| download: | /CryptoNickSoft/7z-SFX-Constructor/raw/master/upd/7zSFX%20Constructor.7z |
| Full analysis: | https://app.any.run/tasks/778bc258-051e-4dee-9c4a-19d0e87bf832 |
| Verdict: | Malicious activity |
| Analysis date: | April 13, 2025, 15:07:59 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-7z-compressed |
| File info: | 7-zip archive data, version 0.4 |
| MD5: | D1D742B063729E155DCBC15822178647 |
| SHA1: | 60140553FBF80854E0807569958C742E3F8B6607 |
| SHA256: | 1060C7742E6883F4845D0B81D51A6957523C1C91B579A6BD7232F146982F0D5B |
| SSDEEP: | 98304:/o91ukS5l6A0w4wiSjhKxIGeju+J6hvVRFfiDANk7j6HHVPr6CEqVyszmM7lM7O+:EEQAGekj1gVlcri4iiA |
MALICIOUS
Generic archive extractor
- WinRAR.exe (PID: 2840)
Executing a file with an untrusted certificate
- 7zSFX_Constructor.exe (PID: 312)
- 7zSFX_Constructor.exe (PID: 568)
- 7zSFX_Constructor.exe (PID: 3224)
SUSPICIOUS
Executable content was dropped or overwritten
- 7zSFX_Constructor.exe (PID: 568)
- 7zSFX_Constructor.exe (PID: 3224)
- xcopy.exe (PID: 3108)
- ap14.dat (PID: 3276)
Drops 7-zip archiver for unpacking
- 7zSFX_Constructor.exe (PID: 568)
- 7zSFX_Constructor.exe (PID: 3224)
- xcopy.exe (PID: 3108)
Reads the Internet Settings
- 7zSFX_Constructor.exe (PID: 568)
- 7zSFX_Constructor.exe (PID: 3224)
Reads security settings of Internet Explorer
- 7zSFX_Constructor.exe (PID: 568)
Starts CMD.EXE for commands execution
- 7zSFX_Constructor.exe (PID: 568)
Starts the AutoIt3 executable file
- 7zSFX_Constructor.exe (PID: 3224)
Starts application with an unusual extension
- 7zSFX_Constructor.exe (PID: 3224)
There is functionality for taking screenshot (YARA)
- 7zSFX_Constructor.exe (PID: 3224)
Reads the Windows owner or organization settings
- 7zSFX_Constructor.exe (PID: 3224)
INFO
Executable content was dropped or overwritten
- WinRAR.exe (PID: 2840)
Checks supported languages
- 7zSFX_Constructor.exe (PID: 312)
- 7zSFX_Constructor.exe (PID: 568)
- 7zSFX_Constructor.exe (PID: 3224)
- ap30.dat (PID: 2780)
- ap30.dat (PID: 3668)
- ap14.dat (PID: 3276)
- ap10.dat (PID: 3184)
Manual execution by a user
- cmd.exe (PID: 2568)
- cmd.exe (PID: 672)
- 7zSFX_Constructor.exe (PID: 3224)
Create files in a temporary directory
- 7zSFX_Constructor.exe (PID: 568)
The sample compiled with english language support
- 7zSFX_Constructor.exe (PID: 568)
- xcopy.exe (PID: 3108)
- 7zSFX_Constructor.exe (PID: 3224)
The sample compiled with turkish language support
- 7zSFX_Constructor.exe (PID: 568)
- xcopy.exe (PID: 3108)
The sample compiled with russian language support
- 7zSFX_Constructor.exe (PID: 568)
- xcopy.exe (PID: 3108)
Reads the computer name
- 7zSFX_Constructor.exe (PID: 568)
- ap30.dat (PID: 2780)
- ap30.dat (PID: 3668)
- 7zSFX_Constructor.exe (PID: 3224)
- ap10.dat (PID: 3184)
Creates a new folder
- cmd.exe (PID: 3076)
Creates files in the program directory
- cmd.exe (PID: 3076)
- xcopy.exe (PID: 2952)
- cmd.exe (PID: 2652)
- xcopy.exe (PID: 3108)
- ap30.dat (PID: 2780)
- ap14.dat (PID: 3276)
- 7zSFX_Constructor.exe (PID: 3224)
- ap10.dat (PID: 3184)
Creates files or folders in the user directory
- 7zSFX_Constructor.exe (PID: 568)
- 7zSFX_Constructor.exe (PID: 3224)
Reads mouse settings
- ap14.dat (PID: 3276)
The process uses Lua
- 7zSFX_Constructor.exe (PID: 3224)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .7z | | | 7-Zip compressed archive (v0.4) (57.1) |
|---|---|---|
| .7z | | | 7-Zip compressed archive (gen) (42.8) |
EXIF
ZIP
| FileVersion: | 7z v0.04 |
|---|---|
| ModifyDate: | 2018:12:09 11:50:31+00:00 |
| ArchivedFileName: | APPS |
Total processes
66
Monitored processes
21
Malicious processes
2
Suspicious processes
2
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 312 | "7zSFX_Constructor.exe" /h | C:\Users\admin\Desktop\7zSFX_Constructor.exe | — | cmd.exe | |||||||||||
User: admin Company: CryptoNick Integrity Level: MEDIUM Description: 7z SFX Constructor Exit code: 0 Version: 4.5.0.0 Modules
| |||||||||||||||
| 568 | 7zSFX_Constructor.exe -aiS | C:\Users\admin\Desktop\7zSFX_Constructor.exe | cmd.exe | ||||||||||||
User: admin Company: CryptoNick Integrity Level: MEDIUM Description: 7z SFX Constructor Exit code: 0 Version: 4.5.0.0 Modules
| |||||||||||||||
| 672 | C:\Windows\system32\cmd.exe /c ""C:\Users\admin\Desktop\Install.cmd" " | C:\Windows\System32\cmd.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 988 | "C:\Windows\System32\cmd.exe" /c if not exist "C:\ProgramData\7zSFX_Constructor\APPS\Settings\Sert.pfx.old" (copy /y "C:\ProgramData\7zSFX_Constructor\APPS\Sert\Sert.pfx" "C:\ProgramData\7zSFX_Constructor\APPS\Sert\Sert.pfx.old") | C:\Windows\System32\cmd.exe | — | 7zSFX_Constructor.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 1268 | "C:\Windows\System32\cmd.exe" /c if not exist "C:\ProgramData\7zSFX_Constructor\APPS\Settings\Sert.cer.old" (copy /y "C:\ProgramData\7zSFX_Constructor\APPS\Sert\Sert.cer" "C:\ProgramData\7zSFX_Constructor\APPS\Sert\Sert.cer.old") | C:\Windows\System32\cmd.exe | — | 7zSFX_Constructor.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 1996 | "C:\Windows\System32\cmd.exe" /c if not exist "C:\ProgramData\7zSFX_Constructor\APPS\Settings\Settings.old" (copy /y "C:\ProgramData\7zSFX_Constructor\APPS\Settings\Settings.cfg" "C:\ProgramData\7zSFX_Constructor\APPS\Settings\Settings.old") | C:\Windows\System32\cmd.exe | — | 7zSFX_Constructor.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2464 | "C:\Windows\System32\cmd.exe" /c xcopy "C:\Users\admin\Desktop\APPS" "C:\ProgramData\7zSFX_Constructor\APPS" /c /i /s /e /r /h /y | C:\Windows\System32\cmd.exe | — | 7zSFX_Constructor.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2568 | C:\Windows\system32\cmd.exe /c ""C:\Users\admin\Desktop\Help.cmd" " | C:\Windows\System32\cmd.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2604 | "C:\Windows\System32\cmd.exe" /c if not exist "C:\ProgramData\7zSFX_Constructor\APPS\Settings\VerIcon.old" (copy /y "C:\ProgramData\7zSFX_Constructor\APPS\Settings\VerIcon.dll" "C:\ProgramData\7zSFX_Constructor\APPS\Settings\VerIcon.old") | C:\Windows\System32\cmd.exe | — | 7zSFX_Constructor.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2652 | "C:\Windows\System32\cmd.exe" /c @echo Install Date: %date%>>"C:\ProgramData\7zSFX_Constructor\Install.log" | C:\Windows\System32\cmd.exe | — | 7zSFX_Constructor.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
Total events
5 188
Read events
5 140
Write events
35
Delete events
13
Modification events
| (PID) Process: | (2840) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (2840) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (2840) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (2840) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 3 |
Value: C:\Users\admin\Desktop\Win7-KB3191566-x86.zip | |||
| (PID) Process: | (2840) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip | |||
| (PID) Process: | (2840) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\omni_23_10_2024_.zip | |||
| (PID) Process: | (2840) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\778bc258-051e-4dee-9c4a-19d0e87bf832.7z | |||
| (PID) Process: | (2840) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (2840) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (2840) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
Executable files
69
Suspicious files
158
Text files
314
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2840 | WinRAR.exe | C:\Users\admin\Desktop\APPS\Icon\04.ico | image | |
MD5:7FB4DA969F150C834A3B4DE251E27928 | SHA256:47C7D32CE8F8BB3C1751551EC7C62E8A1F851D0853A004653387C92140C54EA6 | |||
| 2840 | WinRAR.exe | C:\Users\admin\Desktop\APPS\Changelog.txt | text | |
MD5:A42B1D33FC08C288477B38ACD696430F | SHA256:007D561CFB13F6914FE37AA2DCD1412A9BB1C38D9526489AB3271A3D96F2D07E | |||
| 2840 | WinRAR.exe | C:\Users\admin\Desktop\APPS\Icon\08.ico | image | |
MD5:38DFDD10BC80F987BE67A5FB0C553B7D | SHA256:7F48F3E63AE9BE28ED4A8FFBB0217C67B0C32C74C5628B4764719A810DB388D0 | |||
| 2840 | WinRAR.exe | C:\Users\admin\Desktop\APPS\Icon\101.ico | image | |
MD5:1705BCCAE5C5A08D9273BCDEA7853565 | SHA256:582542657D66CB5DD5E009995254FF3CDB8BF0C624EA849E1662DA28E31BD217 | |||
| 2840 | WinRAR.exe | C:\Users\admin\Desktop\APPS\Icon\7z-silver.ico | binary | |
MD5:7477876E3A472A2E30881AEB75549793 | SHA256:344F32B59A209E31D1451659690AC8CC14132A31F27B8F005C45A203D3142A2D | |||
| 2840 | WinRAR.exe | C:\Users\admin\Desktop\APPS\Icon\05.ico | image | |
MD5:7935317E09A754BD1D7AB8E20A8550CE | SHA256:1ECDE30857AC47F3AB1C58D302F435F0E99598AC0140CCBD6CE4C4E1A302424F | |||
| 2840 | WinRAR.exe | C:\Users\admin\Desktop\APPS\Icon\07.ico | image | |
MD5:1FF38F61C271CC99B67655CD9B004239 | SHA256:B264602D8348EF5538F7D8ACB9ACDF90A88C84A75E13D83E3BBACBE7CDA660F1 | |||
| 2840 | WinRAR.exe | C:\Users\admin\Desktop\APPS\Icon\138.ico | image | |
MD5:F42C6A54594B38EA0C43210D53EA1654 | SHA256:8FA77E2DE8774D0DCF247D4DFAF08820D7273C7AFA5979BA45BBF2B19748AB89 | |||
| 2840 | WinRAR.exe | C:\Users\admin\Desktop\APPS\Icon\09.ico | binary | |
MD5:C48D18018157B6C25CF38A78E0C7E742 | SHA256:991F627239A110744C30E8BE8A447C7C9B10913D9B96AEE7F50B01ECC5DD4292 | |||
| 2840 | WinRAR.exe | C:\Users\admin\Desktop\APPS\Icon\22.ico | binary | |
MD5:4C77C30650E4C5EC389980129C82A095 | SHA256:A229C336F4FC0E64E662E1200EA327716F35BF6928F2C9E59BA39B67BC3A616F | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
6
DNS requests
1
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 224.0.0.252:5355 | — | — | — | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |