analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

CCGEN v1.0.zip

Full analysis: https://app.any.run/tasks/b5acb8ae-fe2f-48be-83be-f456f2557749
Verdict: Malicious activity
Analysis date: July 12, 2020, 17:16:44
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

638EA5CFDEA0111E0240D2304C4F1167

SHA1:

2423B9719818F0E5662463B2F326FE9DE143D7C9

SHA256:

2B1854DB2CC5E9BB0B61261007EAE7B7CA6CA2A5530548967D2B311E074D3AE8

SSDEEP:

12288:aZNpt2Z3FfDJYzJzOd9r47v+1S0jsERkntvdKK3qTf4QbhYPpBKVrUgylx2J:qghDJQJz6yiMEIJdKGqL/NYPXKxtylxI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • CCGEN v1.0.exe (PID: 1672)
      • SearchProtocolHost.exe (PID: 316)
      • CCGEN v1.0.exe (PID: 4076)
      • CCGEN v1.0.exe (PID: 2536)

    • Application was dropped or rewritten from another process

      • CCGEN v1.0.exe (PID: 1672)
      • CCGEN v1.0.exe (PID: 4076)
      • CCGEN v1.0.exe (PID: 2536)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1248)

  • INFO

    • Manual execution by user

      • NOTEPAD.EXE (PID: 2368)
      • CCGEN v1.0.exe (PID: 1672)
      • CCGEN v1.0.exe (PID: 4076)
      • CCGEN v1.0.exe (PID: 2536)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: CCGEN v1.0/
ZipUncompressedSize: -
ZipCompressedSize: -
ZipCRC: 0x00000000
ZipModifyDate: 2020:07:12 15:44:29
ZipCompression: None
ZipBitFlag: -
ZipRequiredVersion: 10
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
6
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe searchprotocolhost.exe no specs ccgen v1.0.exe no specs notepad.exe no specs ccgen v1.0.exe no specs ccgen v1.0.exe

Process information

PID
CMD
Path
Indicators
Parent process
1248"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\CCGEN v1.0.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
316"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
1672"C:\Users\admin\Desktop\CCGEN v1.0\CCGEN v1.0.exe" C:\Users\admin\Desktop\CCGEN v1.0\CCGEN v1.0.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
CCGEN
Exit code:
0
Version:
1.0.0.0
2368"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\Generated 1387 Credit Cards.txtC:\Windows\system32\NOTEPAD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
4076"C:\Users\admin\Desktop\CCGEN v1.0\CCGEN v1.0.exe" C:\Users\admin\Desktop\CCGEN v1.0\CCGEN v1.0.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
CCGEN
Exit code:
0
Version:
1.0.0.0
2536"C:\Users\admin\Desktop\CCGEN v1.0\CCGEN v1.0.exe" C:\Users\admin\Desktop\CCGEN v1.0\CCGEN v1.0.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
CCGEN
Version:
1.0.0.0
Total events
1 460
Read events
1 337
Write events
0
Delete events
0

Modification events

No data
Executable files
3
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
1248WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1248.5438\CCGEN v1.0\CCGEN v1.0.exeexecutable
MD5:F868890365981DF0D05BA8FAB5DBA250
SHA256:E4775EFDE40FCB66C631A45FFA55762FA707D79F74549E58752DA720FF6C1C8A
1672CCGEN v1.0.exeC:\Users\admin\Desktop\Generated 1387 Credit Cards.txttext
MD5:100A7C257A5BF558C4DDBFCCC130ACEF
SHA256:813683F8EF52DEAE1E8C7827A84E2189A82E4F627D847F735FE7DEC59F0B1AB2
1248WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1248.5438\CCGEN v1.0\Kidux64.dllexecutable
MD5:ADF108AF551793F9883E5FF77070B826
SHA256:835305F52DD417990CD13F8D1B71C77BC2F93CF5CBC1647F1A4F7AC3ECD24674
1248WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1248.5438\CCGEN v1.0\Kidux32.dllexecutable
MD5:54FB01CC27DE40B955FD59AAD9AFB0D2
SHA256:D3B44E0DCEB22FAB65F0ACFA09FF136916FCD45DA51DACC338A969E85A5BDAD7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
CCGEN v1.0.zip