Malware analysis Windows 7 Activator Reloaded [Team Rjaa].zip Malicious activity

Add for printing

File name:	Windows 7 Activator Reloaded [Team Rjaa].zip
Full analysis:	https://app.any.run/tasks/453f8e8c-540b-4b1e-8926-8ecb48370a4d
Verdict:	Malicious activity
Analysis date:	June 26, 2019, 08:29:41
OS:	Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:	evasion
Indicators:
MIME:	application/zip
File info:	Zip archive data, at least v2.0 to extract
MD5:	4FD8D270F84C4D4323FF4C20BF29D2C5
SHA1:	9604C38D673B4BB6CCACB9242B8FA5CC3C7F0748
SHA256:	0B9EE7718817A386DE36EB1CA34EF78E81E3761FE63097E245C613FDF994C90B
SSDEEP:	196608:dEyaJJRbr2POiWWD4wWxju+OMmjkU8m5zgq:za/RmPOD4au+OTjkURgq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 60 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: none
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 8.0.7601.17514 undefined
Adobe Acrobat Reader DC MUI (15.023.20070)
Adobe Flash Player 26 ActiveX (26.0.0.131)
Adobe Flash Player 26 NPAPI (26.0.0.131)
Adobe Flash Player 26 PPAPI (26.0.0.131)
Adobe Refresh Manager (1.8.0)
CCleaner (5.35)
FileZilla Client 3.36.0 (3.36.0)
Google Chrome (73.0.3683.75)
Google Update Helper (1.3.33.23)
Java 8 Update 92 (8.0.920.14)
Java Auto Updater (2.8.92.14)
Microsoft .NET Framework 4.6.1 (4.6.01055)
Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Professional 2010 (14.0.6029.1000)
Microsoft Office Proof (English) 2010 (14.0.6029.1000)
Microsoft Office Proof (French) 2010 (14.0.6029.1000)
Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Single Image 2010 (14.0.6029.1000)
Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2017 Redistributable (x86) - 14.15.26706 (14.15.26706.0)
Microsoft Visual C++ 2017 x86 Additional Runtime - 14.15.26706 (14.15.26706)
Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.15.26706 (14.15.26706)
Mozilla Firefox 65.0.2 (x86 en-US) (65.0.2)
Notepad++ (32-bit x86) (7.5.1)
Opera 12.15 (12.15.1748)
Skype version 8.29 (8.29)
VLC media player (2.2.6)
WinRAR 5.60 (32-bit) (5.60.0)

Hotfixes

Client LanguagePack Package
Client Refresh LanguagePack Package
CodecPack Basic Package
Foundation Package
IE Troubleshooters Package
InternetExplorer Optional Package
KB2534111
KB2999226
KB976902
LocalPack AU Package
LocalPack CA Package
LocalPack GB Package
LocalPack US Package
LocalPack ZA Package
ProfessionalEdition
UltimateEdition

Add for printing

MALICIOUS
- Changes the autorun value in the registry
  - SeafkoAgent.exe (PID: 3112)
  - SeafkoAgent.exe (PID: 1904)
- Application was dropped or rewritten from another process
  - SeafkoAgent.exe (PID: 3112)
  - Windows Loader.exe (PID: 2088)
  - SeafkoAgent.exe (PID: 1904)
- Changes settings of System certificates
  - SeafkoAgent.exe (PID: 3112)
SUSPICIOUS
- Executable content was dropped or overwritten
  - Windows Loader.exe (PID: 3208)
  - SeafkoAgent.exe (PID: 3112)
- Creates executable files which already exist in Windows
  - SeafkoAgent.exe (PID: 3112)
- Creates files in the user directory
  - Windows Loader.exe (PID: 3208)
  - Windows_7_Activator.exe (PID: 3272)
- Executed as Windows Service
  - WmiApSrv.exe (PID: 1524)
- Adds / modifies Windows certificates
  - SeafkoAgent.exe (PID: 3112)
- Checks for external IP
  - SeafkoAgent.exe (PID: 3112)
- Executes application which crashes
  - Windows_7_Activator.exe (PID: 3272)
INFO
- Manual execution by user
  - Windows Loader.exe (PID: 3208)
  - Windows_7_Activator.exe (PID: 3272)
- Reads settings of System Certificates
  - SeafkoAgent.exe (PID: 3112)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.zip	\|	ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion:	20
ZipBitFlag:	-
ZipCompression:	Deflated
ZipModifyDate:	2011:08:19 18:51:10
ZipCRC:	0xdc52d4ca
ZipCompressedSize:	133
ZipUncompressedSize:	172
ZipFileName:	Windows 7 Activator/Activate.txt

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

296

"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Windows 7 Activator Reloaded [Team Rjaa].zip"

C:\Program Files\WinRAR\WinRAR.exe

—

explorer.exe

User:

admin

Company:

Alexander Roshal

Integrity Level:

MEDIUM

Description:

WinRAR archiver

Exit code:

Version:

5.60.0

Modules

Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll

1524

C:\Windows\system32\wbem\WmiApSrv.exe

—

services.exe

User:

SYSTEM

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

WMI Performance Reverse Adapter

Exit code:

Version:

6.1.7600.16385 (win7_rtm.090713-1255)

Modules

Images
c:\windows\system32\wbem\wmiapsrv.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll

1904

"C:\Users\admin\AppData\Roaming\SeafkoAgent.exe"

C:\Users\admin\AppData\Roaming\SeafkoAgent.exe

Windows_7_Activator.exe

User:

admin

Company:

Microsoft

Integrity Level:

HIGH

Description:

Windows Explorer

Exit code:

Version:

1.0.0.0

Modules

Images
c:\users\admin\appdata\roaming\seafkoagent.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll

2088

"C:\Users\admin\AppData\Roaming\Windows Loader.exe"

C:\Users\admin\AppData\Roaming\Windows Loader.exe

—

Windows Loader.exe

User:

admin

Integrity Level:

HIGH

Exit code:

Modules

Images
c:\users\admin\appdata\roaming\windows loader.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\gdi32.dll

2968

"C:\Windows\system32\ntvdm.exe" -i1

C:\Windows\system32\ntvdm.exe

—

Windows_7_Activator.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

NTVDM.EXE

Exit code:

Version:

6.1.7600.16385 (win7_rtm.090713-1255)

Modules

Images
c:\windows\system32\ntvdm.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll

3112

"C:\Users\admin\AppData\Roaming\SeafkoAgent.exe"

C:\Users\admin\AppData\Roaming\SeafkoAgent.exe

Windows Loader.exe

User:

admin

Company:

Microsoft

Integrity Level:

HIGH

Description:

Windows Explorer

Exit code:

Version:

1.0.0.0

Modules

Images
c:\users\admin\appdata\roaming\seafkoagent.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll

3208

"C:\Users\admin\Desktop\Windows 7 Activator\Windows Loader.exe"

C:\Users\admin\Desktop\Windows 7 Activator\Windows Loader.exe

explorer.exe

User:

admin

Integrity Level:

HIGH

Description:

Exit code:

Version:

0.0.0.0

Modules

Images
c:\users\admin\desktop\windows 7 activator\windows loader.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll

3272

"C:\Users\admin\Desktop\Windows 7 Activator\Windows_7_Activator.exe"

C:\Users\admin\Desktop\Windows 7 Activator\Windows_7_Activator.exe

explorer.exe

User:

admin

Integrity Level:

HIGH

Description:

Exit code:

Version:

0.0.0.0

Modules

Images
c:\users\admin\desktop\windows 7 activator\windows_7_activator.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll

Add for printing

Total events

1 381

Read events

1 327

Write events

Delete events

Modification events


(PID) Process:	(296) WinRAR.exe	Key:	HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:	write	Name:	ShellExtBMP
Value:
(PID) Process:	(296) WinRAR.exe	Key:	HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:	write	Name:	ShellExtIcon
Value:
(PID) Process:	(296) WinRAR.exe	Key:	HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E
Operation:	write	Name:	LanguageList
Value: en-US
(PID) Process:	(296) WinRAR.exe	Key:	HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:	write	Name:	0
Value: C:\Users\admin\AppData\Local\Temp\Windows 7 Activator Reloaded [Team Rjaa].zip
(PID) Process:	(296) WinRAR.exe	Key:	HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	name
Value: 120
(PID) Process:	(296) WinRAR.exe	Key:	HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	size
Value: 80
(PID) Process:	(296) WinRAR.exe	Key:	HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	type
Value: 120
(PID) Process:	(296) WinRAR.exe	Key:	HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	mtime
Value: 100
(PID) Process:	(3112) SeafkoAgent.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:	write	Name:	explorer
Value: C:\Users\admin\AppData\Local\explorer.exe
(PID) Process:	(3112) SeafkoAgent.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SeafkoAgent_RASAPI32
Operation:	write	Name:	EnableFileTracing
Value: 0

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
296	WinRAR.exe	C:\Users\admin\AppData\Local\Temp\Rar$DRa296.31562\Windows 7 Activator\Activate.txt		—
		MD5:—	SHA256:—
296	WinRAR.exe	C:\Users\admin\AppData\Local\Temp\Rar$DRa296.31562\Windows 7 Activator\ProdKeys.inf		—
		MD5:—	SHA256:—
296	WinRAR.exe	C:\Users\admin\AppData\Local\Temp\Rar$DRa296.31562\Windows 7 Activator\Windows Loader.exe		—
		MD5:—	SHA256:—
296	WinRAR.exe	C:\Users\admin\AppData\Local\Temp\Rar$DRa296.31562\Windows 7 Activator\Windows_7_Activator.exe		—
		MD5:—	SHA256:—
3208	Windows Loader.exe	C:\Users\admin\AppData\Roaming\data.xml		—
		MD5:—	SHA256:—
3272	Windows_7_Activator.exe	C:\Users\admin\AppData\Roaming\data.xml		—
		MD5:—	SHA256:—
3272	Windows_7_Activator.exe	C:\Users\admin\AppData\Roaming\Windows_7_Activator.exe		—
		MD5:—	SHA256:—
2968	ntvdm.exe	C:\Users\admin\AppData\Local\Temp\scs6E14.tmp		—
		MD5:—	SHA256:—
2968	ntvdm.exe	C:\Users\admin\AppData\Local\Temp\scs6E15.tmp		—
		MD5:—	SHA256:—
3112	SeafkoAgent.exe	C:\Users\admin\AppData\Local\Microsoft\SeafkoAgent.exe_Url_k2ifdwiijzcfo45vluw4asoq2xxwupwh\1.0.0.0\dqkewlhp.newcfg		—
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
3112	SeafkoAgent.exe	GET	204	216.58.205.238:80	http://clients3.google.com/generate_204	US	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
3112	SeafkoAgent.exe	216.239.36.21:443	ipinfo.io	Google Inc.	US	whitelisted
3112	SeafkoAgent.exe	145.14.144.143:443	mired-intensity.000webhostapp.com	Hostinger International Limited	US	shared
3112	SeafkoAgent.exe	216.58.205.238:80	clients3.google.com	Google Inc.	US	whitelisted
3112	SeafkoAgent.exe	192.186.136.206:6669	irc.abjects.net	B2 Net Solutions Inc.	CA	malicious
3112	SeafkoAgent.exe	92.61.32.19:6667	irc.data.lt	Telia Lietuva, AB	LT	unknown
3112	SeafkoAgent.exe	5.9.164.48:6667	irc.alphachat.net	Hetzner Online GmbH	DE	unknown

DNS requests

Domain	IP	Reputation
clients3.google.com	216.58.205.238	whitelisted
ipinfo.io	216.239.36.21 216.239.32.21 216.239.38.21 216.239.34.21	shared
mired-intensity.000webhostapp.com	145.14.144.143	shared
irc.data.lt	92.61.32.19	unknown
irc.abjects.net	192.186.136.206 107.191.116.17 172.93.55.23 94.23.42.81 104.227.214.15 23.229.98.85	malicious
irc.alphachat.net	5.9.164.48 149.255.109.168 149.248.55.130 104.238.146.46 45.32.74.177	unknown

Threats

PID	Process	Class	Message
3112	SeafkoAgent.exe	A Network Trojan was detected	ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)
3112	SeafkoAgent.exe	Potential Corporate Privacy Violation	ET POLICY Possible External IP Lookup SSL Cert Observed (ipinfo.io)
1048	svchost.exe	Not Suspicious Traffic	ET INFO Observed Free Hosting Domain (*.000webhostapp .com in DNS Lookup)
3112	SeafkoAgent.exe	Not Suspicious Traffic	ET INFO Observed SSL Cert for Free Hosting Domain (*.000webhostapp .com)

Add for printing

Process	Message
SeafkoAgent.exe	* HR originated: -2147024774 * Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
SeafkoAgent.exe	* HR propagated: -2147024774 * Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144

General Info

Windows 7 Activator Reloaded [Team Rjaa].zip

4FD8D270F84C4D4323FF4C20BF29D2C5

9604C38D673B4BB6CCACB9242B8FA5CC3C7F0748

0B9EE7718817A386DE36EB1CA34EF78E81E3761FE63097E245C613FDF994C90B

196608:dEyaJJRbr2POiWWD4wWxju+OMmjkU8m5zgq:za/RmPOD4au+OTjkURgq

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Changes the autorun value in the registry

Application was dropped or rewritten from another process

Changes settings of System certificates

SUSPICIOUS

Executable content was dropped or overwritten

Creates executable files which already exist in Windows

Creates files in the user directory

Executed as Windows Service

Adds / modifies Windows certificates

Checks for external IP

Executes application which crashes

INFO

Manual execution by user

Reads settings of System Certificates

Malware configuration

Static information

TRiD

EXIF

ZIP

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings