analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

机器狗病毒样本080609最新_.7z

Full analysis: https://app.any.run/tasks/b93bc2a1-d3b5-4bd0-9e90-d8cd90d50532
Verdict: Malicious activity
Analysis date: July 18, 2019, 08:42:25
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

33D8A25689079FFFD45176B85FF37CFE

SHA1:

BE7C826D2D5D2416E131B11952F4CCA2A83AE8F7

SHA256:

23B1AD3A2F082B9AC62E1AC218EAB6374E03B2E500B47CE5A593CB56B0888656

SSDEEP:

3072:Dt++UWlkcLrVR9r/xO5dV0hH/UCjvEBzu0KR:Dg+UWKcLrVR9LxIdehHcyEZuV

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 机器狗病毒样本080609最新 .exe (PID: 904)
      • 机器狗病毒样本080609最新 .exe (PID: 2996)
      • orz.exe (PID: 1352)
      • abzwtu.exe (PID: 2428)
      • orz.exe (PID: 1840)

    • Loads dropped or rewritten executable

      • explorer.exe (PID: 124)
      • abzwtu.exe (PID: 2428)
      • IEXPLORE.EXE (PID: 1540)
      • SearchProtocolHost.exe (PID: 3148)
      • IEXPLORE.EXE (PID: 3884)
      • SearchProtocolHost.exe (PID: 2892)

    • Changes Image File Execution Options

      • abzwtu.exe (PID: 2428)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3628)
      • orz.exe (PID: 1352)
      • orz.exe (PID: 1840)
      • abzwtu.exe (PID: 2428)

    • Reads Internet Cache Settings

      • explorer.exe (PID: 124)

    • Creates files in the user directory

      • explorer.exe (PID: 124)

    • Creates files in the Windows directory

      • orz.exe (PID: 1840)
      • abzwtu.exe (PID: 2428)

    • Removes files from Windows directory

      • abzwtu.exe (PID: 2428)

    • Starts CMD.EXE for commands execution

      • orz.exe (PID: 1840)

    • Starts Internet Explorer

      • abzwtu.exe (PID: 2428)

    • Executed as Windows Service

      • spoolsv.exe (PID: 2308)

  • INFO

    • Manual execution by user

      • 机器狗病毒样本080609最新 .exe (PID: 904)
      • 机器狗病毒样本080609最新 .exe (PID: 2996)
      • WinRAR.exe (PID: 2540)
      • orz.exe (PID: 1352)
      • orz.exe (PID: 1840)

    • Reads Microsoft Office registry keys

      • SearchProtocolHost.exe (PID: 3148)
      • SearchProtocolHost.exe (PID: 2892)

    • Changes internet zones settings

      • IEXPLORE.EXE (PID: 3884)

    • Reads internet explorer settings

      • IEXPLORE.EXE (PID: 1540)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
56
Monitored processes
14
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winrar.exe 机器狗病毒样本080609最新 .exe no specs 机器狗病毒样本080609最新 .exe winrar.exe no specs orz.exe orz.exe abzwtu.exe cmd.exe no specs explorer.exe no specs iexplore.exe iexplore.exe no specs searchprotocolhost.exe no specs spoolsv.exe no specs searchprotocolhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3628"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\机器狗病毒样本080609最新_.7z"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
904"C:\Users\admin\Desktop\机器狗病毒样本080609最新 .exe" C:\Users\admin\Desktop\机器狗病毒样本080609最新 .exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
2996"C:\Users\admin\Desktop\机器狗病毒样本080609最新 .exe" C:\Users\admin\Desktop\机器狗病毒样本080609最新 .exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
6
2540"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\机器狗病毒样本080609最新 .exe" C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
1352"C:\Users\admin\Desktop\orz.exe" C:\Users\admin\Desktop\orz.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
1840"C:\Users\admin\Desktop\orz.exe" C:\Users\admin\Desktop\orz.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
2428C:\Windows\system32\abzwtu.exeC:\Windows\system32\abzwtu.exe
orz.exe
User:
admin
Integrity Level:
HIGH
2164cmd /c c:\_uniep.batC:\Windows\system32\cmd.exe—orz.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
124C:\Windows\Explorer.EXEC:\Windows\explorer.exe——
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3884"C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE
abzwtu.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Total events
4 958
Read events
4 622
Write events
0
Delete events
0

Modification events

No data
Executable files
7
Suspicious files
0
Text files
2
Unknown types
6

Dropped files

PID
Process
Filename
Type
2540WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2540.40642\20086665944894\orz.exe —
MD5:—
SHA256:—
1840orz.exeC:\Users\admin\AppData\Local\Temp\_temp.dat —
MD5:—
SHA256:—
1840orz.exeC:\_uniep.bat —
MD5:—
SHA256:—
2428abzwtu.exeC:\Users\admin\AppData\Local\Temp\orz.exe —
MD5:—
SHA256:—
3884IEXPLORE.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\favicon[1].ico —
MD5:—
SHA256:—
3884IEXPLORE.EXEC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
3148SearchProtocolHost.exeC:\Users\admin\Documents\Outlook Files\~Outlook Data File - NoMail.pst.tmp —
MD5:—
SHA256:—
2892SearchProtocolHost.exeC:\Users\admin\Documents\Outlook Files\~Outlook Data File - NoMail.pst.tmp —
MD5:—
SHA256:—
3628WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3628.37039\机器狗病毒样本080609最新 .exeexecutable
MD5:CA538872D1900E719C558AAD40DDA387
SHA256:505E4B95B68684212F4B26E50FC36179A906237FCD1341822648EA1F20F85F96
1840orz.exeC:\Windows\system32\abzwtu.exeexecutable
MD5:BF68DABB4FFE2B35D9A8AABCBB5805DE
SHA256:635F2CF80EF61631B96726BDEBC63411DDCD7C3E91F7FB0768A5EEB2F28D1066
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
12
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3884
IEXPLORE.EXE
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3884
IEXPLORE.EXE
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted

DNS requests

Domain
IP
Reputation
txt.sonuher6.info
  • —
unknown
www.bing.com
  • 204.79.197.200
whitelisted
txt.yinuoben7.info
  • —
unknown
xtx.sonuher6.info
  • —
unknown
xtx.yinuoben7.info
  • —
unknown
tox.sonuher6.info
  • —
unknown
tox.yinuoben7.info
  • —
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
机器狗病毒样本080609最新_.7z