File name:

GOCLEAN SAMPLE (2).zip

Full analysis: https://app.any.run/tasks/a1159c65-2df1-49f9-886d-b15507528a1d
Verdict: Malicious activity
Analysis date: August 07, 2020, 00:06:15
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

8ED2ECDAC7AEC5332B5A992EAE0B3D8F

SHA1:

F08E40531DB1DDB21DD224DBE59B5C8925C870FD

SHA256:

0C215B7BE57AC955A45E630784C0E61E4FEDAA5FA87178ADD6CBEF1FBECE91FB

SSDEEP:

49152:ZRQzi5i9hIpIBvg95YtmE1Xzul4yN6ke7l2pfnUYlOtX:vkjbIpIBvggtmGc4yNppZqX

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • GoClean.exe (PID: 3900)
      • GoClean.exe (PID: 3524)
      • GoCleanUp.exe (PID: 2956)
      • GoClean.exe (PID: 1728)
      • GoCleanUp.exe (PID: 2672)
      • GoClean.exe (PID: 1248)

    • Changes settings of System certificates

      • GoClean.exe (PID: 3900)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2660)

    • Reads Internet Cache Settings

      • GoClean.exe (PID: 3900)
      • GoCleanUp.exe (PID: 2672)
      • GoClean.exe (PID: 1728)

    • Creates files in the user directory

      • GoClean.exe (PID: 3900)
      • GoClean.exe (PID: 1728)

    • Adds / modifies Windows certificates

      • GoClean.exe (PID: 3900)

    • Starts Internet Explorer

      • GoClean.exe (PID: 3900)

    • Reads internet explorer settings

      • GoClean.exe (PID: 1728)
      • GoClean.exe (PID: 3900)

    • Searches for installed software

      • GoClean.exe (PID: 1728)

  • INFO

    • Changes internet zones settings

      • iexplore.exe (PID: 3656)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3656)
      • GoClean.exe (PID: 1728)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3656)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3656)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2972)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3656)
      • iexplore.exe (PID: 2972)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xpi | Mozilla Firefox browser extension (66.6)
.zip | ZIP compressed archive (33.3)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2020:08:07 08:05:03
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: GOCLEAN SAMPLE/backup/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
55
Monitored processes
9
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start drop and start drop and start drop and start drop and start drop and start start winrar.exe goclean.exe no specs goclean.exe iexplore.exe iexplore.exe gocleanup.exe no specs gocleanup.exe goclean.exe no specs goclean.exe

Process information

PID
CMD
Path
Indicators
Parent process
1248"C:\Users\admin\AppData\Local\Temp\Rar$EXa2660.16417\GOCLEAN SAMPLE\GoClean.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2660.16417\GOCLEAN SAMPLE\GoClean.exe—WinRAR.exe
User:
admin
Company:
고클린
Integrity Level:
MEDIUM
Description:
고클린
Exit code:
3221226540
Version:
1.0.0.1
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2660.16417\goclean sample\goclean.exe
c:\systemroot\system32\ntdll.dll
1728"C:\Users\admin\AppData\Local\Temp\Rar$EXa2660.16417\GOCLEAN SAMPLE\GoClean.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2660.16417\GOCLEAN SAMPLE\GoClean.exe
WinRAR.exe
User:
admin
Company:
고클린
Integrity Level:
HIGH
Description:
고클린
Exit code:
0
Version:
1.0.0.1
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2660.16417\goclean sample\goclean.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\psapi.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
2660"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\GOCLEAN SAMPLE (2).zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2672"C:\Users\admin\AppData\Local\Temp\Rar$EXa2660.14980\GOCLEAN SAMPLE\GoCleanUp.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2660.14980\GOCLEAN SAMPLE\GoCleanUp.exe
WinRAR.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2660.14980\goclean sample\gocleanup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2956"C:\Users\admin\AppData\Local\Temp\Rar$EXa2660.14980\GOCLEAN SAMPLE\GoCleanUp.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2660.14980\GOCLEAN SAMPLE\GoCleanUp.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2660.14980\goclean sample\gocleanup.exe
c:\systemroot\system32\ntdll.dll
2972"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3656 CREDAT:275457 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3524"C:\Users\admin\AppData\Local\Temp\Rar$EXa2660.12924\GOCLEAN SAMPLE\GoClean.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2660.12924\GOCLEAN SAMPLE\GoClean.exe—WinRAR.exe
User:
admin
Company:
고클린
Integrity Level:
MEDIUM
Description:
고클린
Exit code:
3221226540
Version:
1.0.0.1
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2660.12924\goclean sample\goclean.exe
c:\systemroot\system32\ntdll.dll
3656"C:\Program Files\Internet Explorer\iexplore.exe" http://www.gobest.kr/goclean/goclean-ad-new.htmC:\Program Files\Internet Explorer\iexplore.exe
GoClean.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3900"C:\Users\admin\AppData\Local\Temp\Rar$EXa2660.12924\GOCLEAN SAMPLE\GoClean.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2660.12924\GOCLEAN SAMPLE\GoClean.exe
WinRAR.exe
User:
admin
Company:
고클린
Integrity Level:
HIGH
Description:
고클린
Exit code:
2
Version:
1.0.0.1
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2660.12924\goclean sample\goclean.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\psapi.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
Total events
1 787
Read events
1 629
Write events
153
Delete events
5

Modification events

(PID) Process:(2660) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2660) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2660) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\134\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2660) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\134\52C64B7E
Operation:writeName:@C:\Windows\system32\NetworkExplorer.dll,-1
Value:
Network
(PID) Process:(2660) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\GOCLEAN SAMPLE (2).zip
(PID) Process:(2660) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2660) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2660) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2660) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2660) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\134\52C64B7E
Operation:writeName:@C:\Windows\system32\notepad.exe,-469
Value:
Text Document
Executable files
18
Suspicious files
10
Text files
119
Unknown types
7

Dropped files

PID
Process
Filename
Type
2660WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2660.12924\GOCLEAN SAMPLE\backup\startprog\2020¦G08+·06+--15++33¦-59+-.regtext
MD5:—
SHA256:—
2660WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2660.12924\GOCLEAN SAMPLE\backup\bh\OneNote Lin&ked Notes (Extension_HKLM)\info.dattext
MD5:—
SHA256:—
2660WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2660.12924\GOCLEAN SAMPLE\backup\startprog\2020¦G08+·06+--15++35¦-34+-.regtext
MD5:—
SHA256:—
2660WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2660.12924\GOCLEAN SAMPLE\backup\startprog\2020¦G08+·06+--15++34¦-20+-.regtext
MD5:—
SHA256:—
2660WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2660.12924\GOCLEAN SAMPLE\backup\startprog\2020¦G08+·06+--15++35¦-15+-.regtext
MD5:—
SHA256:—
2660WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2660.12924\GOCLEAN SAMPLE\backup\startprog\2020¦G08+·06+--15++45¦-39+-.regtext
MD5:—
SHA256:—
2660WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2660.12924\GOCLEAN SAMPLE\backup\startprog\Monitor Ink Alerts - LG LIP2250.lnk(lnk).lnklnk
MD5:—
SHA256:—
2660WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2660.12924\GOCLEAN SAMPLE\backup\startprog\2020¦G08+·06+--15++34¦-57+-.regtext
MD5:—
SHA256:—
2660WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2660.12924\GOCLEAN SAMPLE\backup\task\HPLJCustParticipationxml
MD5:—
SHA256:—
2660WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2660.12924\GOCLEAN SAMPLE\backup\task\Lenovo Power Management Driver PnP Taskxml
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
38
TCP/UDP connections
23
DNS requests
12
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3900
GoClean.exe
GET
200
143.204.201.66:80
http://www.gobest.kr/goclean/upversion2.dat
US
text
454 b
whitelisted
3900
GoClean.exe
GET
200
143.204.201.66:80
http://www.gobest.kr/adfile/ad-m-top-147.htm
US
html
3.67 Kb
whitelisted
3900
GoClean.exe
GET
200
143.204.201.66:80
http://www.gobest.kr/adfile/top-2.htm
US
html
1.15 Kb
whitelisted
3900
GoClean.exe
GET
200
172.217.16.131:80
http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D
US
der
468 b
whitelisted
3900
GoClean.exe
GET
200
14.0.115.222:80
http://img.mobon.net/Frtb/common/css/mobon_reset.css?201706292
KR
text
9.73 Kb
suspicious
3900
GoClean.exe
GET
200
14.0.115.222:80
http://img.mobon.net/js/mobonStorage.js
KR
text
9.73 Kb
suspicious
3900
GoClean.exe
GET
200
14.0.115.222:80
http://img.mobon.net/Frtb/common/css/mobon_reset.css?201706292
KR
text
9.73 Kb
suspicious
3900
GoClean.exe
GET
200
14.0.115.222:80
http://img.mobon.net/Frtb/js/frame_default_script_S.js
KR
text
24.2 Kb
suspicious
3900
GoClean.exe
GET
200
14.0.115.222:80
http://img.mobon.net/js/bounceRate.js
KR
text
2.93 Kb
suspicious
3900
GoClean.exe
GET
200
14.0.115.222:80
http://img.mobon.net/js/mobonStorage.js
KR
text
2.93 Kb
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3900
GoClean.exe
143.204.201.66:80
www.gobest.kr
—
US
suspicious
3900
GoClean.exe
172.217.18.14:443
www.google-analytics.com
Google Inc.
US
whitelisted
3900
GoClean.exe
172.217.16.131:80
ocsp.pki.goog
Google Inc.
US
whitelisted
3900
GoClean.exe
119.205.238.29:80
www.mediacategory.com
Korea Telecom
KR
suspicious
3900
GoClean.exe
14.0.115.222:80
img.mobon.net
—
KR
suspicious
2672
GoCleanUp.exe
143.204.201.66:80
www.gobest.kr
—
US
suspicious
1728
GoClean.exe
172.217.18.14:443
www.google-analytics.com
Google Inc.
US
whitelisted
1728
GoClean.exe
143.204.201.66:80
www.gobest.kr
—
US
suspicious
1728
GoClean.exe
119.205.238.29:80
www.mediacategory.com
Korea Telecom
KR
suspicious
1728
GoClean.exe
14.0.115.222:80
img.mobon.net
—
KR
suspicious

DNS requests

Domain
IP
Reputation
www.gobest.kr
  • 143.204.201.66
  • 143.204.201.9
  • 143.204.201.106
  • 143.204.201.38
whitelisted
www.google-analytics.com
  • 172.217.18.14
whitelisted
www.mediacategory.com
  • 119.205.238.29
suspicious
ocsp.pki.goog
  • 172.217.16.131
whitelisted
img.mobon.net
  • 14.0.115.222
  • 14.0.113.209
  • 14.0.115.220
  • 14.0.113.205
  • 14.0.113.206
suspicious
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
GOCLEAN SAMPLE (2).zip