analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

4837005644464128.zip

Full analysis: https://app.any.run/tasks/20dad6a6-9b42-4976-ba77-5ecc064a6b47
Verdict: Malicious activity
Analysis date: August 17, 2019, 11:33:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

DF7857EE42958585CD426417CD553AC3

SHA1:

6E38449B17AD4C3056F87C61797B1EB93CE88859

SHA256:

2CFC9FA5DF7FE60B91F0D57BBAD8F70C4C0F351DAFFF131C77D024422C9A34AC

SSDEEP:

1536:SZbZ8JM8iqCaG9uPTYq0dZyO5PO6nbhUO2huf:kbZz/qQuPTcJ5Gk2huf

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses WMIC.EXE to invoke XSL script

      • WINWORD.EXE (PID: 3896)

    • Unusual execution from Microsoft Office

      • WINWORD.EXE (PID: 3896)

  • SUSPICIOUS

    • Starts Microsoft Office Application

      • rundll32.exe (PID: 2276)

    • Uses RUNDLL32.EXE to load library

      • WinRAR.exe (PID: 3496)

  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 3896)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3896)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0009
ZipCompression: Unknown (99)
ZipModifyDate: 1980:00:00 00:00:00
ZipCRC: 0x00000000
ZipCompressedSize: 55069
ZipUncompressedSize: 107008
ZipFileName: 888c0731668382751931506832188d492d21ac6bca53fbdba7408f34b4d11e89
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
4
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs rundll32.exe no specs winword.exe no specs wmic.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3496"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\4837005644464128.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
2276"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\Rar$DIb3496.12735\888c0731668382751931506832188d492d21ac6bca53fbdba7408f34b4d11e89C:\Windows\system32\rundll32.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3896"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Rar$DIb3496.12735\888c0731668382751931506832188d492d21ac6bca53fbdba7408f34b4d11e89"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
3740"C:\Windows\System32\wbem\wmic.exe" process list /format:"aOlNZc.xsl"C:\Windows\System32\wbem\wmic.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
2147614729
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
2 070
Read events
1 583
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
1
Text files
1
Unknown types
3

Dropped files

PID
Process
Filename
Type
3896WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVREE4.tmp.cvr —
MD5:—
SHA256:—
3896WINWORD.EXEC:\Users\admin\AppData\Local\Temp\Rar$DIb3496.12735\~$8c0731668382751931506832188d492d21ac6bca53fbdba7408f34b4d11e89pgc
MD5:98B8D49E8C8D756954902E71642DA4A4
SHA256:E1CC47D952F6891054713CAFCB380ACA0D2F503B53991D1F61FBF1DE957604D0
3496WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIb3496.12735\888c0731668382751931506832188d492d21ac6bca53fbdba7408f34b4d11e89document
MD5:42C2C7EE74B65CAF88BA1F73DB9A9ACA
SHA256:888C0731668382751931506832188D492D21AC6BCA53FBDBA7408F34B4D11E89
3896WINWORD.EXEC:\Users\admin\AppData\Local\Temp\aOlNZc.xslxml
MD5:336D8A04176C5228B0AE87F10E632EB2
SHA256:8C4158C67D4C68FD5FC8C801CE69F831086E6846D92C9FEC600A64C78FED41C2
3896WINWORD.EXEC:\Users\admin\AppData\Local\Temp\VBE\MSForms.exdtlb
MD5:DED110949A11F069CB09854ECB6CF9C6
SHA256:5491E2ED25A6483FBBBFE5060D0F1F245874CC7948ADE58792524C8CB23DE763
3896WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:BA9E148239E8758B683B0FF54F0260CD
SHA256:2792F84B796D24EB2A98D845B99E29E5795258F8E7F03A521983720631F69C1F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

Domain
IP
Reputation
mgregyoherminio.com
  • —
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
4837005644464128.zip