File name:

Brontok (2).zip

Full analysis: https://app.any.run/tasks/3cc41aa2-59f1-4dfb-b5cb-32fb548f4545
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Malware Trends Tracker     >>>
Analysis date: July 31, 2023, 23:51:29
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
brontok
trojan
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

745C42DC17137367D55FE2CAC3707E36

SHA1:

081E0841C0FFBEB36C6534B48007795F72E3F3A9

SHA256:

0CC7B2078E97C25E045321E1EE896C2A602A5E80EFC959AC133637864B7F48E4

SSDEEP:

6144:UvwCbNa4hyK5am3q7jjrpAuzR7lmME3sIYj3:bI1yKIma79v7lgYD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 70d98b736c32160617e8e272c2f5b2c10c72789fe40e27ec16f94ffa09394cd7.exe (PID: 1576)
      • smss.exe (PID: 3940)
      • winlogon.exe (PID: 856)
      • services.exe (PID: 540)
      • lsass.exe (PID: 3068)
      • inetinfo.exe (PID: 1484)

    • Changes the login/logoff helper path in the registry

      • 70d98b736c32160617e8e272c2f5b2c10c72789fe40e27ec16f94ffa09394cd7.exe (PID: 1576)
      • smss.exe (PID: 3940)
      • winlogon.exe (PID: 856)
      • services.exe (PID: 540)
      • lsass.exe (PID: 3068)
      • inetinfo.exe (PID: 1484)

    • Changes appearance of the Explorer extensions

      • 70d98b736c32160617e8e272c2f5b2c10c72789fe40e27ec16f94ffa09394cd7.exe (PID: 1576)
      • smss.exe (PID: 3940)
      • winlogon.exe (PID: 856)
      • services.exe (PID: 540)
      • inetinfo.exe (PID: 1484)
      • lsass.exe (PID: 3068)

    • Changes the autorun value in the registry

      • smss.exe (PID: 3940)
      • winlogon.exe (PID: 856)
      • services.exe (PID: 540)
      • inetinfo.exe (PID: 1484)
      • lsass.exe (PID: 3068)

    • Modify registry editing tools (regedit)

      • smss.exe (PID: 3940)
      • winlogon.exe (PID: 856)
      • services.exe (PID: 540)
      • lsass.exe (PID: 3068)
      • inetinfo.exe (PID: 1484)

    • Creates a writable file the system directory

      • smss.exe (PID: 3940)
      • inetinfo.exe (PID: 1484)

    • Create files in the Startup directory

      • smss.exe (PID: 3940)

    • BRONTOK was detected

      • inetinfo.exe (PID: 1484)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 70d98b736c32160617e8e272c2f5b2c10c72789fe40e27ec16f94ffa09394cd7.exe (PID: 1576)
      • smss.exe (PID: 3940)
      • inetinfo.exe (PID: 1484)

    • Creates executable files that already exist in Windows

      • 70d98b736c32160617e8e272c2f5b2c10c72789fe40e27ec16f94ffa09394cd7.exe (PID: 1576)

    • The process creates files with name similar to system file names

      • 70d98b736c32160617e8e272c2f5b2c10c72789fe40e27ec16f94ffa09394cd7.exe (PID: 1576)

    • Starts itself from another location

      • 70d98b736c32160617e8e272c2f5b2c10c72789fe40e27ec16f94ffa09394cd7.exe (PID: 1576)
      • smss.exe (PID: 3940)

    • Creates files in the driver directory

      • inetinfo.exe (PID: 1484)

    • Reads the Internet Settings

      • inetinfo.exe (PID: 1484)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2312)

    • Checks supported languages

      • 70d98b736c32160617e8e272c2f5b2c10c72789fe40e27ec16f94ffa09394cd7.exe (PID: 1576)
      • smss.exe (PID: 3940)
      • winlogon.exe (PID: 856)
      • services.exe (PID: 540)
      • lsass.exe (PID: 3068)
      • inetinfo.exe (PID: 1484)

    • The process checks LSA protection

      • 70d98b736c32160617e8e272c2f5b2c10c72789fe40e27ec16f94ffa09394cd7.exe (PID: 1576)
      • explorer.exe (PID: 2816)
      • smss.exe (PID: 3940)
      • winlogon.exe (PID: 856)
      • lsass.exe (PID: 3068)
      • at.exe (PID: 2076)
      • services.exe (PID: 540)
      • at.exe (PID: 1396)
      • inetinfo.exe (PID: 1484)

    • Reads the machine GUID from the registry

      • 70d98b736c32160617e8e272c2f5b2c10c72789fe40e27ec16f94ffa09394cd7.exe (PID: 1576)
      • smss.exe (PID: 3940)
      • winlogon.exe (PID: 856)
      • services.exe (PID: 540)
      • lsass.exe (PID: 3068)
      • inetinfo.exe (PID: 1484)

    • Create files in a temporary directory

      • 70d98b736c32160617e8e272c2f5b2c10c72789fe40e27ec16f94ffa09394cd7.exe (PID: 1576)
      • smss.exe (PID: 3940)
      • winlogon.exe (PID: 856)
      • services.exe (PID: 540)
      • lsass.exe (PID: 3068)
      • inetinfo.exe (PID: 1484)

    • Manual execution by a user

      • 70d98b736c32160617e8e272c2f5b2c10c72789fe40e27ec16f94ffa09394cd7.exe (PID: 1576)

    • Reads the computer name

      • 70d98b736c32160617e8e272c2f5b2c10c72789fe40e27ec16f94ffa09394cd7.exe (PID: 1576)
      • smss.exe (PID: 3940)
      • winlogon.exe (PID: 856)
      • services.exe (PID: 540)
      • lsass.exe (PID: 3068)
      • inetinfo.exe (PID: 1484)

    • Creates files or folders in the user directory

      • 70d98b736c32160617e8e272c2f5b2c10c72789fe40e27ec16f94ffa09394cd7.exe (PID: 1576)
      • smss.exe (PID: 3940)

    • Checks proxy server information

      • inetinfo.exe (PID: 1484)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: 18aa10fd9b9bf66546b7d28eba2d21ea60becb4eaa8c5ef805a5e28471907f58.exe
ZipUncompressedSize: 422400
ZipCompressedSize: 183227
ZipCRC: 0x0fe3369f
ZipModifyDate: 2023:07:31 23:42:42
ZipCompression: Deflated
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
53
Monitored processes
10
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start winrar.exe 70d98b736c32160617e8e272c2f5b2c10c72789fe40e27ec16f94ffa09394cd7.exe explorer.exe no specs smss.exe winlogon.exe at.exe no specs services.exe at.exe no specs lsass.exe #BRONTOK inetinfo.exe

Process information

PID
CMD
Path
Indicators
Parent process
540C:\Users\admin\AppData\Local\services.exeC:\Users\admin\AppData\Local\services.exe
smss.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\services.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
856C:\Users\admin\AppData\Local\winlogon.exeC:\Users\admin\AppData\Local\winlogon.exe
smss.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\winlogon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\lpk.dll
c:\windows\system32\advapi32.dll
1396at 17:08 /every:M,T,W,Th,F,S,Su "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\Brengkolang.com"C:\Windows\System32\at.exe—smss.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Schedule service command line interface
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\at.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\netutils.dll
c:\windows\system32\schedcli.dll
1484C:\Users\admin\AppData\Local\inetinfo.exeC:\Users\admin\AppData\Local\inetinfo.exe
smss.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\inetinfo.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\usp10.dll
1576"C:\Users\admin\Desktop\70d98b736c32160617e8e272c2f5b2c10c72789fe40e27ec16f94ffa09394cd7.exe" C:\Users\admin\Desktop\70d98b736c32160617e8e272c2f5b2c10c72789fe40e27ec16f94ffa09394cd7.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\desktop\70d98b736c32160617e8e272c2f5b2c10c72789fe40e27ec16f94ffa09394cd7.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\msvcrt.dll
2076at /delete /yC:\Windows\System32\at.exe—smss.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Schedule service command line interface
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\at.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\netutils.dll
c:\windows\system32\sechost.dll
c:\windows\system32\schedcli.dll
2312"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Brontok (2).zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\winrar\winrar.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\shlwapi.dll
2816explorer.exeC:\Windows\explorer.exe—70d98b736c32160617e8e272c2f5b2c10c72789fe40e27ec16f94ffa09394cd7.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
3068C:\Users\admin\AppData\Local\lsass.exeC:\Users\admin\AppData\Local\lsass.exe
smss.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\lsass.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
3940C:\Users\admin\AppData\Local\smss.exeC:\Users\admin\AppData\Local\smss.exe
70d98b736c32160617e8e272c2f5b2c10c72789fe40e27ec16f94ffa09394cd7.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\smss.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
Total events
2 358
Read events
2 123
Write events
235
Delete events
0

Modification events

(PID) Process:(2312) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\178\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2312) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2312) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2312) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(2312) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2312) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2312) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2312) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2312) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
(PID) Process:(2312) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\General
Operation:writeName:LastFolder
Value:
C:\Users\admin\Desktop
Executable files
14
Suspicious files
3
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
2312WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2312.48651\18aa10fd9b9bf66546b7d28eba2d21ea60becb4eaa8c5ef805a5e28471907f58.exeexecutable
MD5:C3C39477FB30CEF3479B38DF479EE032
SHA256:18AA10FD9B9BF66546B7D28EBA2D21EA60BECB4EAA8C5EF805A5E28471907F58
157670d98b736c32160617e8e272c2f5b2c10c72789fe40e27ec16f94ffa09394cd7.exeC:\Windows\ShellNew\sempalong.exeexecutable
MD5:483FCF432217D71544246AA760D98CDC
SHA256:70D98B736C32160617E8E272C2F5B2C10C72789FE40E27EC16F94FFA09394CD7
157670d98b736c32160617e8e272c2f5b2c10c72789fe40e27ec16f94ffa09394cd7.exeC:\Users\admin\AppData\Local\smss.exeexecutable
MD5:483FCF432217D71544246AA760D98CDC
SHA256:70D98B736C32160617E8E272C2F5B2C10C72789FE40E27EC16F94FFA09394CD7
157670d98b736c32160617e8e272c2f5b2c10c72789fe40e27ec16f94ffa09394cd7.exeC:\Windows\eksplorasi.exeexecutable
MD5:483FCF432217D71544246AA760D98CDC
SHA256:70D98B736C32160617E8E272C2F5B2C10C72789FE40E27EC16F94FFA09394CD7
157670d98b736c32160617e8e272c2f5b2c10c72789fe40e27ec16f94ffa09394cd7.exeC:\Users\admin\AppData\Local\services.exeexecutable
MD5:483FCF432217D71544246AA760D98CDC
SHA256:70D98B736C32160617E8E272C2F5B2C10C72789FE40E27EC16F94FFA09394CD7
157670d98b736c32160617e8e272c2f5b2c10c72789fe40e27ec16f94ffa09394cd7.exeC:\Users\admin\AppData\Local\lsass.exeexecutable
MD5:483FCF432217D71544246AA760D98CDC
SHA256:70D98B736C32160617E8E272C2F5B2C10C72789FE40E27EC16F94FFA09394CD7
157670d98b736c32160617e8e272c2f5b2c10c72789fe40e27ec16f94ffa09394cd7.exeC:\Users\admin\AppData\Local\inetinfo.exeexecutable
MD5:483FCF432217D71544246AA760D98CDC
SHA256:70D98B736C32160617E8E272C2F5B2C10C72789FE40E27EC16F94FFA09394CD7
2312WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2312.48651\70d98b736c32160617e8e272c2f5b2c10c72789fe40e27ec16f94ffa09394cd7.exeexecutable
MD5:483FCF432217D71544246AA760D98CDC
SHA256:70D98B736C32160617E8E272C2F5B2C10C72789FE40E27EC16F94FFA09394CD7
157670d98b736c32160617e8e272c2f5b2c10c72789fe40e27ec16f94ffa09394cd7.exeC:\Users\admin\AppData\Local\csrss.exeexecutable
MD5:483FCF432217D71544246AA760D98CDC
SHA256:70D98B736C32160617E8E272C2F5B2C10C72789FE40E27EC16F94FFA09394CD7
1484inetinfo.exeC:\Windows\System32\drivers\etc\hosts-Denied By-admin.comexecutable
MD5:483FCF432217D71544246AA760D98CDC
SHA256:70D98B736C32160617E8E272C2F5B2C10C72789FE40E27EC16F94FFA09394CD7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
7
DNS requests
6
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1484
inetinfo.exe
GET
—
34.225.127.72:80
http://www.geocities.com/sbllro2/Host12.txt
US
—
—
malicious
1484
inetinfo.exe
GET
301
34.225.127.72:80
http://www.geocities.com/sbllro2/IN12OLPDORUR.txt
US
html
4.31 Kb
malicious
1484
inetinfo.exe
GET
301
54.161.105.65:80
http://yahoo.com/
US
html
4.28 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2720
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
1484
inetinfo.exe
34.225.127.72:80
www.geocities.com
AMAZON-AES
US
malicious
1484
inetinfo.exe
54.161.105.65:80
www.geocities.com
AMAZON-AES
US
malicious
1484
inetinfo.exe
87.248.100.215:80
www.yahoo.com
Yahoo! UK Services Limited
IE
malicious
1484
inetinfo.exe
87.248.100.216:80
www.yahoo.com
Yahoo! UK Services Limited
IE
malicious

DNS requests

Domain
IP
Reputation
www.geocities.com
  • 34.225.127.72
  • 54.161.105.65
  • 74.6.136.150
  • 124.108.115.100
  • 106.10.248.150
  • 98.136.103.23
  • 212.82.100.150
malicious
yahoo.com
  • 54.161.105.65
  • 98.137.11.164
  • 34.225.127.72
  • 74.6.231.21
  • 74.6.143.26
  • 74.6.143.25
  • 74.6.231.20
  • 98.137.11.163
whitelisted
www.yahoo.com
  • 87.248.100.216
  • 87.248.100.215
whitelisted
dns.msftncsi.com
  • 131.107.255.255
shared
google.com
  • 216.58.206.46
malicious

Threats

PID
Process
Class
Message
1484
inetinfo.exe
A Network Trojan was detected
ET MALWARE Brontok User-Agent Detected (Brontok.A3 Browser)
1484
inetinfo.exe
A Network Trojan was detected
ET MALWARE Brontok User-Agent Detected (Brontok.A3 Browser)
1484
inetinfo.exe
A Network Trojan was detected
ET MALWARE Brontok User-Agent Detected (Brontok.A3 Browser)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Brontok (2).zip