File name:

Masscan GUI.zip

Full analysis: https://app.any.run/tasks/a68d6b6a-b42d-403e-a2f4-b420e7782066
Verdict: Malicious activity
Analysis date: November 20, 2023, 14:29:08
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

A498F3A8DCF1F1CE10DB14A11538BAF9

SHA1:

ABA7E933725A2E37C414E863F6E7A25D5C780E38

SHA256:

0A7C41EF77D368A7754CF36A119660E0A164920AF9581715BBE987B83DA41593

SSDEEP:

98304:Y1oKLNb0mcC1TbUxx7zjiMd+WraNSLHdNTbbwPw6ictj+Yl7Rd56UOtN0fVAM8+R:YJD/otIZAFLNi1RyWtULmHBssvjCrSD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • masscanGUI.exe (PID: 3756)
      • Setup.exe (PID: 3860)

    • Changes the autorun value in the registry

      • Setup.exe (PID: 3864)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 3128)
      • masscanGUI.exe (PID: 3756)

    • Reads the Internet Settings

      • masscanGUI.exe (PID: 3756)
      • Setup.exe (PID: 3860)
      • Setup.exe (PID: 3864)
      • svchost.exe (PID: 3732)

    • The process creates files with name similar to system file names

      • Setup.exe (PID: 3864)

    • Reads settings of System Certificates

      • svchost.exe (PID: 3732)

  • INFO

    • Manual execution by a user

      • masscan.exe (PID: 3624)
      • masscanGUI.exe (PID: 3756)
      • wmpnscfg.exe (PID: 4044)

    • Checks supported languages

      • masscan.exe (PID: 3624)
      • masscanGUI.exe (PID: 3756)
      • Setup.exe (PID: 3864)
      • Setup.exe (PID: 3860)
      • masscanGUI .exe (PID: 3840)
      • svchost.exe (PID: 3732)
      • wmpnscfg.exe (PID: 4044)

    • Create files in a temporary directory

      • masscanGUI.exe (PID: 3756)
      • svchost.exe (PID: 3732)

    • Reads the computer name

      • masscanGUI.exe (PID: 3756)
      • masscanGUI .exe (PID: 3840)
      • svchost.exe (PID: 3732)
      • Setup.exe (PID: 3860)
      • Setup.exe (PID: 3864)
      • wmpnscfg.exe (PID: 4044)

    • Reads the machine GUID from the registry

      • Setup.exe (PID: 3864)
      • masscanGUI.exe (PID: 3756)
      • Setup.exe (PID: 3860)
      • svchost.exe (PID: 3732)
      • wmpnscfg.exe (PID: 4044)
      • masscanGUI .exe (PID: 3840)

    • Creates files or folders in the user directory

      • Setup.exe (PID: 3864)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3128)

    • Reads Environment values

      • svchost.exe (PID: 3732)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2022:06:29 00:40:22
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: Masscan GUI/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
8
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe no specs masscan.exe no specs masscangui.exe no specs setup.exe setup.exe no specs masscangui .exe no specs svchost.exe wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3128"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Masscan GUI.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3624"C:\Users\admin\Desktop\Masscan GUI\masscan.exe" C:\Users\admin\Desktop\Masscan GUI\masscan.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\users\admin\desktop\masscan gui\masscan.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\desktop\masscan gui\msvcr100.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\iphlpapi.dll
3732"C:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" C:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe
Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Exit code:
0
Version:
8.1.1.7900
Modules
Images
c:\users\admin\appdata\roaming\microsoft\windows\templates\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3756"C:\Users\admin\Desktop\Masscan GUI\masscanGUI.exe" C:\Users\admin\Desktop\Masscan GUI\masscanGUI.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\masscan gui\masscangui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3840"C:\Users\admin\Desktop\Masscan GUI\masscanGUI .exe" C:\Users\admin\Desktop\Masscan GUI\masscanGUI .exe—masscanGUI.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\masscan gui\masscangui .exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\desktop\masscan gui\qt5core.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\users\admin\desktop\masscan gui\libgcc_s_dw2-1.dll
3860"C:\Users\admin\AppData\Local\Temp\Setup.exe" C:\Users\admin\AppData\Local\Temp\Setup.exe—masscanGUI.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
3864"C:\Users\admin\AppData\Local\Temp\Setup.exe" C:\Users\admin\AppData\Local\Temp\Setup.exe
masscanGUI.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
4044"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
Total events
6 946
Read events
6 897
Write events
46
Delete events
3

Modification events

(PID) Process:(3128) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17A\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3756) masscanGUI.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3756) masscanGUI.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
16
Suspicious files
1
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
3128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3128.9060\Masscan GUI\libgcc_s_dw2-1.dllexecutable
MD5:FADDE43C97607E4445A6F924D851F04E
SHA256:F0614835136413217ED3BAEC9BA22AAAC4C37956AFCB0209F1F89B7676AE86BC
3128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3128.9060\Masscan GUI\31.txttext
MD5:869316B18036A97C30D9232B0FB7EC36
SHA256:F05092AF7665259841FF578B5646CCEEE519E87C6047CFAD64345C2FFF015225
3128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3128.9060\Masscan GUI\24.txttext
MD5:FC9F3E57851B13447F2A5EF2F6E8AA1E
SHA256:190D781BD511DECBC8C8F531EAF4C5489AFE80621FDD4A073954116E7B278304
3128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3128.9060\Masscan GUI\23.txttext
MD5:4DB24184FE989647073A8430AE322CD6
SHA256:21C37F7D9F7AAE11156DB7588BF211CA280264435A512E7F6E1BDE2FAA61DC83
3128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3128.9060\Masscan GUI\27.txttext
MD5:CB2E753E043282F397142DD7929651D7
SHA256:388C944907CA83E0C5670AFFB81C213682A22B05C2F793784ED8F0617EE1DA67
3128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3128.9060\Masscan GUI\Qt5Core.dllexecutable
MD5:931D4A882FD8C329BF96BB5ADAB9EF96
SHA256:43580C42406877B1DBAA801AB8D53C20C7F1E6A55CEE59D60080589FA741186B
3128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3128.9060\Masscan GUI\msvcr100.dllexecutable
MD5:0E37FBFA79D349D672456923EC5FBBE3
SHA256:8793353461826FBD48F25EA8B835BE204B758CE7510DB2AF631B28850355BD18
3128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3128.9060\Masscan GUI\Qt5Gui.dllexecutable
MD5:E189AC2CC8FD526B458634AC5D601070
SHA256:E4DE14D3C2A884E7324163EC708251D76F19C97ABEF67345880F35CCAACDF105
3128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3128.9060\Masscan GUI\Qt5Widgets.dllexecutable
MD5:251E93666D4EB9D5E3EFC6FD199980E1
SHA256:F409260E206CD6150756CAD196DFB9F444CD3BEC09117245AC2BFF4DE0A5E784
3864Setup.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.zipcompressed
MD5:AB29B0234F8DF412A9B76CC59CDB96FC
SHA256:5B2680C0B3A7AA295CC780CDBB4935F9520EF4AE4F74E47D624185D7BF01F18A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
8
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3732
svchost.exe
HEAD
200
107.180.41.239:80
http://amazonhost.thedreamsop.com/2022/explorer.txt
unknown
—
—
unknown
3732
svchost.exe
GET
200
107.180.41.239:80
http://amazonhost.thedreamsop.com/2022/explorer.txt
unknown
text
37 b
unknown
3732
svchost.exe
GET
200
107.180.41.239:80
http://amazonhost.thedreamsop.com/2022/explorer.txt
unknown
text
37 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3732
svchost.exe
107.180.41.239:80
amazonhost.thedreamsop.com
AS-26496-GO-DADDY-COM-LLC
US
unknown
3732
svchost.exe
172.217.17.97:443
24-06-2022-8080.blogspot.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
amazonhost.thedreamsop.com
  • 107.180.41.239
unknown
24-06-2022-8080.blogspot.com
  • 172.217.17.97
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Masscan GUI.zip