analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

4857496168202240.zip

Full analysis: https://app.any.run/tasks/30ed2dfa-466c-4f70-822e-7ddd5390d54f
Verdict: Malicious activity
Analysis date: March 16, 2022, 20:19:36
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

07C7911FEE7B10248C0581AB2B5CEA2C

SHA1:

DFE63284E426601E444693F1210DFAD769FE05EF

SHA256:

15C502BD130BC27EB17DBD5506201B8F524C897CFB92CDC7574CF4C95620A721

SSDEEP:

6144:qB5u9bIp+MfhFB/SPYEslcFMU8nevGMjyTyejWY7jv5nSybYIkeWEjnirC9u+tOR:qU8pvfrBSPY7cFyTWYHgybR56D

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • go.exe (PID: 3644)
      • go.exe (PID: 1952)
      • ovkf4nzt.exe (PID: 1512)

    • Writes to a start menu file

      • go.exe (PID: 3644)
      • go.exe (PID: 1952)

    • Uses Task Scheduler to autorun other applications

      • cmd.exe (PID: 1432)

    • Changes the autorun value in the registry

      • go.exe (PID: 3644)
      • go.exe (PID: 1952)

    • Starts Visual C# compiler

      • go.exe (PID: 3644)
      • go.exe (PID: 1952)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 2140)
      • wbengine.exe (PID: 3276)

    • Drops executable file immediately after starts

      • csc.exe (PID: 452)
      • go.exe (PID: 1952)
      • csc.exe (PID: 328)

    • Deletes shadow copies

      • cmd.exe (PID: 3484)
      • cmd.exe (PID: 2408)
      • cmd.exe (PID: 1704)

    • Application was injected by another process

      • svchost.exe (PID: 332)
      • svchost.exe (PID: 876)
      • SearchIndexer.exe (PID: 2996)

    • Runs injected code in another process

      • wbadmin.exe (PID: 2844)

    • Starts BCDEDIT.EXE to disable recovery

      • cmd.exe (PID: 3676)

    • Turns off the firewall via NETSH.EXE

      • cmd.exe (PID: 1104)

    • Disables Windows Defender

      • go.exe (PID: 1952)

  • SUSPICIOUS

    • Checks supported languages

      • WinRAR.exe (PID: 3732)
      • go.exe (PID: 3644)
      • cmd.exe (PID: 1432)
      • csc.exe (PID: 452)
      • cvtres.exe (PID: 4056)
      • csc.exe (PID: 328)
      • go.exe (PID: 1952)
      • cvtres.exe (PID: 4072)
      • cmd.exe (PID: 2408)
      • cmd.exe (PID: 3288)
      • cmd.exe (PID: 3484)
      • cmd.exe (PID: 1704)
      • cmd.exe (PID: 2140)
      • cmd.exe (PID: 1104)
      • cmd.exe (PID: 3676)
      • cmd.exe (PID: 2484)
      • WMIC.exe (PID: 2560)
      • ovkf4nzt.exe (PID: 1512)
      • mshta.exe (PID: 3616)

    • Reads the computer name

      • go.exe (PID: 3644)
      • WinRAR.exe (PID: 3732)
      • go.exe (PID: 1952)
      • WMIC.exe (PID: 2560)
      • ovkf4nzt.exe (PID: 1512)
      • mshta.exe (PID: 3616)

    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 3732)
      • go.exe (PID: 3644)
      • csc.exe (PID: 452)
      • go.exe (PID: 1952)
      • csc.exe (PID: 328)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3732)
      • go.exe (PID: 3644)
      • csc.exe (PID: 452)
      • go.exe (PID: 1952)
      • csc.exe (PID: 328)

    • Starts CMD.EXE for commands execution

      • go.exe (PID: 3644)
      • go.exe (PID: 1952)

    • Creates files in the program directory

      • go.exe (PID: 3644)
      • csc.exe (PID: 452)
      • csc.exe (PID: 328)
      • go.exe (PID: 1952)
      • SearchIndexer.exe (PID: 2996)

    • Creates files in the user directory

      • go.exe (PID: 3644)

    • Application launched itself

      • go.exe (PID: 3644)

    • Creates files in the Windows directory

      • svchost.exe (PID: 876)
      • go.exe (PID: 1952)
      • wbadmin.exe (PID: 2844)

    • Changes default file association

      • go.exe (PID: 1952)

    • Executed as Windows Service

      • vssvc.exe (PID: 3896)
      • vds.exe (PID: 3060)
      • wbengine.exe (PID: 3276)

    • Uses NETSH.EXE for network configuration

      • cmd.exe (PID: 1104)
      • cmd.exe (PID: 2484)

    • Reads Environment values

      • netsh.exe (PID: 2096)
      • netsh.exe (PID: 2520)

    • Executed via COM

      • vdsldr.exe (PID: 3980)
      • DllHost.exe (PID: 3656)

    • Writes to a desktop.ini file (may be used to cloak folders)

      • go.exe (PID: 1952)

    • Starts MSHTA.EXE for opening HTA or HTMLS files

      • ovkf4nzt.exe (PID: 1512)

    • Reads Microsoft Outlook installation path

      • mshta.exe (PID: 3616)

  • INFO

    • Manual execution by user

      • go.exe (PID: 3644)
      • ovkf4nzt.exe (PID: 1512)

    • Checks supported languages

      • schtasks.exe (PID: 2140)
      • svchost.exe (PID: 876)
      • vssadmin.exe (PID: 3668)
      • wbadmin.exe (PID: 2844)
      • netsh.exe (PID: 2096)
      • bcdedit.exe (PID: 3224)
      • bcdedit.exe (PID: 3236)
      • vssvc.exe (PID: 3896)
      • netsh.exe (PID: 2520)
      • wbengine.exe (PID: 3276)
      • vdsldr.exe (PID: 3980)
      • DllHost.exe (PID: 3656)
      • wbadmin.exe (PID: 2608)
      • vds.exe (PID: 3060)

    • Reads the computer name

      • schtasks.exe (PID: 2140)
      • wbadmin.exe (PID: 2844)
      • vssadmin.exe (PID: 3668)
      • wbadmin.exe (PID: 2608)
      • vssvc.exe (PID: 3896)
      • DllHost.exe (PID: 3656)
      • netsh.exe (PID: 2520)
      • wbengine.exe (PID: 3276)
      • netsh.exe (PID: 2096)
      • vdsldr.exe (PID: 3980)
      • vds.exe (PID: 3060)

    • Reads internet explorer settings

      • mshta.exe (PID: 3616)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0009
ZipCompression: Deflated
ZipModifyDate: 1980:00:00 00:00:00
ZipCRC: 0xc7089b66
ZipCompressedSize: 348505
ZipUncompressedSize: 485888
ZipFileName: 15d7342be36d20ce615647fac9c2277f46b6d19aa54f3cf3d99e49d6ce0486d0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
87
Monitored processes
35
Malicious processes
6
Suspicious processes
4

Behavior graph

Click at the process to see the details
start drop and start inject inject inject winrar.exe go.exe cmd.exe schtasks.exe no specs csc.exe cvtres.exe no specs go.exe csc.exe cvtres.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs vssadmin.exe no specs cmd.exe no specs wbadmin.exe no specs cmd.exe no specs cmd.exe no specs wmic.exe no specs wbadmin.exe no specs cmd.exe no specs svchost.exe svchost.exe searchindexer.exe vssvc.exe no specs bcdedit.exe no specs bcdedit.exe no specs netsh.exe no specs netsh.exe no specs wbengine.exe no specs SPPSurrogate no specs vdsldr.exe no specs vds.exe no specs ovkf4nzt.exe no specs mshta.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3732"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\4857496168202240.zip"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
3644"C:\Users\admin\Desktop\go.exe" C:\Users\admin\Desktop\go.exe
Explorer.EXE
User:
admin
Company:
Microsoft
Integrity Level:
MEDIUM
Description:
svchost
Exit code:
0
Version:
1.0.0.0
1432"C:\Windows\System32\cmd.exe" /C schtasks /CREATE /SC ONLOGON /TN Loki /TR C:\Users\admin\AppData\Roaming\winlogon.exe /RU SYSTEM /RL HIGHEST /FC:\Windows\System32\cmd.exe
go.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2140schtasks /CREATE /SC ONLOGON /TN Loki /TR C:\Users\admin\AppData\Roaming\winlogon.exe /RU SYSTEM /RL HIGHEST /FC:\Windows\system32\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
452"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\odptmeg3.cmdline"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
go.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
4.0.30319.34209 built by: FX452RTMGDR
4056C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES1630.tmp" "c:\ProgramData\CSCF41E2E2A78C34658937750879B8021C0.TMP"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft� Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
12.00.51209.34209 built by: FX452RTMGDR
1952"C:\Users\admin\Desktop\go.exe" C:\Users\admin\Desktop\go.exe
go.exe
User:
admin
Company:
Microsoft
Integrity Level:
HIGH
Description:
svchost
Version:
1.0.0.0
328"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\i5sboeob.cmdline"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
go.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
4.0.30319.34209 built by: FX452RTMGDR
4072C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES1824.tmp" "c:\ProgramData\CSCED1448891DC14D6F93A0238D2E34A3.TMP"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft� Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
12.00.51209.34209 built by: FX452RTMGDR
2408"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quietC:\Windows\System32\cmd.exe—go.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Total events
15 392
Read events
15 115
Write events
0
Delete events
0

Modification events

No data
Executable files
8
Suspicious files
2 392
Text files
400
Unknown types
92

Dropped files

PID
Process
Filename
Type
3644go.exeC:\Users\admin\AppData\Local\Temp\odptmeg3.cmdlinetext
MD5:5EE89A40F5EB439C9A39E7001504E644
SHA256:934BF68C0A1052FD48034929E3501D200C49D5255E1FF2DBBB219EE938B9F8A5
4056cvtres.exeC:\Users\admin\AppData\Local\Temp\RES1630.tmpo
MD5:4589BF88FB803C2DF68E0F2C2367762F
SHA256:FC4C9973D9ED75E9D039FEF9527E332F925190AD3E48722058D8AC4832EE0DBF
3644go.exeC:\ProgramData\info.Lokihtml
MD5:C1418F8066D196265BE2D5D7A130324B
SHA256:89F19816187051EC5C39B53214A7DD4D41A6A27890166327FC55993AC9384D17
1952go.exeC:\Users\admin\AppData\Local\Temp\i5sboeob.cmdlinetext
MD5:690FA5155A26AF28A5764E8D8CA82F1A
SHA256:53E9E2B07578C2C6B28CAB736EDA2AB1D46DED071208913FF11644F1B2668EA7
452csc.exeC:\ProgramData\CSCF41E2E2A78C34658937750879B8021C0.TMPres
MD5:2F5268C672C63DE3B5C2E459CDBBA39B
SHA256:E1E869BC9D2C2744557DA2D21F5AF8DFEC86661E8273F5682ECBD47617A7A2D7
452csc.exeC:\Users\admin\AppData\Local\Temp\odptmeg3.outtext
MD5:18324658B8F188EFC0387432025581A8
SHA256:D87052C1E027331190EC3A4846610F793B7A5DF0E1D943364B3F480C8E48B3B2
876svchost.exeC:\Windows\appcompat\programs\RecentFileCache.bcftxt
MD5:9B69B8531E6D13A98F80B071FD3A1EBF
SHA256:13A51F888AF7F5029D3BEB591E41B304893B15BD13B7F839789FBD48AE5ECB10
452csc.exeC:\ProgramData\3srqvmc3.exeexecutable
MD5:A6E3C41A2C0CB3AEA8F912896C826139
SHA256:B3D6E161081836FEC260A3D6B3CDCED5E6874F3923AE6E7E79646D9370E06C89
876svchost.exeC:\Windows\System32\Tasks\Lokixml
MD5:CE16A8EEBC0EC37C24D517233DAFF9B3
SHA256:8E71F59FD5D1478A74D95AF385CD43EEDD647412350799FBBA494A0A2D1E27ED
3644go.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wvtymcow.battext
MD5:3FC537B642D3756646715325299C6367
SHA256:708511C356493E41CA103DB51B8DF3FB57898DDB2BB7CF4F11560FACDE9425ED
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
13
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3644
go.exe
POST
200
91.223.82.6:80
http://loki-locker.one/index.php
NL
binary
601 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.1:445
—
—
—
unknown
—
—
192.168.100.2:445
—
—
—
whitelisted
—
—
192.168.100.2:139
—
—
—
whitelisted
—
—
192.168.100.1:139
—
—
—
unknown
3644
go.exe
91.223.82.6:80
loki-locker.one
Iws Networks LLC
NL
malicious

DNS requests

Domain
IP
Reputation
loki-locker.one
  • 91.223.82.6
malicious

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
4857496168202240.zip