analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

5145777101275136.zip

Full analysis: https://app.any.run/tasks/252e95ed-1ead-432f-80e2-41d4680471a3
Verdict: Malicious activity
Analysis date: August 13, 2019, 13:31:41
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

BF899379F8189F478E9B95040FC71595

SHA1:

6995BF3971738EC94A8277B8D34AFDAC0F5BAC3A

SHA256:

32E05C82FA5C4300E0AFE366F3C96DF7B411A68E28B506A92760C55D3EADE876

SSDEEP:

384:LVFvP+TIW5SVm99cqQbZR/M9N/8e582/pPHQz6unAjZJdFDd0zzwXoo:Lbm99pQH/+8eb/pfQsjfd12o

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executable content was dropped or overwritten

      • WINWORD.EXE (PID: 3840)

    • Unusual execution from Microsoft Office

      • WINWORD.EXE (PID: 3840)

    • Application was dropped or rewritten from another process

      • svhost.exe (PID: 1952)

    • Loads dropped or rewritten executable

      • svhost.exe (PID: 1952)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • svhost.exe (PID: 1952)

    • Creates files in the user directory

      • svhost.exe (PID: 1952)

  • INFO

    • Manual execution by user

      • WINWORD.EXE (PID: 3840)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3840)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 3840)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: e9c7aace13382d774fd38f906dfac10e2e91aaf953590895a7437117cb79ad54
ZipUncompressedSize: 232924
ZipCompressedSize: 21414
ZipCRC: 0x00000000
ZipModifyDate: 1980:00:00 00:00:00
ZipCompression: Unknown (99)
ZipBitFlag: 0x0009
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
3
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start winrar.exe no specs winword.exe svhost.exe

Process information

PID
CMD
Path
Indicators
Parent process
3300"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\5145777101275136.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
3840"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\e9c7aace13382d774fd38f906dfac10e2e91aaf953590895a7437117cb79ad54.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
1952C:\Users\admin\AppData\Roaming\svhost.exeC:\Users\admin\AppData\Roaming\svhost.exe
WINWORD.EXE
User:
admin
Integrity Level:
MEDIUM
Total events
1 705
Read events
1 332
Write events
0
Delete events
0

Modification events

No data
Executable files
6
Suspicious files
3
Text files
15
Unknown types
4

Dropped files

PID
Process
Filename
Type
3840WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRF040.tmp.cvr —
MD5:—
SHA256:—
3840WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\3C4D8399.png —
MD5:—
SHA256:—
3840WINWORD.EXEC:\Users\admin\AppData\Roaming\svhost.exeexecutable
MD5:827156E633E18F8EABC3D7ADB7B94FEF
SHA256:C8267562616B9257CAD37631F513DC20C5549E2A69B427786F7976518E73F559
3840WINWORD.EXEC:\Users\admin\AppData\Local\Temp\Abctfhghghghghg.scTbinary
MD5:727E9D320415108DD8759BECB6DE65BE
SHA256:86FECBD0610AD00DE168619378972FD60C989FDF084FA0466CE1BA81D79D9F14
3840WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\jl[1].exeexecutable
MD5:827156E633E18F8EABC3D7ADB7B94FEF
SHA256:C8267562616B9257CAD37631F513DC20C5549E2A69B427786F7976518E73F559
1952svhost.exeC:\Users\admin\AppData\Local\Temp\publisher\mtime\sserver\winforms03162004fig10.gifimage
MD5:4F7780754758FBD0DBBA456956E768EE
SHA256:8547B95E538F4318186CC39F7251D78152DCBF930B017E607605D762A610B98E
1952svhost.exeC:\Users\admin\AppData\Roaming\bulk\prune\vnd.ms-cab-compressed.xmlxml
MD5:2E930219047AE4022A1768541DBE9051
SHA256:B53ABCC635097BB290924F237D3D4584C9545CF7A40320E4A38CD39A3EC115B9
1952svhost.exeC:\Users\admin\AppData\Local\Temp\comments\re\lvmsadctext
MD5:EBA0B38F08261BB774B05A5E2819B0B2
SHA256:92D3AC376E5375101861C26835838C4D0E336ADB62690C7D782D148216F4AEB6
3300WinRAR.exeC:\Users\admin\Desktop\e9c7aace13382d774fd38f906dfac10e2e91aaf953590895a7437117cb79ad54text
MD5:922889CB82B99B9A3D6C660C5E205016
SHA256:E9C7AACE13382D774FD38F906DFAC10E2E91AAF953590895A7437117CB79AD54
1952svhost.exeC:\Users\admin\AppData\Local\Temp\comments\re\RedCircle42,8,8.gifimage
MD5:3F227564002E08816324571F94B6F416
SHA256:1A90938B319AECF48BDFD44BD41541351926CBC4579739FF0CF3C01C0241F4B5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3840
WINWORD.EXE
191.6.204.108:443
samanthazanco.com.br
IPV6 Internet Ltda
BR
unknown

DNS requests

Domain
IP
Reputation
samanthazanco.com.br
  • 191.6.204.108
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
5145777101275136.zip