File name:

CopyTrans Photo 4.403.zip

Full analysis: https://app.any.run/tasks/231d5ca2-3e39-40d9-aa3b-50a1f2f79ba6
Verdict: Malicious activity
Analysis date: April 27, 2020, 04:29:21
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

9D70DD15A6EADFBF14D19E55E56D3489

SHA1:

2FA5F728832049A769D4761D2FA2544B777303E0

SHA256:

2F29FC7D1A3A5F28A4429E8FFEEFE8C5B07555A13719BA255D73A3D43FCCBEC6

SSDEEP:

12288:sycdKiUzzECPHaL+dOv12OiraGfeHPXu9YWVPYDk0zHKwbSYfX7+2R/ZpW707iGb:50uzwsHaLWOQXrpGvX6tiDBeSq2RBpWG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • CopyTrans Photo 4.403.exe (PID: 3420)
      • CopyTrans Photo 4.403.exe (PID: 2360)
      • sysinfo.exe (PID: 3728)

    • Uses Task Scheduler to run other applications

      • sysinfo.exe (PID: 3728)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 1784)
      • schtasks.exe (PID: 3164)

    • Changes settings of System certificates

      • CopyTrans Photo 4.403.tmp (PID: 1136)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3880)
      • CopyTrans Photo 4.403.exe (PID: 3420)
      • CopyTrans Photo 4.403.tmp (PID: 1136)
      • CopyTrans Photo 4.403.exe (PID: 2360)
      • 7za.exe (PID: 3996)

    • Reads the Windows organization settings

      • CopyTrans Photo 4.403.tmp (PID: 1136)

    • Reads Windows owner or organization settings

      • CopyTrans Photo 4.403.tmp (PID: 1136)

    • Creates files in the user directory

      • CopyTrans Photo 4.403.tmp (PID: 1136)
      • sysinfo.exe (PID: 3728)

    • Executed via COM

      • explorer.exe (PID: 2108)

    • Adds / modifies Windows certificates

      • CopyTrans Photo 4.403.tmp (PID: 1136)

  • INFO

    • Application was dropped or rewritten from another process

      • CopyTrans Photo 4.403.tmp (PID: 1136)
      • 7za.exe (PID: 3544)
      • 7za.exe (PID: 3996)
      • 7za.exe (PID: 3668)
      • CopyTrans Photo 4.403.tmp (PID: 3388)

    • Manual execution by user

      • CopyTrans Photo 4.403.exe (PID: 3420)

    • Reads settings of System Certificates

      • CopyTrans Photo 4.403.tmp (PID: 1136)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0001
ZipCompression: Deflated
ZipModifyDate: 2020:04:27 07:27:29
ZipCRC: 0x643e0da0
ZipCompressedSize: 684037
ZipUncompressedSize: 757911
ZipFileName: CopyTrans Photo 4.403.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
57
Monitored processes
13
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start winrar.exe copytrans photo 4.403.exe copytrans photo 4.403.tmp no specs copytrans photo 4.403.exe copytrans photo 4.403.tmp 7za.exe no specs 7za.exe 7za.exe no specs sysinfo.exe no specs schtasks.exe no specs schtasks.exe no specs explorer.exe no specs explorer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1136"C:\Users\admin\AppData\Local\Temp\is-U6R5U.tmp\CopyTrans Photo 4.403.tmp" /SL5="$801E0,367862,121344,C:\Users\admin\Desktop\CopyTrans Photo 4.403.exe" /SPAWNWND=$80194 /NOTIFYWND=$80130 C:\Users\admin\AppData\Local\Temp\is-U6R5U.tmp\CopyTrans Photo 4.403.tmp
CopyTrans Photo 4.403.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-u6r5u.tmp\copytrans photo 4.403.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
1784"C:\Windows\system32\schtasks.exe" /Delete /tn "Microsoft\Windows\Windows Error Reporting\SystemInfo" /fC:\Windows\system32\schtasks.exe—sysinfo.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2108C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -EmbeddingC:\Windows\explorer.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2360"C:\Users\admin\Desktop\CopyTrans Photo 4.403.exe" /SPAWNWND=$80194 /NOTIFYWND=$80130 C:\Users\admin\Desktop\CopyTrans Photo 4.403.exe
CopyTrans Photo 4.403.tmp
User:
admin
Company:
Integrity Level:
HIGH
Description:
Exit code:
0
Version:
5.2
Modules
Images
c:\users\admin\desktop\copytrans photo 4.403.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2740"explorer.exe" "C:\Users\admin\Desktop\CopyTrans Photo 4.403"C:\Windows\explorer.exe—CopyTrans Photo 4.403.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3164"C:\Windows\system32\schtasks.exe" /Create /f /XML "C:\Users\admin\AppData\Roaming\SystemDiag\data.xml" /tn "Microsoft\Windows\Windows Error Reporting\SystemInfo"C:\Windows\system32\schtasks.exe—sysinfo.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
3388"C:\Users\admin\AppData\Local\Temp\is-4ILD9.tmp\CopyTrans Photo 4.403.tmp" /SL5="$80130,367862,121344,C:\Users\admin\Desktop\CopyTrans Photo 4.403.exe" C:\Users\admin\AppData\Local\Temp\is-4ILD9.tmp\CopyTrans Photo 4.403.tmp—CopyTrans Photo 4.403.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-4ild9.tmp\copytrans photo 4.403.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3420"C:\Users\admin\Desktop\CopyTrans Photo 4.403.exe" C:\Users\admin\Desktop\CopyTrans Photo 4.403.exe
explorer.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
5.2
Modules
Images
c:\users\admin\desktop\copytrans photo 4.403.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
3544"C:\Users\admin\AppData\Local\Temp\is-V0CJU.tmp\7za.exe" x "C:\Users\admin\AppData\Local\Temp\is-V0CJU.tmp\sub.res" -p"b1lig@n_vl"C:\Users\admin\AppData\Local\Temp\is-V0CJU.tmp\7za.exe—CopyTrans Photo 4.403.tmp
User:
admin
Company:
Igor Pavlov
Integrity Level:
HIGH
Description:
7-Zip Standalone Console
Exit code:
0
Version:
4.65
Modules
Images
c:\users\admin\appdata\local\temp\is-v0cju.tmp\7za.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
3668"C:\Users\admin\AppData\Local\Temp\is-V0CJU.tmp\7za.exe" x "C:\Users\admin\AppData\Local\Temp\is-V0CJU.tmp\misc.res" -p"b1lig@n_vl"C:\Users\admin\AppData\Local\Temp\is-V0CJU.tmp\7za.exe—CopyTrans Photo 4.403.tmp
User:
admin
Company:
Igor Pavlov
Integrity Level:
HIGH
Description:
7-Zip Standalone Console
Exit code:
0
Version:
4.65
Modules
Images
c:\users\admin\appdata\local\temp\is-v0cju.tmp\7za.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
Total events
1 738
Read events
541
Write events
1 197
Delete events
0

Modification events

(PID) Process:(3880) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3880) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3880) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3880) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\CopyTrans Photo 4.403.zip
(PID) Process:(3880) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3880) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3880) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3880) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3880) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\DialogEditHistory\ExtrPath
Operation:writeName:0
Value:
C:\Users\admin\Desktop
(PID) Process:(3880) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
Executable files
6
Suspicious files
3
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
1136CopyTrans Photo 4.403.tmpC:\Users\admin\AppData\Local\Temp\{A116156A-F9BF-4318-95AB-3ADB8566D2A9}\is-M6JC6.tmp —
MD5:—
SHA256:—
1136CopyTrans Photo 4.403.tmpC:\Users\admin\AppData\Local\Temp\{A116156A-F9BF-4318-95AB-3ADB8566D2A9}\license.txt —
MD5:—
SHA256:—
3880WinRAR.exeC:\Users\admin\Desktop\CopyTrans Photo 4.403.exeexecutable
MD5:—
SHA256:—
1136CopyTrans Photo 4.403.tmpC:\Users\admin\Desktop\CopyTrans Photo 4.403\license.txttext
MD5:—
SHA256:—
1136CopyTrans Photo 4.403.tmpC:\Users\admin\AppData\Local\Temp\is-V0CJU.tmp\misc.rescompressed
MD5:—
SHA256:—
1136CopyTrans Photo 4.403.tmpC:\Users\admin\AppData\Local\Temp\is-V0CJU.tmp\form.rescompressed
MD5:—
SHA256:—
39967za.exeC:\Users\admin\AppData\Local\Temp\is-V0CJU.tmp\form.exeexecutable
MD5:—
SHA256:—
36687za.exeC:\Users\admin\AppData\Local\Temp\is-V0CJU.tmp\misc.xmlxml
MD5:—
SHA256:—
1136CopyTrans Photo 4.403.tmpC:\Users\admin\AppData\Roaming\SystemDiag\sysinfo.exeexecutable
MD5:—
SHA256:—
1136CopyTrans Photo 4.403.tmpC:\Users\admin\AppData\Roaming\SystemDiag\dataxml
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
3
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1136
CopyTrans Photo 4.403.tmp
GET
301
104.27.143.232:80
http://crackpluskeygen.org/provider
US
—
—
malicious
1136
CopyTrans Photo 4.403.tmp
POST
200
172.217.22.14:80
http://www.google-analytics.com/collect
US
image
35 b
whitelisted
1136
CopyTrans Photo 4.403.tmp
POST
200
172.217.22.14:80
http://www.google-analytics.com/collect
US
image
35 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1136
CopyTrans Photo 4.403.tmp
172.217.22.14:80
www.google-analytics.com
Google Inc.
US
whitelisted
1136
CopyTrans Photo 4.403.tmp
104.27.143.232:80
crackpluskeygen.org
Cloudflare Inc
US
shared
1136
CopyTrans Photo 4.403.tmp
104.27.143.232:443
crackpluskeygen.org
Cloudflare Inc
US
shared

DNS requests

Domain
IP
Reputation
www.google-analytics.com
  • 172.217.22.14
whitelisted
crackpluskeygen.org
  • 104.27.143.232
  • 104.27.142.232
malicious

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
CopyTrans Photo 4.403.zip