File name:

666.exe malware.zip

Full analysis: https://app.any.run/tasks/bd0c19ba-d913-44cd-a3ca-2ec887dfa0fc
Verdict: Malicious activity
Analysis date: March 16, 2024, 17:41:21
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

29FA9E769E966D235D50B905F7D86230

SHA1:

C92929E61218173908925F5830B35FC41B56A7F9

SHA256:

09BC6605501BC38B05E60D21678CFADAD50473EAF0F39B24101A5CC6460BCC3B

SSDEEP:

98304:klMOvSbvCemKja46x8RnKXbmDFw0yj5vgsqdiiAsgV4ZshrHExy4/KazcSp:aGZ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 2120)
      • 666.exe (PID: 2596)

    • Disables the Shutdown in the Start menu

      • 666.exe (PID: 2596)

    • Disables the Run the Start menu

      • 666.exe (PID: 2596)

    • Changes the login/logoff helper path in the registry

      • 666.exe (PID: 2596)

    • UAC/LUA settings modification

      • 666.exe (PID: 2596)

    • Changes image file execution options

      • 666.exe (PID: 2596)

    • Changes the autorun value in the registry

      • unregmp2.exe (PID: 2240)
      • regsvr32.exe (PID: 2312)

    • Create files in the Startup directory

      • regsvr32.exe (PID: 2312)

    • Steals credentials from Web Browsers

      • setup.exe (PID: 2640)

  • SUSPICIOUS

    • Creates or modifies Windows services

      • 666.exe (PID: 2596)

    • Executable content was dropped or overwritten

      • 666.exe (PID: 2596)

    • Changes the desktop background image

      • 666.exe (PID: 2596)

    • The process executes via Task Scheduler

      • sipnotify.exe (PID: 1252)
      • ctfmon.exe (PID: 1408)
      • sipnotify.exe (PID: 1292)

    • Reads settings of System Certificates

      • sipnotify.exe (PID: 1252)
      • sipnotify.exe (PID: 1292)

    • Reads the Internet Settings

      • sipnotify.exe (PID: 1252)
      • runonce.exe (PID: 1600)
      • sipnotify.exe (PID: 1292)
      • ie4uinit.exe (PID: 2084)
      • rundll32.exe (PID: 2132)
      • rundll32.exe (PID: 2164)
      • ie4uinit.exe (PID: 2220)
      • ie4uinit.exe (PID: 2300)

    • Non-standard symbols in registry

      • WerFault.exe (PID: 2052)

    • Application launched itself

      • ie4uinit.exe (PID: 2084)
      • rundll32.exe (PID: 2132)
      • WerFault.exe (PID: 1412)
      • setup.exe (PID: 2640)

    • Uses RUNDLL32.EXE to load library

      • rundll32.exe (PID: 2132)
      • ie4uinit.exe (PID: 2084)

    • Reads Internet Explorer settings

      • ie4uinit.exe (PID: 2084)

    • Changes internet zones settings

      • ie4uinit.exe (PID: 2084)

    • Reads Microsoft Outlook installation path

      • ie4uinit.exe (PID: 2084)

    • Write to the desktop.ini file (may be used to cloak folders)

      • ie4uinit.exe (PID: 2084)
      • unregmp2.exe (PID: 2240)
      • regsvr32.exe (PID: 2312)

    • Changes default file association

      • unregmp2.exe (PID: 2240)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2120)

    • Checks supported languages

      • 666.exe (PID: 2596)
      • IMEKLMG.EXE (PID: 2152)
      • IMEKLMG.EXE (PID: 2168)
      • wmpnscfg.exe (PID: 2432)
      • wmpnscfg.exe (PID: 2452)
      • setup.exe (PID: 2652)
      • setup.exe (PID: 2684)
      • IMEKLMG.EXE (PID: 3156)
      • IMEKLMG.EXE (PID: 3144)
      • setup.exe (PID: 2640)
      • IMKRMIG.EXE (PID: 3176)
      • wmpnscfg.exe (PID: 3720)
      • wmpnscfg.exe (PID: 3740)

    • Reads the computer name

      • 666.exe (PID: 2596)
      • IMEKLMG.EXE (PID: 2152)
      • IMEKLMG.EXE (PID: 2168)
      • wmpnscfg.exe (PID: 2432)
      • wmpnscfg.exe (PID: 2452)
      • setup.exe (PID: 2684)
      • IMEKLMG.EXE (PID: 3144)
      • setup.exe (PID: 2652)
      • wmpnscfg.exe (PID: 3720)
      • IMEKLMG.EXE (PID: 3156)
      • wmpnscfg.exe (PID: 3740)

    • Manual execution by a user

      • 666.exe (PID: 2596)
      • IMEKLMG.EXE (PID: 2152)
      • wmpnscfg.exe (PID: 2452)
      • IMEKLMG.EXE (PID: 2168)
      • runonce.exe (PID: 1600)
      • wmpnscfg.exe (PID: 2432)
      • ie4uinit.exe (PID: 2084)
      • ie4uinit.exe (PID: 2220)
      • unregmp2.exe (PID: 2240)
      • ie4uinit.exe (PID: 2300)
      • regsvr32.exe (PID: 2312)
      • chrmstp.exe (PID: 2488)
      • setup.exe (PID: 2640)
      • IMEKLMG.EXE (PID: 3144)
      • IMEKLMG.EXE (PID: 3156)
      • wmpnscfg.exe (PID: 3720)
      • wmpnscfg.exe (PID: 3740)

    • Reads the software policy settings

      • sipnotify.exe (PID: 1252)
      • sipnotify.exe (PID: 1292)

    • Reads security settings of Internet Explorer

      • sipnotify.exe (PID: 1252)
      • ie4uinit.exe (PID: 2084)
      • runonce.exe (PID: 1600)
      • sipnotify.exe (PID: 1292)

    • Process checks whether UAC notifications are on

      • IMEKLMG.EXE (PID: 2152)
      • IMEKLMG.EXE (PID: 2168)
      • IMEKLMG.EXE (PID: 3156)
      • IMEKLMG.EXE (PID: 3144)

    • Reads the time zone

      • runonce.exe (PID: 1600)

    • Checks proxy server information

      • ie4uinit.exe (PID: 2084)

    • Application launched itself

      • chrmstp.exe (PID: 2488)
      • chrmstp.exe (PID: 2544)
      • msedge.exe (PID: 2700)

    • Creates files in the program directory

      • chrmstp.exe (PID: 2488)
      • setup.exe (PID: 2652)
      • setup.exe (PID: 2684)
      • setup.exe (PID: 2640)
      • chrmstp.exe (PID: 2544)
      • ie4uinit.exe (PID: 2084)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2021:07:28 19:19:06
ZipCRC: 0x298ee849
ZipCompressedSize: 1820904
ZipUncompressedSize: 4166144
ZipFileName: 666.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
165
Monitored processes
39
Malicious processes
5
Suspicious processes
3

Behavior graph

Click at the process to see the details
start winrar.exe 666.exe sipnotify.exe ctfmon.exe no specs imeklmg.exe no specs imeklmg.exe no specs wmpnscfg.exe no specs wmpnscfg.exe no specs sipnotify.exe runonce.exe no specs werfault.exe no specs werfault.exe no specs ie4uinit.exe no specs ie4uinit.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs ie4uinit.exe no specs unregmp2.exe ie4uinit.exe no specs regsvr32.exe chrmstp.exe no specs chrmstp.exe no specs chrmstp.exe no specs chrmstp.exe no specs setup.exe setup.exe no specs setup.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs imeklmg.exe no specs imeklmg.exe no specs imkrmig.exe no specs wmpnscfg.exe no specs wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1252C:\Windows\system32\sipnotify.exe -LogonOrUnlockC:\Windows\System32\sipnotify.exe
taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
sipnotify
Exit code:
0
Version:
6.1.7602.20480 (win7sp1_ldr_escrow.191010-1716)
Modules
Images
c:\windows\system32\sipnotify.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1292C:\Windows\system32\sipnotify.exe -LogonOrUnlockC:\Windows\System32\sipnotify.exe
taskeng.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
sipnotify
Exit code:
0
Version:
6.1.7602.20480 (win7sp1_ldr_escrow.191010-1716)
Modules
Images
c:\windows\system32\sipnotify.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1408C:\Windows\System32\ctfmon.exe C:\Windows\System32\ctfmon.exe—taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
CTF Loader
Exit code:
1073807364
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ctfmon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msctfmonitor.dll
c:\windows\system32\msctf.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
1412"C:\Windows\System32\WerFault.exe" -k -rqC:\Windows\System32\WerFault.exe—runonce.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1600C:\Windows\system32\runonce.exe /ExplorerC:\Windows\System32\runonce.exe—explorer.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Run Once Wrapper
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\runonce.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2052C:\Windows\System32\WerFault.exe -k -qC:\Windows\System32\WerFault.exe—WerFault.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2084"C:\Windows\System32\ie4uinit.exe" -UserConfigC:\Windows\System32\ie4uinit.exe—explorer.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
IE Per-User Initialization Utility
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\system32\ie4uinit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2104C:\Windows\System32\ie4uinit.exe -ClearIconCacheC:\Windows\System32\ie4uinit.exe—ie4uinit.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
IE Per-User Initialization Utility
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\system32\ie4uinit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2116C:\Windows\System32\rundll32 advpack.dll,LaunchINFSectionEx C:\Windows\system32\ieuinit.inf,Install,,36C:\Windows\System32\rundll32.exe—ie4uinit.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
2120"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\666.exe malware.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
Total events
26 436
Read events
24 954
Write events
1 282
Delete events
200

Modification events

(PID) Process:(2120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2120) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(2120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(2120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\666.exe malware.zip
(PID) Process:(2120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
8
Suspicious files
39
Text files
88
Unknown types
19

Dropped files

PID
Process
Filename
Type
2164rundll32.exeC:\Users\Administrator\AppData\Local\Microsoft\Feeds Cache\AVO5ZJHP\fwlink[1] —
MD5:—
SHA256:—
2164rundll32.exeC:\Users\Administrator\AppData\Local\Microsoft\Feeds Cache\I78Z4R0G\fwlink[1] —
MD5:—
SHA256:—
2164rundll32.exeC:\Users\Administrator\AppData\Local\Microsoft\Feeds Cache\23SL9UQZ\fwlink[1] —
MD5:—
SHA256:—
2164rundll32.exeC:\Users\Administrator\AppData\Local\Microsoft\Feeds Cache\F1FS46JA\fwlink[1] —
MD5:—
SHA256:—
2164rundll32.exeC:\Users\Administrator\AppData\Local\Microsoft\Feeds Cache\AVO5ZJHP\fwlink[2] —
MD5:—
SHA256:—
2164rundll32.exeC:\Users\Administrator\AppData\Local\Microsoft\Feeds Cache\I78Z4R0G\fwlink[2] —
MD5:—
SHA256:—
2596666.exeC:\Windows\death.exeexecutable
MD5:F3346CEC01E6868EC4F593E7169DEC18
SHA256:A29451E1B94AB7A4A4DE84BE214D39D3C6FF3343DC5DF041E627D1071B70201C
2596666.exeC:\Windows\666.bmpimage
MD5:95B1A43E40E5080A626372C916BC04AA
SHA256:432B44507D1665F903A65D3B04EF0E0C45CE9C03D1BF6B46D556E01C06138AA2
1252sipnotify.exeC:\Users\admin\AppData\Local\microsoft\windows\SipNotify\eoscontent\main.jpgimage
MD5:B342ACE63F77961249A084C61EABC884
SHA256:E5067BBA2095B5DA7C3171EC116E9A92337E24E471339B0860A160076EFE49B9
2596666.exeC:\Windows\first.exeexecutable
MD5:4CB1F84904AF2DC04D8608AD00F8CA1E
SHA256:37F99309053D3B0ADCE6BAC240249F0390C6370A7B1F6D2099B7E838F6DF91B7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
14
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1252
sipnotify.exe
HEAD
200
88.221.61.151:80
http://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2JgkA?v=133550845300030000
unknown
—
—
unknown
1292
sipnotify.exe
HEAD
200
88.221.61.151:80
http://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2JgkA?v=133550846149480000
unknown
—
—
unknown
1292
sipnotify.exe
GET
200
88.221.61.151:80
http://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2JgkA?v=133550846149480000
unknown
compressed
78.4 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1100
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1252
sipnotify.exe
88.221.61.151:80
query.prod.cms.rt.microsoft.com
AKAMAI-AS
DE
unknown
1148
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1292
sipnotify.exe
88.221.61.151:80
query.prod.cms.rt.microsoft.com
AKAMAI-AS
DE
unknown

DNS requests

Domain
IP
Reputation
query.prod.cms.rt.microsoft.com
  • 88.221.61.151
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
666.exe malware.zip