File name:

7za.7z

Full analysis: https://app.any.run/tasks/a8b7fed2-d343-466a-8f6e-17f2fb55a8db
Verdict: Malicious activity
Analysis date: April 29, 2024, 23:08:20
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

9EB56A77BE154F96FEDD3FC9BC1F8F92

SHA1:

1EF31708A0F85644388A4AD14418B570A59466BF

SHA256:

176B08098EA5C592A7D78E3EA11752E8BA6E7CD5F8C7DE02C34FC863F6C3A6B1

SSDEEP:

6144:zRcyGh0+/PLXzkRLX1eaTSPz8QN9XSORwFUhYQdVwksbqlIx:zE0+XLXzGxeHBN9XkFU+QVJUdx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • 7za.exe (PID: 1200)
      • 7za.exe (PID: 1604)

    • Create files in the Startup directory

      • 7za.exe (PID: 864)
      • 7za.exe (PID: 2040)
      • 7za.exe (PID: 1112)
      • 7za.exe (PID: 1604)
      • 7za.exe (PID: 1872)
      • 7za.exe (PID: 1792)
      • 7za.exe (PID: 2124)
      • 7za.exe (PID: 2472)
      • 7za.exe (PID: 1796)
      • 7za.exe (PID: 1128)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 7za.exe (PID: 1604)
      • 7za.exe (PID: 1200)

    • Process drops legitimate windows executable

      • 7za.exe (PID: 1604)

  • INFO

    • Manual execution by a user

      • 7za.exe (PID: 1200)
      • 7za.exe (PID: 2040)
      • 7za.exe (PID: 864)
      • 7za.exe (PID: 1872)
      • 7za.exe (PID: 1112)
      • 7za.exe (PID: 1604)
      • 7za.exe (PID: 1796)
      • 7za.exe (PID: 1792)
      • 7za.exe (PID: 2124)
      • 7za.exe (PID: 2472)
      • 7za.exe (PID: 1128)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3968)

    • Reads the computer name

      • 7za.exe (PID: 864)
      • 7za.exe (PID: 2040)
      • 7za.exe (PID: 1872)
      • 7za.exe (PID: 1112)
      • 7za.exe (PID: 1604)
      • 7za.exe (PID: 1796)
      • 7za.exe (PID: 2124)
      • 7za.exe (PID: 1792)
      • 7za.exe (PID: 2472)
      • 7za.exe (PID: 1128)
      • 7za.exe (PID: 1200)

    • Checks supported languages

      • 7za.exe (PID: 1872)
      • 7za.exe (PID: 1200)
      • 7za.exe (PID: 864)
      • 7za.exe (PID: 2040)
      • 7za.exe (PID: 1112)
      • 7za.exe (PID: 1796)
      • 7za.exe (PID: 1604)
      • 7za.exe (PID: 2124)
      • 7za.exe (PID: 2472)
      • 7za.exe (PID: 1792)
      • 7za.exe (PID: 1128)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3968)

    • Creates files or folders in the user directory

      • 7za.exe (PID: 1200)
      • 7za.exe (PID: 864)
      • 7za.exe (PID: 2040)
      • 7za.exe (PID: 1604)
      • 7za.exe (PID: 1112)
      • 7za.exe (PID: 1872)
      • 7za.exe (PID: 1792)
      • 7za.exe (PID: 2124)
      • 7za.exe (PID: 1796)
      • 7za.exe (PID: 1128)
      • 7za.exe (PID: 2472)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
57
Monitored processes
12
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe 7za.exe 7za.exe 7za.exe 7za.exe 7za.exe 7za.exe 7za.exe 7za.exe 7za.exe 7za.exe 7za.exe

Process information

PID
CMD
Path
Indicators
Parent process
864"C:\Users\admin\Desktop\7za.exe" C:\Users\admin\Desktop\7za.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\7za.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1112"C:\Users\admin\Desktop\7za.exe" C:\Users\admin\Desktop\7za.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\7za.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1128"C:\Users\admin\Desktop\7za.exe" C:\Users\admin\Desktop\7za.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\7za.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1200"C:\Users\admin\Desktop\7za.exe" C:\Users\admin\Desktop\7za.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\7za.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1604"C:\Users\admin\Desktop\7za.exe" C:\Users\admin\Desktop\7za.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\7za.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1792"C:\Users\admin\Desktop\7za.exe" C:\Users\admin\Desktop\7za.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\7za.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1796"C:\Users\admin\Desktop\7za.exe" C:\Users\admin\Desktop\7za.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\7za.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1872"C:\Users\admin\Desktop\7za.exe" C:\Users\admin\Desktop\7za.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\7za.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2040"C:\Users\admin\Desktop\7za.exe" C:\Users\admin\Desktop\7za.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\7za.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2124"C:\Users\admin\Desktop\7za.exe" C:\Users\admin\Desktop\7za.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\7za.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
Total events
26 957
Read events
26 938
Write events
19
Delete events
0

Modification events

(PID) Process:(3968) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3968) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3968) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3968) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3968) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3968) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(3968) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\7za.7z
(PID) Process:(3968) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3968) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3968) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
24
Suspicious files
7
Text files
9
Unknown types
3

Dropped files

PID
Process
Filename
Type
3968WinRAR.exeC:\Users\admin\Desktop\7za.txtexecutable
MD5:95E1B8930154783A112A8CF4BE312474
SHA256:01E3E0ADB13D1074A76974B464904BD807D20DF27173DF57CE6952440037A1CF
16047za.exeC:\Windows\Alcrmv.exeexecutable
MD5:95E1B8930154783A112A8CF4BE312474
SHA256:01E3E0ADB13D1074A76974B464904BD807D20DF27173DF57CE6952440037A1CF
16047za.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Ground.lnklnk
MD5:0DC77371F4694CDEE24E40DED1AC6AAE
SHA256:81346430E48E48BD5D813BE12F7734A2D62A42CA4F8DA3BFCC8413AE40BCF9BB
8647za.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Ground.lnklnk
MD5:82B7F1C1C25D6DBE029E236B48825C01
SHA256:2E3E6D71A31AD65E07B3351D2016834252A238E2F66D62934B3229FE2BB396C4
20407za.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Ground.lnkbinary
MD5:0DC77371F4694CDEE24E40DED1AC6AAE
SHA256:81346430E48E48BD5D813BE12F7734A2D62A42CA4F8DA3BFCC8413AE40BCF9BB
16047za.exeC:\Windows\SOUNDMAN.EXEexecutable
MD5:95E1B8930154783A112A8CF4BE312474
SHA256:01E3E0ADB13D1074A76974B464904BD807D20DF27173DF57CE6952440037A1CF
16047za.exeC:\Windows\Microsoft.NET\NETFXRepair.exeexecutable
MD5:95E1B8930154783A112A8CF4BE312474
SHA256:01E3E0ADB13D1074A76974B464904BD807D20DF27173DF57CE6952440037A1CF
16047za.exeC:\Windows\RCX5F15.tmpexecutable
MD5:907BC5065B8A016F4E6C7D438C889433
SHA256:8EC670861B5F2B62AED0679EBCEFACF2C3D097810259C66124C221EB08713FCD
16047za.exeC:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\gMicrosoft.Workflow.Compiler.exeexecutable
MD5:631677EE4B8D1D283C5FD86B8CBD8E34
SHA256:81B14305883DD7C818D00B2CAA971CDD05FCFE045D30F53363B689E954D47C16
16047za.exeC:\Windows\RCX5F83.tmpexecutable
MD5:907BC5065B8A016F4E6C7D438C889433
SHA256:8EC670861B5F2B62AED0679EBCEFACF2C3D097810259C66124C221EB08713FCD
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
1088
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
7za.7z