analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

tf2game.zip

Full analysis: https://app.any.run/tasks/bbdd7626-af1e-4bc8-a9ce-4e93165f5ffd
Verdict: Malicious activity
Analysis date: January 14, 2022, 20:42:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

1E90F32671037A25894B21037F00619B

SHA1:

6D0CD472AE61D9366162A30DF7BDB6109ECAD858

SHA256:

10CF455D7B1863F8AA40E0E8355326961EA28E3F9D362C8448408C7B7039EE2A

SSDEEP:

6144:/DjamHy7qfanG++ySOd5621pMZxJ0NYtimyD/7/S2Dy596R6X//TYWqW:/D3KqfanGhgLvw0NYtHyPM596R6XwW

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • WinRAR.exe (PID: 3336)

    • Application was dropped or rewritten from another process

      • setup.exe (PID: 2788)
      • setup.exe (PID: 1084)

  • SUSPICIOUS

    • Reads the computer name

      • WinRAR.exe (PID: 3336)
      • setup.exe (PID: 2788)
      • dfsvc.exe (PID: 420)
      • setup.exe (PID: 1084)

    • Checks supported languages

      • WinRAR.exe (PID: 3336)
      • setup.exe (PID: 2788)
      • setup.exe (PID: 1084)
      • dfsvc.exe (PID: 420)

    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 3336)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3336)
      • setup.exe (PID: 2788)
      • setup.exe (PID: 1084)

    • Drops a file that was compiled in debug mode

      • WinRAR.exe (PID: 3336)
      • setup.exe (PID: 2788)
      • setup.exe (PID: 1084)

    • Uses RUNDLL32.EXE to load library

      • WinRAR.exe (PID: 3336)

  • INFO

    • Reads settings of System Certificates

      • setup.exe (PID: 2788)
      • setup.exe (PID: 1084)

    • Checks Windows Trust Settings

      • setup.exe (PID: 2788)
      • setup.exe (PID: 1084)

    • Checks supported languages

      • rundll32.exe (PID: 496)

    • Reads the computer name

      • rundll32.exe (PID: 496)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2019:08:30 22:18:16
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: tf2game/Application Files/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
5
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
drop and start drop and start start winrar.exe setup.exe rundll32.exe no specs dfsvc.exe setup.exe

Process information

PID
CMD
Path
Indicators
Parent process
3336"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\tf2game.zip"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
2788"C:\Users\admin\AppData\Local\Temp\Rar$EXa3336.9343\tf2game\setup.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3336.9343\tf2game\setup.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup
Exit code:
1603
Version:
16.0.28315.86 built by: D16.0
496"rundll32.exe" dfshim.dll,ShOpenVerbApplication C:\Users\admin\AppData\Local\Temp\Rar$DIa3336.10851\tf2game.applicationC:\Windows\system32\rundll32.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
420"C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe
rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
ClickOnce
Version:
4.0.30319.34209 built by: FX452RTMGDR
1084"C:\Users\admin\AppData\Local\Temp\Rar$EXa3336.12920\tf2game\setup.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3336.12920\tf2game\setup.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup
Version:
16.0.28315.86 built by: D16.0
Total events
10 230
Read events
10 101
Write events
0
Delete events
0

Modification events

No data
Executable files
9
Suspicious files
7
Text files
11
Unknown types
4

Dropped files

PID
Process
Filename
Type
3336WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3336.9343\tf2game\tf2game.applicationxml
MD5:94620FB8D57AA76DBA5BDC3485087680
SHA256:286B98A0383C5F26684F881B04C3426BBD79BFAE86DBD50ADC69CB63C374756E
3336WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3336.9343\tf2game\Application Files\tf2game_1_0_0_0\tf2game.exe.deployexecutable
MD5:1D6101202E0A6AE65D2C3D6CEA7AE07E
SHA256:2DF0E11FD459D8B61F8D807D25C84DF9806391E212047F91CA1567A8A5AE0EC3
2788setup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:36C32062275E4942A7E4302AFF140C82
SHA256:1D3718303F21273F93C9CFAF2A358FC50F7F4FCC4AA976B78EF48DD91353B6A7
3336WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3336.9343\tf2game\Application Files\tf2game_1_0_0_0\tf2game.exe.manifestxml
MD5:B97A86C9E9A1EF7FCCA975C003452850
SHA256:5839143A6ED4D5E29E4E17BF11F9493C3983FB2EA4FFC40AE2ED3815A18E635B
2788setup.exeC:\Users\admin\AppData\Local\Temp\VSD3842.tmp\setup.exeexecutable
MD5:5ED8ADD314751F70F0711BDCCF07BFC3
SHA256:2598A03B3166AF2EA55AD781BAC7F847AB73ABD314E1DEFFA921426546B5B671
2788setup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\37C951188967C8EB88D99893D9D191FEder
MD5:7C13E2B4F2780CDDE5523C304CCA5015
SHA256:365F401AA9ABC00197C525989E6BD1DD131FC009EC547AC6230EFC83ADF6713B
2788setup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776binary
MD5:E74CACC4E2B6A95356CF0166FEC97E47
SHA256:A0C8A46FA851491BA6719E086B0366E4FB2361243358DBAE4013A8AF68666285
2788setup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776der
MD5:ACE427D9E2E5197DA2F600C887DCFCB1
SHA256:9D985EC5E3675B2C7DED4535F7DE2CBE39934D67046E25C3D0466220FAFE9651
3336WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3336.9343\tf2game\Application Files\tf2game_1_0_0_0\tf2game.applicationxml
MD5:94620FB8D57AA76DBA5BDC3485087680
SHA256:286B98A0383C5F26684F881B04C3426BBD79BFAE86DBD50ADC69CB63C374756E
420dfsvc.exeC:\Users\admin\AppData\Local\Temp\Deployment\5M4GJRWR.YQX\GRCYCNVX.0GJ.applicationxml
MD5:94620FB8D57AA76DBA5BDC3485087680
SHA256:286B98A0383C5F26684F881B04C3426BBD79BFAE86DBD50ADC69CB63C374756E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
8
DNS requests
8
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2788
setup.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
2788
setup.exe
GET
302
104.89.38.104:80
http://go.microsoft.com/fwlink/?LinkId=863258&clcid=0x405
NL
—
—
whitelisted
1084
setup.exe
GET
302
104.89.38.104:80
http://go.microsoft.com/fwlink/?LinkId=863258&clcid=0x405
NL
—
—
whitelisted
2788
setup.exe
GET
302
104.89.38.104:80
http://go.microsoft.com/fwlink/?LinkId=863258&clcid=0x405
NL
—
—
whitelisted
2788
setup.exe
GET
302
104.89.38.104:80
http://go.microsoft.com/fwlink/?LinkId=863258&clcid=0x405
NL
—
—
whitelisted
2788
setup.exe
GET
200
92.123.194.163:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
der
1.11 Kb
whitelisted
2788
setup.exe
GET
200
104.79.89.142:80
http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl
US
der
1.05 Kb
whitelisted
2788
setup.exe
GET
302
104.89.38.104:80
http://go.microsoft.com/fwlink/?LinkId=863258&clcid=0x405
NL
—
—
whitelisted
2788
setup.exe
GET
200
104.79.89.142:80
http://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt
US
der
1.87 Kb
whitelisted
2788
setup.exe
GET
200
8.241.78.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?106f60eccc60ab4c
US
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2788
setup.exe
68.232.34.200:443
download.visualstudio.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2788
setup.exe
104.79.89.142:80
www.microsoft.com
Time Warner Cable Internet LLC
US
unknown
2788
setup.exe
104.89.38.104:80
go.microsoft.com
Akamai Technologies, Inc.
NL
malicious
2788
setup.exe
8.241.78.254:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
suspicious
2788
setup.exe
92.123.194.163:80
crl.microsoft.com
Akamai International B.V.
—
suspicious
2788
setup.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
1084
setup.exe
104.89.38.104:80
go.microsoft.com
Akamai Technologies, Inc.
NL
malicious

DNS requests

Domain
IP
Reputation
go.microsoft.com
  • 104.89.38.104
whitelisted
download.visualstudio.microsoft.com
  • 68.232.34.200
whitelisted
ctldl.windowsupdate.com
  • 8.241.78.254
  • 67.27.157.254
  • 8.253.207.120
  • 67.27.233.126
  • 8.248.133.254
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
www.microsoft.com
  • 104.79.89.142
whitelisted
crl.microsoft.com
  • 92.123.194.163
  • 92.123.194.162
whitelisted

Threats

No threats detected
Process
Message
dfsvc.exe
*** Status originated: -1073741811 *** Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
dfsvc.exe
*** Status originated: -1073741811 *** Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
tf2game.zip