analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| File name: | 241122-ke7rfstlfr_pw_infected.zip |
| Full analysis: | https://app.any.run/tasks/2e9c2149-bd4a-45f2-b380-8bc039b51437 |
| Verdict: | Malicious activity |
| Analysis date: | November 22, 2024 at 08:35:20 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v2.0 to extract, compression method=AES Encrypted |
| MD5: | DE1DDA02A0793892DFB634F1608BB7A2 |
| SHA1: | 898F2144D0706A301458805A0E8CE8FB7DA2E410 |
| SHA256: | 1437A63D1FDFB4C752EA400FE2E970CAAE0B222B130B7FD50EBB38F10290539D |
| SSDEEP: | 393216:gRHznxBTjHbvvMtfd0E5a2x5Xoo6JFRdnbZ6CHGjaXxjbUKW6iiEk3dRdGuV:+HLxBPL655a2x9HCQaXxjba+7Rp |
MALICIOUS
No malicious indicators.SUSPICIOUS
Process drops legitimate windows executable
- photo_for_you.png.exe (PID: 3608)
Executes application which crashes
- pat.exe (PID: 3556)
- pat.exe (PID: 4036)
- pat.exe (PID: 3672)
- pat.exe (PID: 1488)
- pat.exe (PID: 3932)
- pat.exe (PID: 4708)
- pat.exe (PID: 3660)
Process drops python dynamic module
- photo_for_you.png.exe (PID: 3608)
Executable content was dropped or overwritten
- photo_for_you.png.exe (PID: 3608)
The process drops C-runtime libraries
- photo_for_you.png.exe (PID: 3608)
INFO
Reads the computer name
- photo_for_you.png.exe (PID: 3608)
Checks supported languages
- photo_for_you.png.exe (PID: 3608)
Manual execution by a user
- pat.exe (PID: 1488)
- pat.exe (PID: 3672)
- pat.exe (PID: 4708)
- photo_for_you.png.exe (PID: 3608)
- pat.exe (PID: 4036)
- pat.exe (PID: 3556)
- photo_for_you.png.exe (PID: 5780)
- pat.exe (PID: 3660)
- pw.exe (PID: 2356)
- pw.exe (PID: 908)
- photo_for_you.png.exe (PID: 6072)
The process uses the downloaded file
- WinRAR.exe (PID: 1224)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .zip | | | ZIP compressed archive (100) |
|---|
EXIF
ZIP
| ZipFileName: | photo_for_you.png.exe |
|---|---|
| ZipUncompressedSize: | 64592632 |
| ZipCompressedSize: | 61147271 |
| ZipCRC: | 0x00000000 |
| ZipModifyDate: | 1980:00:00 00:00:00 |
| ZipCompression: | Unknown (99) |
| ZipBitFlag: | 0x0009 |
| ZipRequiredVersion: | 20 |
Total processes
149
Monitored processes
29
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1224 | "C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\241122-ke7rfstlfr_pw_infected.zip | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
| 3608 | "C:\Users\admin\Desktop\photo_for_you.png.exe" | C:\Users\admin\Desktop\photo_for_you.png.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: HIGH Description: ilverbulmpp Exit code: 3221225547 Version: 0.1.0 Modules
| |||||||||||||||
| 1812 | C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding | C:\Windows\System32\rundll32.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1488 | "C:\winnit\pat.exe" | C:\winnit\pat.exe | explorer.exe | ||||||||||||
User: admin Company: The Qt Company Ltd. Integrity Level: HIGH Description: Qt Compressed Help File Generator Exit code: 3221226505 Version: 5.15.2.0 Modules
| |||||||||||||||
| 2524 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | pat.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1288 | C:\WINDOWS\system32\WerFault.exe -u -p 1488 -s 88 | C:\Windows\System32\WerFault.exe | pat.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Problem Reporting Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3556 | "C:\winnit\pat.exe" | C:\winnit\pat.exe | explorer.exe | ||||||||||||
User: admin Company: The Qt Company Ltd. Integrity Level: MEDIUM Description: Qt Compressed Help File Generator Exit code: 3221226505 Version: 5.15.2.0 Modules
| |||||||||||||||
| 376 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | pat.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6088 | C:\WINDOWS\system32\WerFault.exe -u -p 3556 -s 572 | C:\Windows\System32\WerFault.exe | pat.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Problem Reporting Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5780 | "C:\Users\admin\Desktop\photo_for_you.png.exe" | C:\Users\admin\Desktop\photo_for_you.png.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: HIGH Description: ilverbulmpp Exit code: 3221225547 Version: 0.1.0 Modules
| |||||||||||||||
Total events
30 202
Read events
30 165
Write events
28
Delete events
9
Modification events
| (PID) Process: | (1224) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 3 |
Value: C:\Users\admin\Desktop\preferences.zip | |||
| (PID) Process: | (1224) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\chromium_ext.zip | |||
| (PID) Process: | (1224) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\omni_23_10_2024_.zip | |||
| (PID) Process: | (1224) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\Desktop\241122-ke7rfstlfr_pw_infected.zip | |||
| (PID) Process: | (1224) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (1224) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (1224) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (1224) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (1224) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface |
| Operation: | write | Name: | ShowPassword |
Value: 0 | |||
| (PID) Process: | (1224) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin |
| Operation: | write | Name: | Placement |
Value: 2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000 | |||
Executable files
148
Suspicious files
870
Text files
1 363
Unknown types
1
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1224 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb1224.37489\photo_for_you.png.exe | — | |
MD5:— | SHA256:— | |||
| 3608 | photo_for_you.png.exe | C:\winnit\wellknows.dll | — | |
MD5:— | SHA256:— | |||
| 3608 | photo_for_you.png.exe | C:\winnit\pw\DLLs\pyc.ico | image | |
MD5:B1C9980131A3F20E344AA3AA2C8DEA49 | SHA256:FDA28A734788A3F175CB6AED4DAEB5F05F0E49F6A272CCD2051BA337F7B3B42F | |||
| 3608 | photo_for_you.png.exe | C:\winnit\vcruntime140.dll | executable | |
MD5:49C96CECDA5C6C660A107D378FDFC3D4 | SHA256:69320F278D90EFAAEB67E2A1B55E5B0543883125834C812C8D9C39676E0494FC | |||
| 3608 | photo_for_you.png.exe | C:\winnit\pw\DLLs\libcrypto-1_1.dll | executable | |
MD5:4633D62F19C0B25318B1C612995F5C21 | SHA256:47376D247AE6033BC30FEE4E52043D3762C1C0C177E3EC27CA46EFF4B95C69B0 | |||
| 3608 | photo_for_you.png.exe | C:\winnit\vcruntime140_1.dll | executable | |
MD5:CF0A1C4776FFE23ADA5E570FC36E39FE | SHA256:6FD366A691ED68430BCD0A3DE3D8D19A0CB2102952BFC140BBEF4354ED082C47 | |||
| 3608 | photo_for_you.png.exe | C:\winnit\Qt5Widgets.dll | executable | |
MD5:4CD1F8FDCD617932DB131C3688845EA8 | SHA256:3788C669D4B645E5A576DE9FC77FCA776BF516D43C89143DC2CA28291BA14358 | |||
| 3608 | photo_for_you.png.exe | C:\winnit\Qt5Core.dll | executable | |
MD5:817520432A42EFA345B2D97F5C24510E | SHA256:8D2FF4CE9096DDCCC4F4CD62C2E41FC854CFD1B0D6E8D296645A7F5FD4AE565A | |||
| 3608 | photo_for_you.png.exe | C:\winnit\msvcp140_2.dll | executable | |
MD5:E7A91F7C9D91F0F7857632436B121781 | SHA256:63F1A20CB17EC5E0CA4EBEA870B68740F24E063E28B235C3C8B58A3D8F57A9C4 | |||
| 3608 | photo_for_you.png.exe | C:\winnit\msvcp140_atomic_wait.dll | executable | |
MD5:21F3417BBD33CBB9F1886E86C7240D1A | SHA256:7E02EFE075B7DD385992F621FDE34728EF7C2D4CF090B127B093D0835345F8FE | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
25
DNS requests
12
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 2.23.181.156:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
4932 | svchost.exe | GET | 200 | 23.32.238.107:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
4932 | svchost.exe | GET | 200 | 2.23.181.156:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
— | — | POST | 204 | 2.16.204.142:443 | https://www.bing.com/threshold/xls.aspx | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 20.73.194.208:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4932 | svchost.exe | 23.32.238.107:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
4932 | svchost.exe | 2.23.181.156:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
— | — | 2.23.181.156:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
1288 | WerFault.exe | 104.208.16.94:443 | watson.events.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
6088 | WerFault.exe | 104.208.16.94:443 | watson.events.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
5876 | WerFault.exe | 20.189.173.21:443 | watson.events.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
self.events.data.microsoft.com |
| whitelisted |
watson.events.data.microsoft.com |
| whitelisted |
www.bing.com |
| whitelisted |