analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

DoIT Zipped.zip

Full analysis: https://app.any.run/tasks/ff1b32d2-ad00-4456-bb50-2b1ec105e7a9
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: June 27, 2022, 05:59:19
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

508D7ABD011895BBA416EA43F086D2B8

SHA1:

E8048A3DB2945A41C599D8AD15FF86A673CBF6BB

SHA256:

29A28C5F5EFE8DC231F88E098855131DC3FC7F36B2F4971412EC1E84C5CA2D72

SSDEEP:

384:j3jvORHrPbdR+uh311SPam5Q1sqDgUsVOCuXz75veMMJ:/kHrBR+uh3rSSm5QKqDgUswzIMMJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executable content was dropped or overwritten

      • EXCEL.EXE (PID: 632)

    • Drops executable file immediately after starts

      • EXCEL.EXE (PID: 632)

    • Unusual execution from Microsoft Office

      • EXCEL.EXE (PID: 632)

    • Registers / Runs the DLL via REGSVR32.EXE

      • EXCEL.EXE (PID: 632)

  • SUSPICIOUS

    • Reads default file associations for system extensions

      • WinRAR.exe (PID: 2076)

    • Reads the computer name

      • WinRAR.exe (PID: 2076)
      • WinRAR.exe (PID: 2924)

    • Checks supported languages

      • WinRAR.exe (PID: 2076)
      • WinRAR.exe (PID: 2924)

    • Application launched itself

      • WinRAR.exe (PID: 2924)

    • Starts Microsoft Office Application

      • WinRAR.exe (PID: 2076)

    • Drops a file with a compile date too recent

      • EXCEL.EXE (PID: 632)

  • INFO

    • Reads Microsoft Office registry keys

      • WinRAR.exe (PID: 2076)
      • EXCEL.EXE (PID: 632)

    • Checks supported languages

      • EXCEL.EXE (PID: 632)
      • regsvr32.exe (PID: 3700)
      • regsvr32.exe (PID: 2184)
      • regsvr32.exe (PID: 2292)
      • regsvr32.exe (PID: 2580)

    • Reads the computer name

      • EXCEL.EXE (PID: 632)

    • Creates files in the user directory

      • EXCEL.EXE (PID: 632)

    • Checks Windows Trust Settings

      • EXCEL.EXE (PID: 632)

    • Reads settings of System Certificates

      • EXCEL.EXE (PID: 632)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: PO000000229819.zip
ZipUncompressedSize: 18740
ZipCompressedSize: 18740
ZipCRC: 0x1f505c39
ZipModifyDate: 2022:06:27 01:58:24
ZipCompression: None
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
7
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs winrar.exe no specs excel.exe regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2924"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\DoIT Zipped.zip"C:\Program Files\WinRAR\WinRAR.exe—Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
2076"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\Rar$DIa2924.22743\PO000000229819.zipC:\Program Files\WinRAR\WinRAR.exe—WinRAR.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
632"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /ddeC:\Program Files\Microsoft Office\Office14\EXCEL.EXE
WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Version:
14.0.6024.1000
3700C:\Windows\System32\regsvr32.exe /S ..\peg1.ocxC:\Windows\System32\regsvr32.exe—EXCEL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft(C) Register Server
Exit code:
3
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2292C:\Windows\System32\regsvr32.exe /S ..\peg2.ocxC:\Windows\System32\regsvr32.exe—EXCEL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft(C) Register Server
Exit code:
3
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2580C:\Windows\System32\regsvr32.exe /S ..\peg3.ocxC:\Windows\System32\regsvr32.exe—EXCEL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft(C) Register Server
Exit code:
3
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2184C:\Windows\System32\regsvr32.exe /S ..\peg4.ocxC:\Windows\System32\regsvr32.exe—EXCEL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft(C) Register Server
Exit code:
3
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
7 963
Read events
7 846
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
6
Text files
1
Unknown types
2

Dropped files

PID
Process
Filename
Type
632EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVRB586.tmp.cvr —
MD5:—
SHA256:—
632EXCEL.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:1343BA02220E091D3DAD9A8673792F25
SHA256:F7C8E60A805D8C07BD5BF7A6506DF810FC4597C4D27DF04E0F9F62199CCBE489
632EXCEL.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\1G2JFQWX.txttext
MD5:9F16BA3A8682E226D82E717CDC6F4E50
SHA256:EE1DD12AFA99F6BDA95BB1AC9441CE060417961CB9C7C413411FF48AED4C9CA6
632EXCEL.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751binary
MD5:A52CAAA0CAFFB1CD70A53D59B7D2E085
SHA256:6D202B44E42C18DA31480DF94CDC9BA04D6603C5EEE5D0F39168355A17297016
632EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\5eArcW7P[1].dllexecutable
MD5:400ACF98C6709C5789F5AE59287C8E8E
SHA256:3A845CF36F9A04EB6FA48E329316966BC0FA456D1DC68CE315E41BDDA3B50EC4
2076WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIb2076.22933\PO000000229819.xlsdocument
MD5:B4AA7A6790D8D0A4484FEE5C9D3EDD91
SHA256:A0DE1F3AF78BEF68DDFCABF4B7CEDFA0E466AC65648A5E81E591702B463C96B1
632EXCEL.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F8B7C3256F5D1243492F6BA96F024FA4der
MD5:DFB97CE42C51D9577C51952074F98ACE
SHA256:275CDC9078983DFA7BFE78C09839BE9C86A51C25C064A7C07CFD6D7A04EF958B
2924WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa2924.22743\PO000000229819.zipcompressed
MD5:10B67183602618AF6816A0617C6C38E5
SHA256:B658F8639AD4AB11FF5B3E7E84A3725BFB1D4CF334722460272646FA22925F91
632EXCEL.EXEC:\Users\admin\peg1.ocxexecutable
MD5:400ACF98C6709C5789F5AE59287C8E8E
SHA256:3A845CF36F9A04EB6FA48E329316966BC0FA456D1DC68CE315E41BDDA3B50EC4
632EXCEL.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F8B7C3256F5D1243492F6BA96F024FA4binary
MD5:AEFD2E7784233D30EF94087F8FBE4CB4
SHA256:1550E820CC6C9E43468DAF83CCF3170D2E735E7554BF885E3E58842E89F5FBFC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
10
DNS requests
7
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
632
EXCEL.EXE
GET
200
166.62.28.144:80
http://subbalakshmi.com/data_winning/kYv6xb/
US
executable
314 Kb
suspicious
632
EXCEL.EXE
GET
—
177.11.48.94:80
http://www.dh.net.br/catalogo1/0cJpUJXBhuBaMdVWQf/
BR
—
—
unknown
632
EXCEL.EXE
GET
200
96.16.145.230:80
http://x1.c.lencr.org/
US
der
717 b
whitelisted
632
EXCEL.EXE
GET
200
23.216.77.69:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?053cfc456071b46b
US
compressed
4.70 Kb
whitelisted
632
EXCEL.EXE
GET
200
184.24.77.54:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgM1OnL%2FOkWb2eDsuqsGNmS02g%3D%3D
US
der
503 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
632
EXCEL.EXE
96.16.145.230:80
x1.c.lencr.org
Akamai Technologies, Inc.
US
suspicious
632
EXCEL.EXE
103.45.230.202:443
webhoanggia.com
Quang Trung Software City Development Company
VN
suspicious
632
EXCEL.EXE
166.62.28.144:80
subbalakshmi.com
GoDaddy.com, LLC
US
suspicious
632
EXCEL.EXE
23.216.77.69:80
ctldl.windowsupdate.com
NTT DOCOMO, INC.
US
suspicious
632
EXCEL.EXE
184.24.77.54:80
r3.o.lencr.org
Time Warner Cable Internet LLC
US
suspicious
632
EXCEL.EXE
175.45.125.128:443
www.controlnetworks.com.au
Vocus Connect International Backbone
AU
suspicious
632
EXCEL.EXE
177.11.48.94:80
www.dh.net.br
Brasil Site Informatica LTDA
BR
unknown

DNS requests

Domain
IP
Reputation
subbalakshmi.com
  • 166.62.28.144
suspicious
webhoanggia.com
  • 103.45.230.202
unknown
ctldl.windowsupdate.com
  • 23.216.77.69
  • 23.216.77.80
whitelisted
x1.c.lencr.org
  • 96.16.145.230
whitelisted
r3.o.lencr.org
  • 184.24.77.54
  • 184.24.77.79
shared
www.dh.net.br
  • 177.11.48.94
unknown
www.controlnetworks.com.au
  • 175.45.125.128
suspicious

Threats

PID
Process
Class
Message
632
EXCEL.EXE
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
632
EXCEL.EXE
A Network Trojan was detected
ET CURRENT_EVENTS Likely Evil EXE download from MSXMLHTTP non-exe extension M2
632
EXCEL.EXE
Misc activity
ET INFO EXE - Served Attached HTTP
632
EXCEL.EXE
Potentially Bad Traffic
ET INFO TLS Handshake Failure
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
DoIT Zipped.zip