| File name: | download.zip |
| Full analysis: | https://app.any.run/tasks/fbb39410-2fc7-4c97-8321-c5ae16d9a2aa |
| Verdict: | Malicious activity |
| Analysis date: | April 21, 2024, 14:26:45 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v1.0 to extract, compression method=store |
| MD5: | 6B1734340C290A054AF192416FAB4E8A |
| SHA1: | 79B8B5700139F2F63AEA578E44A7469CCD091C50 |
| SHA256: | 06DA2727860415E535EB3CAA8908E28B898687469E5F60B8B3D862A57E67309C |
| SSDEEP: | 3072:0DiqqHTsYLOij2NUU+HgZ96fifpuk5nM7UrnVYTB2E66zuNIy4LL:SOYIPaUU0gnkeRsUpYM5/NIy6 |
MALICIOUS
Drops the executable file immediately after the start
- WinRAR.exe (PID: 668)
SUSPICIOUS
Drops a system driver (possible attempt to evade defenses)
- WinRAR.exe (PID: 668)
Reads the Internet Settings
- sipnotify.exe (PID: 1860)
Checks Windows Trust Settings
- drvinst.exe (PID: 3300)
The process executes via Task Scheduler
- ctfmon.exe (PID: 1432)
- sipnotify.exe (PID: 1860)
Reads settings of System Certificates
- sipnotify.exe (PID: 1860)
INFO
Reads the software policy settings
- drvinst.exe (PID: 3300)
- sipnotify.exe (PID: 1860)
Manual execution by a user
- IMEKLMG.EXE (PID: 284)
- notepad.exe (PID: 3664)
- mmc.exe (PID: 3592)
- rundll32.exe (PID: 2880)
- notepad.exe (PID: 1424)
- mmc.exe (PID: 1112)
- IMEKLMG.EXE (PID: 1196)
- wmpnscfg.exe (PID: 2416)
- rundll32.exe (PID: 2232)
- wmpnscfg.exe (PID: 2352)
- wmpnscfg.exe (PID: 2780)
- notepad++.exe (PID: 2636)
Executable content was dropped or overwritten
- WinRAR.exe (PID: 668)
Reads the machine GUID from the registry
- drvinst.exe (PID: 3300)
Process checks whether UAC notifications are on
- IMEKLMG.EXE (PID: 284)
- IMEKLMG.EXE (PID: 1196)
Checks supported languages
- IMEKLMG.EXE (PID: 284)
- IMEKLMG.EXE (PID: 1196)
- wmpnscfg.exe (PID: 2352)
- wmpnscfg.exe (PID: 2416)
- wmpnscfg.exe (PID: 2780)
- drvinst.exe (PID: 3300)
Reads the computer name
- IMEKLMG.EXE (PID: 1196)
- wmpnscfg.exe (PID: 2352)
- wmpnscfg.exe (PID: 2416)
- wmpnscfg.exe (PID: 2780)
- drvinst.exe (PID: 3300)
- IMEKLMG.EXE (PID: 284)
Reads security settings of Internet Explorer
- sipnotify.exe (PID: 1860)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .zip | | | ZIP compressed archive (100) |
|---|
EXIF
ZIP
| ZipRequiredVersion: | 10 |
|---|---|
| ZipBitFlag: | - |
| ZipCompression: | None |
| ZipModifyDate: | 2024:04:19 11:58:38 |
| ZipCRC: | 0xc8a1e8a8 |
| ZipCompressedSize: | 19 |
| ZipUncompressedSize: | 19 |
| ZipFileName: | flag4.txt |
Total processes
98
Monitored processes
16
Malicious processes
1
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 284 | "C:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE" /SetPreload /JPN /Log | C:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Office IME 2010 Exit code: 1 Version: 14.0.4734.1000 Modules
| |||||||||||||||
| 668 | "C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\download.zip | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
| 1112 | "C:\Windows\system32\mmc.exe" C:\Windows\system32\devmgmt.msc | C:\Windows\System32\mmc.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft Management Console Exit code: 1073807364 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1196 | "C:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE" /SetPreload /KOR /Log | C:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Office IME 2010 Exit code: 1 Version: 14.0.4734.1000 Modules
| |||||||||||||||
| 1424 | "C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\myDriver.inf | C:\Windows\System32\notepad.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Notepad Exit code: 1073807364 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1432 | C:\Windows\System32\ctfmon.exe | C:\Windows\System32\ctfmon.exe | — | taskeng.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: CTF Loader Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1860 | C:\Windows\system32\sipnotify.exe -LogonOrUnlock | C:\Windows\System32\sipnotify.exe | taskeng.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: sipnotify Exit code: 0 Version: 6.1.7602.20480 (win7sp1_ldr_escrow.191010-1716) Modules
| |||||||||||||||
| 2232 | "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\Desktop\myDriver.sys | C:\Windows\System32\rundll32.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2352 | "C:\Program Files\Windows Media Player\wmpnscfg.exe" | C:\Program Files\Windows Media Player\wmpnscfg.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Media Player Network Sharing Service Configuration Application Exit code: 0 Version: 12.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2416 | "C:\Program Files\Windows Media Player\wmpnscfg.exe" | C:\Program Files\Windows Media Player\wmpnscfg.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Media Player Network Sharing Service Configuration Application Exit code: 0 Version: 12.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
21 091
Read events
20 911
Write events
159
Delete events
21
Modification events
| (PID) Process: | (668) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (668) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (668) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (668) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 3 |
Value: C:\Users\admin\Desktop\phacker.zip | |||
| (PID) Process: | (668) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\Win7-KB3191566-x86.zip | |||
| (PID) Process: | (668) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip | |||
| (PID) Process: | (668) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\Desktop\download.zip | |||
| (PID) Process: | (668) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (668) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (668) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
Executable files
3
Suspicious files
7
Text files
7
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 668 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa668.42698\flag4.txt | text | |
MD5:E652A8F9AB8AB7143FFECC74B270D43B | SHA256:ECFFBC8B49A01CABEEEA7F1859E47F4DD94B08608F28FC7419DAD7B4315B45FA | |||
| 668 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa668.42698\MoneyGrabber.exe | executable | |
MD5:782522FFEC6918E07C3E153A604476DE | SHA256:DEEEB30E5F0BE778456F342E00FDEEEFF8FB01FBA7EBFFF09C2154B961DC36D1 | |||
| 1112 | mmc.exe | C:\Windows\INF\setupapi.dev.log | text | |
MD5:8F6FD63E9CF68120F735C0D1CC1C4284 | SHA256:45575517B593ED460DFC01CE17737E1CD39035DBDAA2ACB3C0230824359C3F05 | |||
| 3300 | drvinst.exe | C:\Windows\INF\setupapi.ev3 | binary | |
MD5:AC5DAE43BD0018517FD3C49B810103F2 | SHA256:34F32201837E28C3A10367382D4C0D0C42F1777E605E57D9A004908B1E1E7EF6 | |||
| 1112 | mmc.exe | C:\Windows\INF\setupapi.app.log | ini | |
MD5:9705B42FD4481D6294D969632F9F276B | SHA256:B28DBEF54C5BBE403905F6169FA65754CB5AAC7731E507E6A6AC6D67C73E8836 | |||
| 668 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa668.42698\mydriver.cat | cat | |
MD5:27E74D02728DBF0DC63EFE7292833126 | SHA256:685E91C151845093F316362C093547BBECDE3AB0F27D412F644EEAB9E7BC68F4 | |||
| 1860 | sipnotify.exe | C:\Users\admin\AppData\Local\microsoft\windows\SipNotify\eoscontent\en-us.html | html | |
MD5:9752942B57692148B9F614CF4C119A36 | SHA256:E31B834DD53FA6815F396FC09C726636ABF98F3367F0CF1590EF5EB3801C75D1 | |||
| 1860 | sipnotify.exe | C:\Users\admin\AppData\Local\microsoft\windows\SipNotify\eoscontent\metadata.json | binary | |
MD5:E8A970BA6CE386EED9A5E724F26212A6 | SHA256:7E06107D585D8FC7870998F3856DCC3E35800AA97E4406AAB83BC8444B6CBDE3 | |||
| 668 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa668.42698\myDriver.inf | binary | |
MD5:8DD881D5D8A835544386C2F02BCC5096 | SHA256:B276DCF68623C18C6DD9E5F1F00EF35728F42E63205AF30E5D1840B6094EE378 | |||
| 668 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa668.42698\myDriver.sys | executable | |
MD5:EA98412A984F3A28B077FE7DB73E2629 | SHA256:5AA6E67C99B20F02DFCAD282A4BAE7862E463568E02DD13A37EC43DA61588527 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
8
DNS requests
1
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1860 | sipnotify.exe | HEAD | 200 | 23.197.138.118:80 | http://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2JgkA?v=133581869404370000 | unknown | — | — | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
1124 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
1860 | sipnotify.exe | 23.197.138.118:80 | query.prod.cms.rt.microsoft.com | Akamai International B.V. | US | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
query.prod.cms.rt.microsoft.com |
| whitelisted |