analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

e68fcd845683be392885de766f158a1c6b00cea57bdd68b5ff44d54e62400e1f.zip

Full analysis: https://app.any.run/tasks/4bbd60cc-35f3-449e-8023-66ce958241be
Verdict: Malicious activity
Analysis date: January 24, 2022, 15:38:46
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
maldoc-5
Indicators:
MIME: application/zip
File info: Zip archive data, at least v5.1 to extract
MD5:

9D6F277E7F90A5B67F4D6DEB56F15DAA

SHA1:

D1F97B078DCBEE9EA39F1BB171E768FB573F21A6

SHA256:

18B99BBD5DB40BFC3B5655989D7F53A2F646F0877FC38272E959B0C0B99EBBA4

SSDEEP:

384:nQpmX/+gmnZCl1jjDbogQtRbzA/PbuufsNURzcXhehBnepC46j7Wbpini73:nImvkrRtB4FFPh5eJ6j7WgS3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops known malicious document

      • WinRAR.exe (PID: 3220)

  • SUSPICIOUS

    • Reads the computer name

      • WinRAR.exe (PID: 3220)

    • Checks supported languages

      • WinRAR.exe (PID: 3220)

    • Reads default file associations for system extensions

      • WinRAR.exe (PID: 3220)
      • EXCEL.EXE (PID: 2696)

    • Starts Microsoft Office Application

      • EXCEL.EXE (PID: 2696)

  • INFO

    • Manual execution by user

      • EXCEL.EXE (PID: 2696)

    • Checks supported languages

      • EXCEL.EXE (PID: 2696)
      • CLVIEW.EXE (PID: 1020)

    • Reads the computer name

      • EXCEL.EXE (PID: 2696)
      • CLVIEW.EXE (PID: 1020)

    • Creates files in the user directory

      • EXCEL.EXE (PID: 2696)

    • Reads internet explorer settings

      • CLVIEW.EXE (PID: 1020)

    • Reads Microsoft Office registry keys

      • CLVIEW.EXE (PID: 1020)
      • EXCEL.EXE (PID: 2696)

    • Reads Microsoft Outlook installation path

      • CLVIEW.EXE (PID: 1020)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: e68fcd845683be392885de766f158a1c6b00cea57bdd68b5ff44d54e62400e1f.xls
ZipUncompressedSize: 51200
ZipCompressedSize: 24571
ZipCRC: 0x951501f8
ZipModifyDate: 2022:01:24 15:38:18
ZipCompression: Unknown (99)
ZipBitFlag: 0x0003
ZipRequiredVersion: 51
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs excel.exe no specs clview.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3220"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\e68fcd845683be392885de766f158a1c6b00cea57bdd68b5ff44d54e62400e1f.zip"C:\Program Files\WinRAR\WinRAR.exe—Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
2696"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /ddeC:\Program Files\Microsoft Office\Office14\EXCEL.EXE—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Exit code:
0
Version:
14.0.6024.1000
1020"C:\Program Files\Microsoft Office\Office14\CLVIEW.EXE" "EXCEL" "Microsoft Excel"C:\Program Files\Microsoft Office\Office14\CLVIEW.EXE—EXCEL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office Help Viewer
Exit code:
0
Version:
14.0.6015.1000
Total events
4 229
Read events
4 084
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
105
Text files
76
Unknown types
4

Dropped files

PID
Process
Filename
Type
2696EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVRE893.tmp.cvr —
MD5:—
SHA256:—
2696EXCEL.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.datini
MD5:E40DC9078D6B7A57DFB24D49625F8CFA
SHA256:D1713B7E12A8544C8E5D9C57A0F5D1627E84A2919EC918D10F38E9A2C0061285
3220WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3220.38810\e68fcd845683be392885de766f158a1c6b00cea57bdd68b5ff44d54e62400e1f.xlsdocument
MD5:4E8EC74A93B831A92A1B016722E79365
SHA256:E68FCD845683BE392885DE766F158A1C6B00CEA57BDD68B5FF44D54E62400E1F
1020CLVIEW.EXEC:\Users\admin\AppData\Local\Temp\IMT3883.tmpbinary
MD5:669884C6C1DEC7F6CD03B442E4101692
SHA256:4447990DB2D42D9DDDA248FF34910A751F77BE3E88B0789672D92BE89B22453F
1020CLVIEW.EXEC:\Users\admin\AppData\Local\Microsoft Help\MS.EXCEL.14.1033_1033_MTOC_EXCEL_COL.HxHbinary
MD5:41859B6D703FC3CB5974B8469E641F91
SHA256:D8759E93651398921103C4BE8909013D6D70F637FA45C844AC3F80FA1EF9A850
2696EXCEL.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\e68fcd845683be392885de766f158a1c6b00cea57bdd68b5ff44d54e62400e1f.xls.LNKlnk
MD5:117C03A9E86F367029377E2A10448DB8
SHA256:B93654EAC82FBA89645375A720F9DEA3F1B9DB191F07CEF25BF366FB7CA7C725
1020CLVIEW.EXEC:\Users\admin\AppData\Local\Temp\IMT3882.tmpbinary
MD5:77CF07B5075A3B3D6491E1D85A46090F
SHA256:2A4706758F22E2078630AD4334D9FA3946041AACD876E5226E8C8C07D7CE0C7E
1020CLVIEW.EXEC:\Users\admin\AppData\Local\Temp\IMT386D.tmpbinary
MD5:7E8B24EECB300B45B19F534EFF40AD54
SHA256:DAA96DDB007D4387E35263890F76F3CE91EE276D6AE85B0BBF1D9BCB97FCF85B
1020CLVIEW.EXEC:\Users\admin\AppData\Local\Temp\IMT385A.tmpbinary
MD5:73E5F16AA352D7188E7266C6C20EAAF1
SHA256:57408D0184C465A18379CAAF84030C6835B480BC644804F5670A02B985E84A0C
1020CLVIEW.EXEC:\Users\admin\AppData\Local\Temp\IMT386B.tmpbinary
MD5:4BE2AEDDA24E0539C95564B48CA9D8BA
SHA256:E4D153F74AC21D4212A83FE030EE7A407B5FDFE2D3A8145F3E826532BD796893
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
e68fcd845683be392885de766f158a1c6b00cea57bdd68b5ff44d54e62400e1f.zip