File name:

Microsoft Office 2000 Professional-20180926T161214Z-001.zip

Full analysis: https://app.any.run/tasks/b8aa3b19-5952-494b-8837-bbb45aec8942
Verdict: Malicious activity
Analysis date: February 02, 2024, 08:14:39
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v4.5 to extract
MD5:

7AA00EEA952CD9CFA5D3CBE319715E4B

SHA1:

AF72BE667C4F13422910C2E30C3910DE6E2DC875

SHA256:

272950125B31895179439A24F5A81CA3227B23A67A4366D5CE8280DAE4409751

SSDEEP:

12288:1Cm+99rXOL0CxBkbYxHi4ssCVZm9Tvu4jmMeNmDgYqWSMuJ:1Cm+zu0CxB5Hi4sVZm9Tvu4KM/gYqWS5

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • cmd.exe (PID: 3456)
      • eng.exe (PID: 1172)
      • rf.exe (PID: 2556)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • cmd.exe (PID: 3456)
      • eng.exe (PID: 1172)
      • rf.exe (PID: 2556)

    • Starts CMD.EXE for commands execution

      • WinRAR.exe (PID: 1380)
      • cmd.exe (PID: 3456)
      • rf.exe (PID: 2556)

    • Executing commands from a ".bat" file

      • WinRAR.exe (PID: 1380)

    • Process drops legitimate windows executable

      • cmd.exe (PID: 3456)
      • eng.exe (PID: 1172)
      • rf.exe (PID: 2556)

    • Uses ATTRIB.EXE to modify file attributes

      • cmd.exe (PID: 3456)
      • cmd.exe (PID: 3660)
      • cmd.exe (PID: 3080)
      • cmd.exe (PID: 4052)
      • cmd.exe (PID: 2920)
      • cmd.exe (PID: 1876)

    • The executable file from the user directory is run by the CMD process

      • eng.exe (PID: 1172)

    • Starts a Microsoft application from unusual location

      • eng.exe (PID: 1172)
      • rf.exe (PID: 2556)

    • Reads security settings of Internet Explorer

      • eng.exe (PID: 1172)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • eng.exe (PID: 1172)

    • Reads data from a binary Stream object (SCRIPT)

      • eng.exe (PID: 1172)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 3456)

    • Saves data to a binary file (SCRIPT)

      • eng.exe (PID: 1172)

    • Reads the Internet Settings

      • eng.exe (PID: 1172)
      • rf.exe (PID: 2556)
      • svcnosts.exe (PID: 3508)
      • svcnost.exe (PID: 2904)

    • Runs shell command (SCRIPT)

      • eng.exe (PID: 1172)

    • Checks Windows Trust Settings

      • eng.exe (PID: 1172)

    • Application launched itself

      • cmd.exe (PID: 3456)

    • Creates a Stream, which may work with files, input/output devices, pipes, or TCP/IP sockets (SCRIPT)

      • eng.exe (PID: 1172)

    • Writes binary data to a Stream object (SCRIPT)

      • eng.exe (PID: 1172)

    • Reads data from a file (SCRIPT)

      • eng.exe (PID: 1172)

    • Checks whether a specific file exists (SCRIPT)

      • eng.exe (PID: 1172)

    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 3316)
      • cmd.exe (PID: 3420)
      • cmd.exe (PID: 3924)
      • cmd.exe (PID: 3816)
      • cmd.exe (PID: 1196)
      • cmd.exe (PID: 2132)
      • cmd.exe (PID: 3372)
      • cmd.exe (PID: 3852)
      • cmd.exe (PID: 4000)
      • cmd.exe (PID: 2636)
      • cmd.exe (PID: 3956)
      • cmd.exe (PID: 2168)
      • cmd.exe (PID: 2896)
      • cmd.exe (PID: 2256)

    • The process creates files with name similar to system file names

      • rf.exe (PID: 2556)

    • Write to the desktop.ini file (may be used to cloak folders)

      • rf.exe (PID: 2556)

    • Starts itself from another location

      • svcnosts.exe (PID: 3508)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 3456)

    • Reads settings of System Certificates

      • svcnost.exe (PID: 2904)

  • INFO

    • Reads the computer name

      • eng.exe (PID: 1172)
      • rf.exe (PID: 2556)
      • svcnosts.exe (PID: 3508)
      • svcnost.exe (PID: 2904)

    • Checks supported languages

      • eng.exe (PID: 1172)
      • rf.exe (PID: 2556)
      • svcnosts.exe (PID: 3508)
      • svcnost.exe (PID: 2904)

    • Reads Environment values

      • eng.exe (PID: 1172)
      • svcnost.exe (PID: 2904)

    • Reads the machine GUID from the registry

      • eng.exe (PID: 1172)
      • rf.exe (PID: 2556)
      • svcnosts.exe (PID: 3508)
      • svcnost.exe (PID: 2904)

    • Create files in a temporary directory

      • eng.exe (PID: 1172)

    • Reads product name

      • svcnost.exe (PID: 2904)

    • Manual execution by a user

      • notepad.exe (PID: 784)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0801
ZipCompression: Deflated
ZipModifyDate: 1980:00:00 00:00:00
ZipCRC: 0xbe1df398
ZipCompressedSize: 407634
ZipUncompressedSize: 469840
ZipFileName: Device/HarddiskVolume4/Users/Bantam Familia/Desktop/euro/Unhide Files.bat
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
112
Monitored processes
53
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs cmd.exe eng.exe attrib.exe no specs attrib.exe no specs attrib.exe no specs cmd.exe no specs reg.exe no specs ping.exe no specs rf.exe cmd.exe no specs cacls.exe no specs cmd.exe no specs cacls.exe no specs cmd.exe no specs cacls.exe no specs cmd.exe no specs cacls.exe no specs cmd.exe no specs cacls.exe no specs cmd.exe no specs cacls.exe no specs ping.exe no specs cmd.exe no specs cacls.exe no specs cmd.exe no specs cacls.exe no specs cmd.exe no specs attrib.exe no specs cmd.exe no specs attrib.exe no specs cmd.exe no specs attrib.exe no specs cmd.exe no specs attrib.exe no specs cmd.exe no specs attrib.exe no specs cmd.exe no specs cacls.exe no specs cmd.exe no specs cacls.exe no specs cmd.exe no specs cacls.exe no specs cmd.exe no specs cacls.exe no specs cmd.exe no specs cacls.exe no specs cmd.exe no specs cacls.exe no specs svcnosts.exe no specs reg.exe no specs svcnost.exe notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
120cacls C:\sefera\Jnt\wypoyyra\..\.. /d administrators /eC:\Windows\System32\cacls.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Control ACLs Program
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\cacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
784"C:\Windows\System32\NOTEPAD.EXE" C:\Users\admin\Desktop\Unhide Files.batC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
896attrib * -s /d C:\Windows\System32\attrib.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Attribute Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\attrib.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ulib.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
956cacls C:\System_VoIume_lnformation\Jnt\seiityo\..\.. /d administrators /eC:\Windows\System32\cacls.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Control ACLs Program
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\cacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1172"C:\Users\admin\AppData\Local\Temp\rlgms22631\eng.exe" "C:\Users\admin\AppData\Local\Temp\rlgms22631\sk.js"C:\Users\admin\AppData\Local\Temp\rlgms22631\eng.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7601.24288
Modules
Images
c:\users\admin\appdata\local\temp\rlgms22631\eng.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1196"C:\Windows\system32\cmd.exe" /c cacls n:\System_VoIume_lnformation\Jnt\null\..\.. /r admin /e /tC:\Windows\System32\cmd.exe—rf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
3
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1380"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Microsoft Office 2000 Professional-20180926T161214Z-001.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1408REG QUERY HKCU\SOFTWARE\btC:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1876"C:\Windows\system32\cmd.exe" /c attrib C:\System_VoIume_lnformation\Jnt\seiityo\..\.. +r +s +hC:\Windows\System32\cmd.exe—rf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2072cacls C:\System_VoIume_lnformation\Jnt\seiityo\..\.. /d admin /eC:\Windows\System32\cacls.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Control ACLs Program
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\cacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
6 736
Read events
6 679
Write events
57
Delete events
0

Modification events

(PID) Process:(1380) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1380) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(1380) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(1380) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(1380) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(1380) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1380) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1380) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1380) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1380) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
8
Suspicious files
5
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
2556rf.exeC:\System_VoIume_lnformation\Jnt\seiityo\bmz\explorer.exeexecutable
MD5:AD7B9C14083B52BC532FBA5948342B98
SHA256:17F746D82695FA9B35493B41859D39D786D32B23A9D2E00F4011DEC7A02402AE
3456cmd.exeC:\Users\admin\AppData\Local\Temp\rlgms22631\unrf.dllbinary
MD5:02511F256BED0988811FD5B16952B6C7
SHA256:ABFFEABD0BDCC10867FF779126C7DE8C8DBFBEAE7BDAACE092F4FC9AD117E123
1172eng.exeC:\Users\admin\AppData\Local\Temp\rlgms22631\rf.exeexecutable
MD5:99FD856CAB9F69B72CBB02D4959C39EC
SHA256:D7B3BC9FF5BDFA4A7645745895DB5177B961F94CD00C33A9F6DF9565D525C305
2556rf.exeC:\sefera\Jnt\wypoyyra\svcnost.exeexecutable
MD5:78698B81C9D2FFB65F471DBBDE70D087
SHA256:3FC2772C7A01BE6BC909E0C929E00306B5110DDBDECE939ACE067EF4D1ABEB89
3456cmd.exeC:\Users\admin\AppData\Local\Temp\rlgms22631\eng.exeexecutable
MD5:BA7AC4381D685354FF87E0553E950A4E
SHA256:BED1028BADEE2ADE8A8A8EDD25AA4C3E70A6BEEFAFBDFFD6426E5E467F24EB01
2556rf.exeC:\sefera\Jnt\wypoyyra\gotera.bmpbinary
MD5:6E0EC61CA1C8E138B86AD319E9984D95
SHA256:CCE5505B776CDB7C79B5563F076DC2BE101B07278DD2FAE6B40BF90364C67247
2556rf.exeC:\System_VoIume_lnformation\Jnt\seiityo\explorers.exeexecutable
MD5:78698B81C9D2FFB65F471DBBDE70D087
SHA256:3FC2772C7A01BE6BC909E0C929E00306B5110DDBDECE939ACE067EF4D1ABEB89
2556rf.exeC:\System_VoIume_lnformation\Jnt\seiityo\gotera.bmpbinary
MD5:6E0EC61CA1C8E138B86AD319E9984D95
SHA256:CCE5505B776CDB7C79B5563F076DC2BE101B07278DD2FAE6B40BF90364C67247
2556rf.exeC:\sefera\desktop.initext
MD5:ADC4B5D4444D26293DC782B6238CA6F0
SHA256:ABE8A5933FF450A89B8E9A736F08874B43B7355D17FFE6540C4A6EAD0F0995D3
2556rf.exeC:\sefera\Jnt\wypoyyra\svcnosts.exeexecutable
MD5:78698B81C9D2FFB65F471DBBDE70D087
SHA256:3FC2772C7A01BE6BC909E0C929E00306B5110DDBDECE939ACE067EF4D1ABEB89
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
5
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2904
svcnost.exe
199.36.158.100:443
clear-march.firebaseapp.com
FASTLY
US
unknown

DNS requests

Domain
IP
Reputation
clear-march.firebaseapp.com
  • 199.36.158.100
malicious

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Microsoft Office 2000 Professional-20180926T161214Z-001.zip