analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

vir.7z

Full analysis: https://app.any.run/tasks/135684ad-1fd6-46c3-925d-8b7c024623e1
Verdict: Malicious activity
Analysis date: July 18, 2019, 07:55:42
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

3336BD34242FF3DD8CFD951B28A6BB1A

SHA1:

AA61EE2F2DAF233826A4B600127D0F501FAD8ACA

SHA256:

1D9787F24CDB70177F708236B398DBA430E253892A8038B4E85FB68D3A80E7F2

SSDEEP:

24576:inNBSxlg5DX9SmOr9sNmuFeBA3yaVPhlBFyjIdajbicVNm3s7bx8cGhF/cW0jFd1:inNBSvghtSmOCFef0ZlB83PVNm3sX6HI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • vir.exe (PID: 3604)

    • Loads dropped or rewritten executable

      • vir.exe (PID: 3604)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 564)
      • vir.exe (PID: 3604)

    • Executed via COM

      • explorer.exe (PID: 3508)

  • INFO

    • Manual execution by user

      • vir.exe (PID: 3604)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
4
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe vir.exe explorer.exe no specs explorer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
564"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\vir.7z"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
3604"C:\Users\admin\AppData\Local\Temp\vir\vir.exe" C:\Users\admin\AppData\Local\Temp\vir\vir.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
544explorer C:\Users\admin\AppData\Local\Temp\vir\virC:\Windows\explorer.exe—vir.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3508C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -EmbeddingC:\Windows\explorer.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
1 118
Read events
1 028
Write events
0
Delete events
0

Modification events

No data
Executable files
15
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
3604vir.exeC:\Users\admin\AppData\Local\Temp\E_N4\shell.fneexecutable
MD5:88DCC71DE4C3D307D957EA38D09BCE2A
SHA256:32A96E91B2A2967201E8CCAD58F6A5F2D0DD54FA6D1715EA3FD67A351A77C636
3604vir.exeC:\Users\admin\AppData\Local\Temp\E_N4\eAPI.fneexecutable
MD5:7D8869E7273F4A45A8EB75293584780A
SHA256:55E2C43055B4089CD7CECC21DF67AB50CE9C42877A196E22E31B59B28FB3925B
3604vir.exeC:\Users\admin\AppData\Local\VirtualStore\Windows\System32\204E98\cnvpe.fneexecutable
MD5:926A81BC9B58640C0528F6877C98529B
SHA256:47885277FD0F6A74B99AC2C2FCD968BDF3CFC98CA60C99DC71EDA5E5E3AA817B
3604vir.exeC:\Users\admin\AppData\Local\VirtualStore\Windows\System32\204E98\eAPI.fneexecutable
MD5:7D8869E7273F4A45A8EB75293584780A
SHA256:55E2C43055B4089CD7CECC21DF67AB50CE9C42877A196E22E31B59B28FB3925B
564WinRAR.exeC:\Users\admin\AppData\Local\Temp\vir\vir.exeexecutable
MD5:CC128E0F682023C97991C8FA28C47485
SHA256:029BC215D5522A82465F7A9C0A7FFA456E85FFE05A09CAE4A0281DCC565C1C7C
3604vir.exeC:\Users\admin\AppData\Local\Temp\E_N4\krnln.fnrexecutable
MD5:7C3D4EF3BEF449EB78E0ECDC10F99E0C
SHA256:6B49853481ABF3E82497B89EB8D72367EACAA617C5CE11235CD38845238144C3
3604vir.exeC:\Users\admin\AppData\Local\VirtualStore\Windows\System32\204E98\krnln.fnrexecutable
MD5:7C3D4EF3BEF449EB78E0ECDC10F99E0C
SHA256:6B49853481ABF3E82497B89EB8D72367EACAA617C5CE11235CD38845238144C3
3604vir.exeC:\Users\admin\AppData\Local\Temp\E_N4\cnvpe.fneexecutable
MD5:926A81BC9B58640C0528F6877C98529B
SHA256:47885277FD0F6A74B99AC2C2FCD968BDF3CFC98CA60C99DC71EDA5E5E3AA817B
3604vir.exeC:\Users\admin\AppData\Local\VirtualStore\Windows\System32\204E98\internet.fneexecutable
MD5:299C26FB72A3D286CC24C4A9A9A4A693
SHA256:2BE723179932D65ABCA06C85F74717A034308EC9ED413E63F86CD82D4415AD7E
3604vir.exeC:\Users\admin\AppData\Local\VirtualStore\Windows\System32\41D8CD\8CD98F00.TXTbinary
MD5:E17781CD41785CCA505E36ED96BF7CE8
SHA256:A9493FEBD2777E9442744BF6CAC8D17F8D2D26BE2FB772A0146958707B6846D5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
vir.7z