analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

sample_124.zip

Full analysis: https://app.any.run/tasks/6dbbcadd-eca8-4c6d-9673-8bc7e9f8b7b4
Verdict: Malicious activity
Analysis date: June 12, 2019, 11:17:38
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

EBC31D6AA6773C1A4189159E4BCC86B3

SHA1:

CE9B8494778ACC4F3888BF5E3232FDE77FDA801F

SHA256:

200D70D4853C3BF6A4A8A31113CB84AC7E6E8D09CE8DBC9CB1DA11E33A96619A

SSDEEP:

3072:z0/eMaijDaaW7s2QQQydcxEDQ8FTsaIm85dHnVzghhdKMTf1:zy/NP34PyEDQ8phuLh0KMZ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 1256)
      • svchost.exe (PID: 848)
      • explorer.exe (PID: 252)
    • Renames files like Ransomware

      • explorer.exe (PID: 252)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • explorer.exe (PID: 252)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: sample_124/
ZipUncompressedSize: -
ZipCompressedSize: -
ZipCRC: 0x00000000
ZipModifyDate: 2018:05:01 18:48:22
ZipCompression: None
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
4
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe no specs searchprotocolhost.exe no specs explorer.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
2816"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\sample_124.zip"C:\Program Files\WinRAR\WinRAR.exeexplorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
1256"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe5_ Global\UsGthrCtrlFltPipeMssGthrPipe5 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exeSearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
252C:\Windows\Explorer.EXEC:\Windows\explorer.exe
ctfmon.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
848C:\Windows\system32\svchost.exe -k netsvcsC:\Windows\System32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
3 042
Read events
2 980
Write events
0
Delete events
0

Modification events

No data
Executable files
3
Suspicious files
0
Text files
0
Unknown types
1

Dropped files

PID
Process
Filename
Type
2816WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2816.28715\sample_124\sample_124
MD5:
SHA256:
252explorer.exeC:\Users\admin\Desktop\sample_124.exeexecutable
MD5:D8EBB2E22B07D53E41E814F67FF73AF1
SHA256:0DB8E7007F8D6A4D2AFB0F93A446B8E576F9415B416AC9285E9D46F38617B93C
848svchost.exeC:\Windows\appcompat\programs\RecentFileCache.bcftxt
MD5:71CA7046B0B8C29B86E377E31888B3D7
SHA256:1EF7983D907EA8D5C152B0A6352827CA3F4133C26E42A77E66AF092D86073AD0
252explorer.exeC:\Users\admin\Desktop\sample_124executable
MD5:D8EBB2E22B07D53E41E814F67FF73AF1
SHA256:0DB8E7007F8D6A4D2AFB0F93A446B8E576F9415B416AC9285E9D46F38617B93C
252explorer.exeC:\Users\admin\Desktop\sample_124.exexecutable
MD5:D8EBB2E22B07D53E41E814F67FF73AF1
SHA256:0DB8E7007F8D6A4D2AFB0F93A446B8E576F9415B416AC9285E9D46F38617B93C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info