File name:

video-china02712.zip

Full analysis: https://app.any.run/tasks/967c009c-cfaa-411f-b804-69bc23bb5814
Verdict: Malicious activity
Analysis date: February 13, 2020, 15:30:19
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

CAACE6841A4CA5FDE5C67E676D140ADE

SHA1:

2804007ED7E315CD468E265F93F6B19E680F0F0F

SHA256:

08710023C219F26237A9C8DE5454A1DE17117A2DA651B4391AFCE8E331F31DFA

SSDEEP:

24576:9FOaiVOohEpbe5fttoTb9aGo2Gcfhbcpz7Cd1HHwhvdK5Q:0VOoqpbe5fY5Qz7CdVwBH

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was injected by another process

      • SearchIndexer.exe (PID: 1376)
      • svchost.exe (PID: 876)
      • svchost.exe (PID: 372)

    • Runs injected code in another process

      • rundll32.exe (PID: 2304)

    • Changes the autorun value in the registry

      • APfunkdrawer.exe (PID: 2112)

    • Loads the Task Scheduler COM API

      • rundll32.exe (PID: 2304)

  • SUSPICIOUS

    • Executed as Windows Service

      • lpremove.exe (PID: 2536)
      • vssvc.exe (PID: 2164)
      • rundll32.exe (PID: 2304)

    • Creates files in the Windows directory

      • rundll32.exe (PID: 2304)

    • Reads the machine GUID from the registry

      • rundll32.exe (PID: 2304)
      • msiexec.exe (PID: 2244)
      • vssvc.exe (PID: 2164)
      • explorer.exe (PID: 2568)
      • WinRAR.exe (PID: 1212)
      • WinRAR.exe (PID: 2640)

    • Creates files in the program directory

      • SearchIndexer.exe (PID: 1376)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 2244)

    • Removes files from Windows directory

      • rundll32.exe (PID: 2304)

    • Searches for installed software

      • rundll32.exe (PID: 2304)

  • INFO

    • Manual execution by user

      • msiexec.exe (PID: 116)
      • explorer.exe (PID: 2568)
      • WinRAR.exe (PID: 2640)

    • Loads dropped or rewritten executable

      • MsiExec.exe (PID: 3060)

    • Low-level read access rights to disk partition

      • vssvc.exe (PID: 2164)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2020:02:11 14:48:02
ZipCRC: 0x3c6797b0
ZipCompressedSize: 1108575
ZipUncompressedSize: 2415104
ZipFileName: video-china02712.msi
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
60
Monitored processes
14
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start inject inject inject winrar.exe no specs rundll32.exe no specs lpremove.exe no specs svchost.exe svchost.exe searchindexer.exe vssvc.exe no specs msiexec.exe no specs msiexec.exe msiexec.exe apfunkdrawer.exe apfunkdrawer.exe no specs explorer.exe no specs winrar.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
116"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\Desktop\video-china02712.msi" C:\Windows\System32\msiexec.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
372C:\Windows\system32\svchost.exe -k NetworkServiceC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
876C:\Windows\system32\svchost.exe -k netsvcsC:\Windows\System32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1212"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\video-china02712.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1376C:\Windows\system32\SearchIndexer.exe /EmbeddingC:\Windows\System32\SearchIndexer.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Indexer
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\searchindexer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2112C:\Users\admin\AppData\Local\altheap\APfunkdrawer.exeC:\Users\admin\AppData\Local\altheap\APfunkdrawer.exe
MsiExec.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\altheap\apfunkdrawer.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2164C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2244C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2304C:\Windows\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreationC:\Windows\system32\rundll32.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
2464C:\Users\admin\AppData\Local\altheap\APfunkdrawer.exeC:\Users\admin\AppData\Local\altheap\APfunkdrawer.exe—MsiExec.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\altheap\apfunkdrawer.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
Total events
5 658
Read events
5 345
Write events
301
Delete events
12

Modification events

(PID) Process:(1212) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1212) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1212) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(372) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Nla\Cache\Intranet
Operation:writeName:{00E51A5A-6FF0-414A-B358-C7EB6484BAF5}
Value:
525400363EFF
(PID) Process:(1212) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\video-china02712.zip
(PID) Process:(1212) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1212) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1212) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1212) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1212) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12F\52C64B7E
Operation:writeName:@C:\Windows\System32\msimsg.dll,-34
Value:
Windows Installer Package
Executable files
3
Suspicious files
10
Text files
0
Unknown types
6

Dropped files

PID
Process
Filename
Type
1212WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1212.36806\video-china02712.msi —
MD5:—
SHA256:—
2244msiexec.exeC:\Windows\Installer\MSIEADE.tmp —
MD5:—
SHA256:—
2244msiexec.exeC:\Users\admin\AppData\Local\Temp\~DF7F5A9CFA368F2753.TMP —
MD5:—
SHA256:—
2304rundll32.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
3060MsiExec.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BDW1XBVN\APfunkdrawer[1].iso —
MD5:—
SHA256:—
3060MsiExec.exeC:\Users\admin\AppData\Local\altheap\RFDK2567218.ZIP —
MD5:—
SHA256:—
372svchost.exeC:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb —
MD5:—
SHA256:—
372svchost.exeC:\Windows\system32\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb —
MD5:—
SHA256:—
372svchost.exeC:\Windows\system32\CatRoot2\edb.log —
MD5:—
SHA256:—
3060MsiExec.exeC:\Users\admin\AppData\Local\altheap\APfunkdrawer.exe —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
2
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3060
MsiExec.exe
GET
200
150.162.249.17:80
http://comunic.sites.ufsc.br/css/comp2020/index.php
BR
—
—
unknown
876
svchost.exe
GET
200
13.72.105.98:443
http://13.72.105.98:443/APfunkdrawer.iso
US
binary
5.04 Mb
malicious
3060
MsiExec.exe
GET
200
13.72.105.98:443
http://13.72.105.98:443/APfunkdrawer.iso
US
binary
5.04 Mb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3060
MsiExec.exe
13.72.105.98:443
—
Microsoft Corporation
US
malicious
3060
MsiExec.exe
150.162.249.17:80
comunic.sites.ufsc.br
Universidade Federal de Santa Catarina
BR
unknown

DNS requests

Domain
IP
Reputation
comunic.sites.ufsc.br
  • 150.162.249.17
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
video-china02712.zip