analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://www.winzipdriverupdater.com/du/wddc2/index.php?lang=nl&gclid=CjwKCAjwvbLkBRBbEiwAChbckevUS1lluvKU4Vnw0mEVIJ4bLZ8xizqDqSbs_iy3J7m7DgubGGtzbxoCnlkQAvD_BwE

Full analysis: https://app.any.run/tasks/95c72b7b-4789-436e-bb70-73fa3b3109df
Verdict: Malicious activity
Analysis date: March 16, 2019, 17:04:52
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

07D6AAF699CA578A2D25A575D6445C2A

SHA1:

FB3F21FF04E664EF8C42413D44DB709E77ED0F10

SHA256:

5CE69CE807A777E6A0CD6EB8FEECF6A98C1DD6034E06069B390641AAD3E8ADC2

SSDEEP:

3:N8DSLAaT8msKyBGXb6hHCOfbmVDqnovUJJGuFdKUfUT2ScRiRHCe:2OLTAFPBGrQHCMijvUJJh/fUT2SEi9Ce

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • wzdu53[1].exe (PID: 2600)
      • ga_utility.exe (PID: 3092)
      • wzdu53[1].exe (PID: 3520)
      • 501a62ea-f5e4-49c3-a52f-a7671439af8b.exe (PID: 3684)
      • WinZipSmartMonitorSetup.exe (PID: 3876)
      • DriverUpdater.exe (PID: 3756)
      • WinZip Smart Monitor Service.exe (PID: 2940)
      • DriverUpdater.exe (PID: 2584)
      • DriverUpdater.exe (PID: 2972)
      • WinZip Smart Monitor Service.exe (PID: 2924)
      • ga_utility.exe (PID: 992)
      • DriverUpdater.exe (PID: 3252)
      • DriverUpdater.exe (PID: 2176)
      • WinZipSmartMonitor.exe (PID: 1488)

    • Changes settings of System certificates

      • ga_utility.exe (PID: 3092)
      • DriverUpdater.exe (PID: 2972)

    • Loads dropped or rewritten executable

      • 501a62ea-f5e4-49c3-a52f-a7671439af8b.exe (PID: 3684)
      • WinZipSmartMonitorSetup.exe (PID: 3876)
      • WinZip Smart Monitor Service.exe (PID: 2940)
      • WinZip Smart Monitor Service.exe (PID: 2924)
      • WinZipSmartMonitor.exe (PID: 1488)

    • Loads the Task Scheduler DLL interface

      • DriverUpdater.exe (PID: 3756)
      • DriverUpdater.exe (PID: 2972)

    • Loads the Task Scheduler COM API

      • DriverUpdater.exe (PID: 3756)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • wzdu53[1].exe (PID: 2600)
      • iexplore.exe (PID: 2828)
      • 501a62ea-f5e4-49c3-a52f-a7671439af8b.exe (PID: 3684)
      • iexplore.exe (PID: 3136)
      • DriverUpdater.exe (PID: 3756)
      • WinZipSmartMonitorSetup.exe (PID: 3876)

    • Adds / modifies Windows certificates

      • ga_utility.exe (PID: 3092)
      • DriverUpdater.exe (PID: 2972)

    • Creates files in the program directory

      • 501a62ea-f5e4-49c3-a52f-a7671439af8b.exe (PID: 3684)
      • WinZipSmartMonitorSetup.exe (PID: 3876)
      • DriverUpdater.exe (PID: 3756)
      • WinZip Smart Monitor Service.exe (PID: 2924)
      • DriverUpdater.exe (PID: 2584)
      • DriverUpdater.exe (PID: 2972)
      • WinZipSmartMonitor.exe (PID: 1488)

    • Removes files from Windows directory

      • WinZip Smart Monitor Service.exe (PID: 2924)

    • Creates files in the Windows directory

      • WinZip Smart Monitor Service.exe (PID: 2924)
      • DriverUpdater.exe (PID: 3756)
      • DriverUpdater.exe (PID: 2972)

    • Starts SC.EXE for service management

      • WinZipSmartMonitorSetup.exe (PID: 3876)

    • Creates a software uninstall entry

      • 501a62ea-f5e4-49c3-a52f-a7671439af8b.exe (PID: 3684)
      • DriverUpdater.exe (PID: 3252)

    • Reads Internet Cache Settings

      • DriverUpdater.exe (PID: 2972)

    • Reads internet explorer settings

      • DriverUpdater.exe (PID: 2972)

    • Creates files in the user directory

      • DriverUpdater.exe (PID: 2972)

  • INFO

    • Changes internet zones settings

      • iexplore.exe (PID: 2828)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2828)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2828)
      • iexplore.exe (PID: 3136)
      • iexplore.exe (PID: 2608)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3136)
      • iexplore.exe (PID: 2608)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2828)

    • Creates files in the user directory

      • iexplore.exe (PID: 3136)
      • FlashUtil32_26_0_0_131_ActiveX.exe (PID: 3312)
      • iexplore.exe (PID: 2828)
      • iexplore.exe (PID: 2608)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2828)

    • Application launched itself

      • iexplore.exe (PID: 2828)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
55
Monitored processes
19
Malicious processes
8
Suspicious processes
3

Behavior graph

Click at the process to see the details
drop and start drop and start start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start iexplore.exe iexplore.exe flashutil32_26_0_0_131_activex.exe no specs wzdu53[1].exe no specs wzdu53[1].exe 501a62ea-f5e4-49c3-a52f-a7671439af8b.exe ga_utility.exe winzipsmartmonitorsetup.exe winzip smart monitor service.exe no specs sc.exe no specs winzip smart monitor service.exe driverupdater.exe driverupdater.exe no specs ga_utility.exe driverupdater.exe driverupdater.exe no specs driverupdater.exe no specs iexplore.exe winzipsmartmonitor.exe

Process information

PID
CMD
Path
Indicators
Parent process
2828"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3136"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2828 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3312C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe -EmbeddingC:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe—svchost.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe® Flash® Player Installer/Uninstaller 26.0 r0
Version:
26,0,0,131
3520"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D2YPIJ90\wzdu53[1].exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D2YPIJ90\wzdu53[1].exe—iexplore.exe
User:
admin
Company:
Corel Corporation
Integrity Level:
MEDIUM
Description:
WinZip Driver Updater
Exit code:
3221226540
Version:
5.27.0.26
2600"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D2YPIJ90\wzdu53[1].exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D2YPIJ90\wzdu53[1].exe
iexplore.exe
User:
admin
Company:
Corel Corporation
Integrity Level:
HIGH
Description:
WinZip Driver Updater
Exit code:
0
Version:
5.27.0.26
3684\501a62ea-f5e4-49c3-a52f-a7671439af8b.exe /BUILD_ID="53" C:\501a62ea-f5e4-49c3-a52f-a7671439af8b.exe
wzdu53[1].exe
User:
admin
Company:
Corel Corporation
Integrity Level:
HIGH
Description:
WinZip Driver Updater installer
Exit code:
0
Version:
5.27.0.26
3092"C:\Users\admin\AppData\Local\Temp\nszFAE3.tmp\ga_utility.exe" -install_start -guid "02E387C4-605B-4448-8267-51CCB10A8633" -language "en" -app_version "5.27.0.26" -product_code "DU" -app_name "WinZip Driver Updater" -track_id "UA-66457935-11"C:\Users\admin\AppData\Local\Temp\nszFAE3.tmp\ga_utility.exe
501a62ea-f5e4-49c3-a52f-a7671439af8b.exe
User:
admin
Integrity Level:
HIGH
Description:
ga_utility
Exit code:
0
Version:
1,0,0,4
3876C:\Users\admin\AppData\Local\Temp\nszFAE3.tmp\WinZipSmartMonitorSetup.exeC:\Users\admin\AppData\Local\Temp\nszFAE3.tmp\WinZipSmartMonitorSetup.exe
501a62ea-f5e4-49c3-a52f-a7671439af8b.exe
User:
admin
Company:
Corel Corporation
Integrity Level:
HIGH
Description:
WinZip Smart Monitor installer
Exit code:
0
Version:
2.8.1.4
2940"C:\Program Files\WinZip Smart Monitor\WinZip Smart Monitor Service.exe" /ServiceC:\Program Files\WinZip Smart Monitor\WinZip Smart Monitor Service.exe—WinZipSmartMonitorSetup.exe
User:
admin
Company:
Corel Corporation
Integrity Level:
HIGH
Description:
WinZip Smart Monitor Service
Exit code:
0
Version:
2,8,1,4
2384sc start "WinZip Smart Monitor Service"C:\Windows\system32\sc.exe—WinZipSmartMonitorSetup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
1 966
Read events
1 610
Write events
0
Delete events
0

Modification events

No data
Executable files
25
Suspicious files
55
Text files
498
Unknown types
16

Dropped files

PID
Process
Filename
Type
2828iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\favicon[1].ico —
MD5:—
SHA256:—
2828iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
3136iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab99C5.tmp —
MD5:—
SHA256:—
3136iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar99C6.tmp —
MD5:—
SHA256:—
3136iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab99F6.tmp —
MD5:—
SHA256:—
3136iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar99F7.tmp —
MD5:—
SHA256:—
3136iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab9AF2.tmp —
MD5:—
SHA256:—
3136iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar9AF3.tmp —
MD5:—
SHA256:—
3136iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt —
MD5:—
SHA256:—
3136iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\index[1].php —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
84
DNS requests
43
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2924
WinZip Smart Monitor Service.exe
GET
200
52.85.182.166:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwZ%2FlFeFh%2Bisd96yUzJbvJmLVg0%3D
US
der
1.39 Kb
shared
2924
WinZip Smart Monitor Service.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D
US
der
471 b
whitelisted
2924
WinZip Smart Monitor Service.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAEU4rgWp2Ty1wBkYdRCEyE%3D
US
der
471 b
whitelisted
3136
iexplore.exe
GET
200
93.184.221.240:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
US
compressed
55.2 Kb
whitelisted
2924
WinZip Smart Monitor Service.exe
GET
200
52.85.182.178:80
http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
US
der
1.70 Kb
whitelisted
3136
iexplore.exe
GET
200
52.85.182.59:80
http://x.ss2.us/x.cer
US
der
1.27 Kb
whitelisted
2924
WinZip Smart Monitor Service.exe
GET
200
52.85.182.224:80
http://ocsp.rootg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D
US
der
1.51 Kb
whitelisted
2828
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
2924
WinZip Smart Monitor Service.exe
GET
200
52.85.182.226:80
http://crl.sca1b.amazontrust.com/sca1b.crl
US
binary
330 Kb
whitelisted
2924
WinZip Smart Monitor Service.exe
GET
200
52.85.182.87:80
http://ocsp.sca1b.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQz9arGHWbnBV0DFzpNHz4YcTiFDQQUWaRmBlKge5WSPKOUByeWdFv5PdACEAMg66w999vpRFtjaNSGZuE%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3136
iexplore.exe
93.184.221.240:80
www.download.windowsupdate.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2828
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3136
iexplore.exe
172.217.22.10:443
fonts.googleapis.com
Google Inc.
US
whitelisted
3136
iexplore.exe
52.85.182.59:80
x.ss2.us
Amazon.com, Inc.
US
whitelisted
3136
iexplore.exe
18.204.107.211:443
www.winzipdriverupdater.com
—
US
unknown
3136
iexplore.exe
172.217.16.131:443
fonts.gstatic.com
Google Inc.
US
whitelisted
3136
iexplore.exe
159.122.87.148:443
dev.visualwebsiteoptimizer.com
SoftLayer Technologies Inc.
DE
unknown
3136
iexplore.exe
157.240.20.19:443
connect.facebook.net
Facebook, Inc.
US
whitelisted
3136
iexplore.exe
172.217.22.34:443
www.googleadservices.com
Google Inc.
US
whitelisted
3136
iexplore.exe
52.239.137.4:443
optanon.blob.core.windows.net
Microsoft Corporation
IE
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
www.winzipdriverupdater.com
  • 18.204.107.211
  • 34.230.169.247
whitelisted
x.ss2.us
  • 52.85.182.59
  • 52.85.182.148
  • 52.85.182.40
  • 52.85.182.127
whitelisted
www.download.windowsupdate.com
  • 93.184.221.240
whitelisted
fonts.googleapis.com
  • 172.217.22.10
whitelisted
fonts.gstatic.com
  • 172.217.16.131
whitelisted
dev.visualwebsiteoptimizer.com
  • 159.122.87.148
  • 159.122.87.153
whitelisted
www.googletagmanager.com
  • 172.217.18.104
whitelisted
www.google-analytics.com
  • 216.58.208.46
whitelisted
www.googleadservices.com
  • 172.217.22.34
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.winzipdriverupdater.com/du/wddc2/index.php?lang=nl&gclid=CjwKCAjwvbLkBRBbEiwAChbckevUS1lluvKU4Vnw0mEVIJ4bLZ8xizqDqSbs_iy3J7m7DgubGGtzbxoCnlkQAvD_BwE