analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://cdn.discordapp.com/attachments/610902783268356112/612013761695318017/Sinki_2.4.mapo.rar

Full analysis: https://app.any.run/tasks/f1209c67-8f83-48c6-a968-0b936cceba17
Verdict: Malicious activity
Analysis date: August 18, 2019, 00:38:29
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

1876A83143CF9030C21A40CC3B5439B9

SHA1:

D05AF7E49EE2A5707A5227DAB2670D52E6DFCD4F

SHA256:

07B96A753D1A49AF1D29B45D524B85C4040D93589E467D36A371302218015832

SSDEEP:

3:N8cCWdy6//zCA/uVTHBoMLu6EOO:2cry6XzCA2VVoMLuh

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 4028)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 3528)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3844)
      • iexplore.exe (PID: 3528)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3528)
      • iexplore.exe (PID: 3844)

    • Creates files in the user directory

      • iexplore.exe (PID: 3844)

    • Changes internet zones settings

      • iexplore.exe (PID: 3528)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
4
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe winrar.exe sinki 2.4.mapo.exe

Process information

PID
CMD
Path
Indicators
Parent process
3528"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3844"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3528 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
4028"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Downloads\Sinki_2.4.mapo.rar"C:\Program Files\WinRAR\WinRAR.exe
iexplore.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
752"C:\Users\admin\AppData\Local\Temp\Rar$EXa4028.27747\Sinki 2.4.mapo.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa4028.27747\Sinki 2.4.mapo.exe
WinRAR.exe
User:
admin
Company:
Sinki
Integrity Level:
MEDIUM
Description:
Sinki
Version:
1.0.0.0
Total events
1 299
Read events
1 187
Write events
108
Delete events
4

Modification events

(PID) Process:(3528) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3528) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3528) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3528) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(3528) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3528) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000092000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(3528) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{87D5F4E5-C150-11E9-B86F-5254004A04AF}
Value:
0
(PID) Process:(3528) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Type
Value:
4
(PID) Process:(3528) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Count
Value:
2
(PID) Process:(3528) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Time
Value:
E307080000001200000026002C00DB02
Executable files
1
Suspicious files
1
Text files
8
Unknown types
4

Dropped files

PID
Process
Filename
Type
3528iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\favicon[1].ico —
MD5:—
SHA256:—
3528iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
3528iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF0FC56D63438657CE.TMP —
MD5:—
SHA256:—
3844iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\993USWCH\Sinki_2.4.mapo[1].rar —
MD5:—
SHA256:—
3528iexplore.exeC:\Users\admin\Downloads\Sinki_2.4.mapo.rar —
MD5:—
SHA256:—
3528iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF3B55AE08ACA87ECE.TMP —
MD5:—
SHA256:—
3528iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{87D5F4E5-C150-11E9-B86F-5254004A04AF}.dat —
MD5:—
SHA256:—
3528iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{87D5F4E6-C150-11E9-B86F-5254004A04AF}.datbinary
MD5:AB70C669B8A3B651794AC2760A0FBFC8
SHA256:C204D3C0E6F541D22BF5AE88804679D7031835D7BC7E44F1DE7CEE4CA80BB743
3844iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.datdat
MD5:377AAF8A4CC3B2861FD29D2396491C4B
SHA256:F127F622393F70A3C7DF77DD1E6EB276BB2BB5616E3A7175A26FE21876E6B742
3844iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.datdat
MD5:B3B57C3D8B62A0BCC65971A9C29600F4
SHA256:6CD88E6F594A2E6EC80577CF38D361F8F2BC7B2440E88F670465C9AAD3BF4A60
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
3
DNS requests
3
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
752
Sinki 2.4.mapo.exe
POST
—
120.41.41.9:80
http://ieqgmccbgb66pn86.soft.maposafe.com/wx.php
CN
—
—
malicious
3528
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3528
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
752
Sinki 2.4.mapo.exe
120.41.41.9:80
ieqgmccbgb66pn86.soft.maposafe.com
Xiamen
CN
malicious
3844
iexplore.exe
162.159.129.233:443
cdn.discordapp.com
Cloudflare Inc
—
shared

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
cdn.discordapp.com
  • 162.159.129.233
  • 162.159.134.233
  • 162.159.130.233
  • 162.159.135.233
  • 162.159.133.233
shared
ieqgmccbgb66pn86.soft.maposafe.com
  • 120.41.41.9
unknown

Threats

No threats detected
Process
Message
Sinki 2.4.mapo.exe
scrt_initialize_thread_safe_statics
Sinki 2.4.mapo.exe
WebPageImpl::init: 0520B7F0
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://cdn.discordapp.com/attachments/610902783268356112/612013761695318017/Sinki_2.4.mapo.rar