File name:

Fall Guys.zip

Full analysis: https://app.any.run/tasks/5227a475-9a96-4366-8ce9-a3aa9d665850
Verdict: Malicious activity
Analysis date: August 20, 2020, 13:09:00
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

5C8D0E096213AF166D5906D950EC0988

SHA1:

FFEC5DBA174B0BEA5BEFDBF54253EF5342D5C2C9

SHA256:

067CB7483A7213D005B46867BEDD67BD0078A18735DFBAA1DFB0D6D4DD8C10FE

SSDEEP:

196608:Bxeyk44XR+uUBCbmWcbvGaek5vsEkqtBG+yxz3+r/M70D5PYSCI4sQjk3:Kyk9+P0kFF5eDlrM07+FCI4sQQ3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Fall Guys.exe (PID: 1004)
      • Fall Guys.exe (PID: 608)

  • SUSPICIOUS

    • Starts Internet Explorer

      • Fall Guys.exe (PID: 608)

  • INFO

    • Manual execution by user

      • Fall Guys.exe (PID: 1004)
      • Fall Guys.exe (PID: 608)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 1448)
      • iexplore.exe (PID: 4064)

    • Creates files in the user directory

      • iexplore.exe (PID: 1448)
      • iexplore.exe (PID: 4064)
      • iexplore.exe (PID: 964)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 4064)
      • iexplore.exe (PID: 1448)
      • iexplore.exe (PID: 2852)
      • iexplore.exe (PID: 964)

    • Application launched itself

      • iexplore.exe (PID: 4064)
      • iexplore.exe (PID: 2852)

    • Changes settings of System certificates

      • iexplore.exe (PID: 4064)

    • Changes internet zones settings

      • iexplore.exe (PID: 4064)
      • iexplore.exe (PID: 2852)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 4064)

    • Reads internet explorer settings

      • iexplore.exe (PID: 1448)
      • iexplore.exe (PID: 964)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2020:08:13 18:30:28
ZipCRC: 0xfe12b8d3
ZipCompressedSize: 11583016
ZipUncompressedSize: 11839488
ZipFileName: Fall Guys.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
7
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs fall guys.exe no specs fall guys.exe no specs iexplore.exe iexplore.exe iexplore.exe no specs iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
608"C:\Users\admin\Desktop\Fall Guys.exe" C:\Users\admin\Desktop\Fall Guys.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Fall Guys
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\fall guys.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
964"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2852 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
1004"C:\Users\admin\Desktop\Fall Guys.exe" C:\Users\admin\Desktop\Fall Guys.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Fall Guys
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\fall guys.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1448"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:4064 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2852"C:\Program Files\Internet Explorer\iexplore.exe" https://verifyzone.org/c0ea8e6C:\Program Files\Internet Explorer\iexplore.exe—Fall Guys.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3124"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Fall Guys.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
4064"C:\Program Files\Internet Explorer\iexplore.exe" https://verifyzone.org/c0ea8e6C:\Program Files\Internet Explorer\iexplore.exe
Fall Guys.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
1 536
Read events
1 384
Write events
146
Delete events
6

Modification events

(PID) Process:(3124) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3124) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3124) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\137\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3124) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\137\52C64B7E
Operation:writeName:@C:\Windows\system32\NetworkExplorer.dll,-1
Value:
Network
(PID) Process:(3124) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Fall Guys.zip
(PID) Process:(3124) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3124) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3124) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3124) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(608) Fall Guys.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
Operation:writeName:{17FE9752-0B5A-4665-84CD-569794602F5C} {7F9185B0-CB92-43C5-80A9-92277A4F7B54} 0xFFFF
Value:
0100000000000000D6938785F376D601
Executable files
0
Suspicious files
29
Text files
9
Unknown types
10

Dropped files

PID
Process
Filename
Type
3124WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3124.31208\Fall Guys.exe —
MD5:—
SHA256:—
1448iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\CabC7E0.tmp —
MD5:—
SHA256:—
1448iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\TarC7E1.tmp —
MD5:—
SHA256:—
1448iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\6EW2FERA.txt —
MD5:—
SHA256:—
4064iexplore.exeC:\Users\admin\AppData\Local\Temp\CabD07B.tmp —
MD5:—
SHA256:—
4064iexplore.exeC:\Users\admin\AppData\Local\Temp\TarD07C.tmp —
MD5:—
SHA256:—
4064iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
4064iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver3A72.tmp —
MD5:—
SHA256:—
4064iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFA135BF69C92077E4.TMP —
MD5:—
SHA256:—
1448iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27der
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
15
DNS requests
13
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4064
iexplore.exe
GET
200
104.18.25.243:80
http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIGkp0%2Fv9GUvNUu1EP06Tu7%2BChyAQUkZ47RGw9V5xCdyo010%2FRzEqXLNoCExwAFF8jA2u85i8%2FLFYAAAAUXyM%3D
US
der
1.79 Kb
whitelisted
1448
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
1448
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQS14tALDViBvqCf47YkiQRtKz1BAQUpc436uuwdQ6UZ4i0RfrZJBCHlh8CEAwIT5ccP%2BYH4aF5UBqgeL4%3D
US
der
278 b
whitelisted
1448
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
1448
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQS14tALDViBvqCf47YkiQRtKz1BAQUpc436uuwdQ6UZ4i0RfrZJBCHlh8CEAwIT5ccP%2BYH4aF5UBqgeL4%3D
US
der
278 b
whitelisted
4064
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D
US
der
1.47 Kb
whitelisted
4064
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D
US
der
1.47 Kb
whitelisted
4064
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D
US
der
1.47 Kb
whitelisted
4064
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
4064
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQS14tALDViBvqCf47YkiQRtKz1BAQUpc436uuwdQ6UZ4i0RfrZJBCHlh8CEA08uJZMbdsM6UNLdDbmY6Y%3D
US
der
278 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1448
iexplore.exe
104.27.158.45:443
verifyzone.org
Cloudflare Inc
US
unknown
4064
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
4064
iexplore.exe
104.26.12.175:443
bucket.cpabuild.com
Cloudflare Inc
US
unknown
4064
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
4064
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
964
iexplore.exe
104.27.158.45:443
verifyzone.org
Cloudflare Inc
US
unknown
4064
iexplore.exe
104.18.25.243:80
ocsp.msocsp.com
Cloudflare Inc
US
shared
1448
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted

DNS requests

Domain
IP
Reputation
verifyzone.org
  • 104.27.158.45
  • 104.27.159.45
  • 172.67.214.105
malicious
ocsp.digicert.com
  • 93.184.220.29
whitelisted
bucket.cpabuild.com
  • 104.26.12.175
  • 104.26.13.175
  • 172.67.69.215
unknown
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 13.107.21.200
  • 204.79.197.200
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
ocsp.msocsp.com
  • 104.18.25.243
  • 104.18.24.243
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Fall Guys.zip