaming\Mozilla\Firefox\Profiles\3y2joh8o.default\history.dat - Access
C:\Users\aETAdzjz\AppData\Roaming\Mozilla\Firefox\Profiles\3y2joh8o.default\places.sqlite - Access
C:\Users\aETAdzjz\AppData\Roaming\Mozilla\Firefox\Profiles\3y2joh8o.default\signons.sqlite - Access
C:\Users\aETAdzjz\AppData\Roaming\Mozilla\Profiles - Access
C:\Users\aETAdzjz\AppData\Roaming\Mozilla\SeaMonkey\profiles.ini - Access
C:\Users\aETAdzjz\AppData\Roaming\Opera\Opera7\profile\wand.dat - Access
C:\Users\aETAdzjz\AppData\Roaming\Opera\Opera\wand.dat - Access
C:\Users\aETAdzjz\AppData\Roaming\pid.txt MD5: 320722549d1751cf3f247855f937b982
SHA1: 7fdec83a2662ffe53af456402cbaeafa380b15b4
SHA256: 88820462180e5c893eff2ed73f4ec33e205d1cd5acc4d17fa7b2bca2495d3448
SSDeep: 3:QV:QV
ImpHash: None 		Access, Write Created File
C:\Users\aETAdzjz\AppData\Roaming\pidloc.txt MD5: 87819f6ce8eada938d45a0a19258bb58
SHA1: 28cab071479d4d2ebeda3662a66b58f220ecf7f6
SHA256: 3d1d10f3d9b4de9aefc08608f20c0c0c789bf430b73cb2fa0d20b8b575075aa7
SSDeep: 3:oNJxzp4EaKC5uhDPfQC:oN/zpJaZ5uiC
ImpHash: None 		Access, Write Created File
C:\Users\aETAdzjz\AppData\Roaming\Thunderbird\Profiles - Access
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc_lng.ini - Access
C:\Windows\Microsoft.NET\Framework\v4.0.30319\config\machine.config - Access, Read
C:\Windows\system32\26 - Access
C:\Windows\system32\28 - Access
Registry (49)
»
Registry Key Name Operations
HKEY_CURRENT_USER Access, Read, Write
HKEY_CURRENT_USER\Identities Access
HKEY_CURRENT_USER\Identities\{31810C36-5D23-4CCE-A3B4-316DED195C38} Access
HKEY_CURRENT_USER\Identities\{31810C36-5D23-4CCE-A3B4-316DED195C38}\Software\Microsoft\Internet Account Manager\Accounts Access
HKEY_CURRENT_USER\Identities\{31810C36-5D23-4CCE-A3B4-316DED195C38}\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts Access
HKEY_CURRENT_USER\Identities\{31810C36-5D23-4CCE-A3B4-316DED195C38}\Username Read
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Access
HKEY_CURRENT_USER\Software\Google\Google Desktop\Mailboxes Access
HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts Access
HKEY_CURRENT_USER\Software\IncrediMail\Identities Access
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL Access
HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager\Accounts Access
HKEY_CURRENT_USER\Software\Microsoft\MSNMessenger Access
HKEY_CURRENT_USER\Software\Microsoft\MessengerService Access
HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles Access
HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts Access
HKEY_CURRENT_USER\Software\Microsoft\Windows Live Mail Access
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles Access
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Access
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden Read, Write
HKEY_CURRENT_USER\Software\Qualcomm\Eudora\CommandLine Access
HKEY_CURRENT_USER\Software\Yahoo\Pager Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\AppContext Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\LegacyWPADSupport Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319 Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319\HWRPortReuseOnSocketBind Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319\SchUseStrongCrypto Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Greenwich Standard Time Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Greenwich Standard Time\Dynamic DST Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Greenwich Standard Time\MUI_Display Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Greenwich Standard Time\MUI_Dlt Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Greenwich Standard Time\MUI_Std Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Greenwich Standard Time\TZI Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Access
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Access
HKEY_LOCAL_MACHINE\Software\Classes\Software\Qualcomm\Eudora\CommandLine\current Access
HKEY_LOCAL_MACHINE\Software\Group Mail Access
HKEY_LOCAL_MACHINE\Software\IncrediMail\Identities Access
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework Access
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\DbgJITDebugLaunchSetting Read
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\DbgManagedDebugger Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\InstallationType Read
HKEY_LOCAL_MACHINE\Software\Mozilla\Mozilla Thunderbird Access
HKEY_PERFORMANCE_DATA Access
Mozilla Firefox 25.0\bin Access
Mozilla Firefox 25.0\bin\PathToExe Read
Mozilla Firefox\bin Access
Domain (19)
»
Domain Sources
rollboat.tk PCAP, Function Log
ykyd69q Function Log
whatismyipaddress.com Function Log, PCAP
smtp.gmail.com Function Log
ocsp2.globalsign.com PCAP
global.prd.cdn.globalsign.com PCAP
prod.globalsign.map.fastly.net PCAP
crl.globalsign.com PCAP
ocos-office365-s2s.msedge.net PCAP
ocos-office365-s2s-msedge-net.e-0009.e-msedge.net PCAP
e-0009.e-msedge.net PCAP
client-office365-tas.msedge.net PCAP
afdo-tas-offload.trafficmanager.net PCAP
vip5.afdorigin-prod-mwh02.afdogw.com PCAP
config.edge.skype.com PCAP
s-0001.s-msedge.net PCAP
crl.verisign.com PCAP
crl-symcprod.digicert.com PCAP
cs9.wac.phicdn.net PCAP
URL (5)
»
URL Operations Sources
http://rollboat.tk/new/kc.exe GET Function Log
http://whatismyipaddress.com/ GET Function Log
http://ocsp2.globalsign.com/gscodesignsha2g2/MFMwUTBPME0wSzAJBgUrDgMCGgUABBQpEOCqbmTiQA9OjY%2F%2Ft2aa8NSkuwQUGUq4WuRNMaUU5V7sL6Mc%2BoCMMmsCEhEhr0NghltULzlkczOf0L9mqQ%3D%3D GET PCAP
http://crl.globalsign.com/gs/gscodesignsha2g2.crl GET PCAP
http://crl.verisign.com/tss-ca.crl GET PCAP
IP (13)
»
IP Protocols Sources
89.40.14.229 HTTP, TCP, UDP PCAP, Function Log
104.16.17.96 HTTP, TCP, UDP Function Log, PCAP
104.16.20.96 HTTP, TCP, UDP Function Log, PCAP
104.16.18.96 HTTP, TCP, UDP Function Log, PCAP
104.16.19.96 HTTP, TCP, UDP Function Log, PCAP
104.16.16.96 HTTP, TCP, UDP Function Log, PCAP
64.233.166.108 TCP Function Log
64.233.166.109 TCP Function Log
151.101.114.133 HTTP, TCP, UDP PCAP
13.107.5.88 TCP, UDP PCAP
51.141.166.104 TCP, UDP PCAP
13.107.3.128 TCP, UDP PCAP
93.184.220.29 HTTP, TCP, UDP PCAP
Export IOCs
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image