File name:

Ana.zip

Full analysis: https://app.any.run/tasks/e254d81d-02f7-4e4a-9b7b-4744006190c5
Verdict: Malicious activity
Analysis date: December 02, 2023, 13:14:53
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

CB6E4F6660706C29035189F8AACFE3F8

SHA1:

7DD1E37A50D4BD7488A3966B8C7C2B99BBA2C037

SHA256:

3341ABF6DBEFB8AEC171F3766A4A23F323FF207E1B031946EE4DBE6DBB2D45A4

SSDEEP:

49152:8x24Hl93N3yArA1CYa0HnhDJBFxDXHVtQvEG:mHj3xyArA1CYfnhnLDkvEG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Endermanch@Ana.exe (PID: 1924)
      • SB.EXE (PID: 1116)
      • setup437922456.exe (PID: 3200)
      • AV2.EXE (PID: 2628)
      • DB.EXE (PID: 1992)
      • Endermanch@Ana.exe (PID: 2248)
      • SB.EXE (PID: 3096)
      • setup2375382368.exe (PID: 3912)

    • Creates a writable file in the system directory

      • DB.EXE (PID: 1992)

    • Changes the autorun value in the registry

      • iK17766NiLjK17766.exe (PID: 4040)

  • SUSPICIOUS

    • Reads the Internet Settings

      • Endermanch@Ana.exe (PID: 1924)
      • EN.EXE (PID: 2540)
      • DB.EXE (PID: 3064)
      • SB.EXE (PID: 1116)
      • AV2.EXE (PID: 2628)
      • iK17766NiLjK17766.exe (PID: 4040)
      • Endermanch@Ana.exe (PID: 2248)
      • DB.EXE (PID: 1992)
      • DB.EXE (PID: 1616)
      • EN.EXE (PID: 1752)
      • SB.EXE (PID: 3096)

    • Reads the BIOS version

      • DB.EXE (PID: 3064)
      • DB.EXE (PID: 1992)
      • DB.EXE (PID: 1616)

    • Starts itself from another location

      • SB.EXE (PID: 1116)
      • SB.EXE (PID: 3096)

    • Application launched itself

      • DB.EXE (PID: 3064)

    • The process executes via Task Scheduler

      • rundll32.exe (PID: 284)

    • Executing commands from a ".bat" file

      • DB.EXE (PID: 1992)
      • DB.EXE (PID: 1616)

    • Starts CMD.EXE for commands execution

      • DB.EXE (PID: 1992)
      • EN.EXE (PID: 1752)
      • EN.EXE (PID: 2540)
      • DB.EXE (PID: 1616)

  • INFO

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 844)

    • Create files in a temporary directory

      • AV.EXE (PID: 2780)
      • Endermanch@Ana.exe (PID: 1924)
      • SB.EXE (PID: 1116)
      • setup437922456.exe (PID: 3200)
      • EN.EXE (PID: 2540)
      • AV2.EXE (PID: 2628)
      • Endermanch@Ana.exe (PID: 2248)
      • DB.EXE (PID: 1992)
      • SB.EXE (PID: 3096)
      • setup2375382368.exe (PID: 3912)
      • AV2.EXE (PID: 3860)
      • EN.EXE (PID: 1752)
      • DB.EXE (PID: 1616)

    • Process checks are UAC notifies on

      • DB.EXE (PID: 3064)
      • DB.EXE (PID: 1992)
      • DB.EXE (PID: 1616)

    • Reads the computer name

      • Endermanch@Ana.exe (PID: 1924)
      • DB.EXE (PID: 3064)
      • EN.EXE (PID: 2540)
      • dw20.exe (PID: 2908)
      • SB.EXE (PID: 1116)
      • setup437922456.exe (PID: 3200)
      • AV2.EXE (PID: 2628)
      • iK17766NiLjK17766.exe (PID: 4040)
      • DB.EXE (PID: 1992)
      • Endermanch@Ana.exe (PID: 2248)
      • DB.EXE (PID: 1616)
      • SB.EXE (PID: 3096)
      • dw20.exe (PID: 3524)
      • EN.EXE (PID: 1752)
      • setup2375382368.exe (PID: 3912)
      • AV2.EXE (PID: 3860)

    • Checks supported languages

      • Endermanch@Ana.exe (PID: 1924)
      • AV.EXE (PID: 2780)
      • AV2.EXE (PID: 2628)
      • DB.EXE (PID: 3064)
      • EN.EXE (PID: 2540)
      • SB.EXE (PID: 1116)
      • setup437922456.exe (PID: 3200)
      • dw20.exe (PID: 2908)
      • iK17766NiLjK17766.exe (PID: 4040)
      • DB.EXE (PID: 1992)
      • Endermanch@Ana.exe (PID: 2248)
      • AV.EXE (PID: 2112)
      • AV2.EXE (PID: 3860)
      • dw20.exe (PID: 3524)
      • DB.EXE (PID: 1616)
      • SB.EXE (PID: 3096)
      • EN.EXE (PID: 1752)
      • setup2375382368.exe (PID: 3912)

    • Reads Windows Product ID

      • DB.EXE (PID: 3064)
      • DB.EXE (PID: 1992)
      • DB.EXE (PID: 1616)

    • Checks proxy server information

      • EN.EXE (PID: 2540)
      • DB.EXE (PID: 3064)
      • AV2.EXE (PID: 2628)
      • iK17766NiLjK17766.exe (PID: 4040)
      • DB.EXE (PID: 1992)
      • DB.EXE (PID: 1616)
      • EN.EXE (PID: 1752)

    • Reads the machine GUID from the registry

      • AV.EXE (PID: 2780)
      • DB.EXE (PID: 3064)
      • dw20.exe (PID: 2908)
      • EN.EXE (PID: 2540)
      • AV2.EXE (PID: 2628)
      • iK17766NiLjK17766.exe (PID: 4040)
      • DB.EXE (PID: 1616)
      • DB.EXE (PID: 1992)
      • AV.EXE (PID: 2112)
      • EN.EXE (PID: 1752)
      • dw20.exe (PID: 3524)

    • Creates files or folders in the user directory

      • dw20.exe (PID: 2908)
      • dw20.exe (PID: 3524)

    • Creates files in the program directory

      • AV2.EXE (PID: 2628)
      • iK17766NiLjK17766.exe (PID: 4040)

    • Manual execution by a user

      • Endermanch@Ana.exe (PID: 2248)
      • AV2.EXE (PID: 944)
      • notepad++.exe (PID: 1828)
      • rundll32.exe (PID: 924)
      • rundll32.exe (PID: 2308)

    • Application launched itself

      • msedge.exe (PID: 3416)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0001
ZipCompression: Deflated
ZipModifyDate: 2011:09:21 08:09:08
ZipCRC: 0x8a7979e4
ZipCompressedSize: 1915365
ZipUncompressedSize: 2173952
ZipFileName: Endermanch@Ana.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
99
Monitored processes
38
Malicious processes
9
Suspicious processes
5

Behavior graph

Click at the process to see the details
start winrar.exe no specs endermanch@ana.exe av.exe av2.exe db.exe en.exe no specs sb.exe no specs dw20.exe no specs setup437922456.exe no specs setup437922456.exe ik17766niljk17766.exe db.exe endermanch@ana.exe rundll32.exe no specs av.exe cmd.exe no specs av2.exe no specs db.exe en.exe no specs sb.exe no specs dw20.exe no specs setup2375382368.exe no specs setup2375382368.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs av2.exe no specs notepad++.exe no specs rundll32.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs rundll32.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
284C:\Windows\system32\rundll32.exe "C:\Windows\system32\PINGM.dll",iyhrlpfrvlC:\Windows\System32\rundll32.exe—taskeng.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
644"C:\Windows\system32\cmd.exe" /c del C:\Users\admin\AppData\Local\Temp\EN.EXE > nulC:\Windows\System32\cmd.exe—EN.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
844"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Ana.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
924"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\q4hg4341.cc2C:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
944"C:\Users\admin\AppData\Local\Temp\AV2.EXE" C:\Users\admin\AppData\Local\Temp\AV2.EXE—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
1116"C:\Users\admin\AppData\Local\Temp\SB.EXE" C:\Users\admin\AppData\Local\Temp\SB.EXE—Endermanch@Ana.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\sb.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
1600 /c C:\Users\admin\AppData\Local\Temp\~unins687.bat "C:\Users\admin\AppData\Local\Temp\DB.EXE"C:\Windows\System32\cmd.exe—DB.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1608"C:\Users\admin\AppData\Local\Temp\setup437922456.exe" C:\Users\admin\AppData\Local\Temp\setup437922456.exe—SB.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\setup437922456.exe
c:\windows\system32\ntdll.dll
1616"C:\Users\admin\AppData\Local\Temp\DB.EXE" C:\Users\admin\AppData\Local\Temp\DB.EXE
Endermanch@Ana.exe
User:
admin
Company:
Prjfeusek Vdceboszrya
Integrity Level:
MEDIUM
Description:
Internet Connection Wizard
Exit code:
0
Version:
6.00.3790.3959 (srv03_sp2_rtm.070216-1710)
Modules
Images
c:\users\admin\appdata\local\temp\db.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\imagehlp.dll
c:\windows\system32\ole32.dll
1752"C:\Users\admin\AppData\Local\Temp\EN.EXE" C:\Users\admin\AppData\Local\Temp\EN.EXE—Endermanch@Ana.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\en.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ddraw.dll
c:\windows\system32\user32.dll
Total events
8 892
Read events
8 252
Write events
638
Delete events
2

Modification events

(PID) Process:(844) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(844) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(844) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(844) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(844) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(844) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(844) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(844) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(844) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(844) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
25
Suspicious files
38
Text files
40
Unknown types
0

Dropped files

PID
Process
Filename
Type
2908dw20.exeC:\Users\admin\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_av.exe_bebff19cf845587bb44e6beb0e283247b493ae_0b7caf01\Report.wer —
MD5:—
SHA256:—
1924Endermanch@Ana.exeC:\Users\admin\AppData\Local\Temp\AV.EXEexecutable
MD5:F284568010505119F479617A2E7DC189
SHA256:26C8F13EA8DC17443A9FA005610537CB6700AEBAF748E747E9278D504E416EB1
844WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb844.39263\Endermanch@Ana.exeexecutable
MD5:F571FACA510BFFE809C76C1828D44523
SHA256:117D7AF0DEB40B3FE532BB6CBE374884FA55ED7CFE053FE698720CDCCB5A59CB
1924Endermanch@Ana.exeC:\Users\admin\AppData\Local\Temp\AV2.EXEexecutable
MD5:014578EDB7DA99E5BA8DD84F5D26DFD5
SHA256:4CE5E8B510895ABB204F97E883D8CBAACC29CCEF0844D9AE81F8666F234B0529
1924Endermanch@Ana.exeC:\Users\admin\AppData\Local\Temp\DB.EXEexecutable
MD5:C6746A62FEAFCB4FCA301F606F7101FA
SHA256:B5A255D0454853C8AFC0B321E1D86DCA22C3DBEFB88E5D385D2D72F9BC0109E6
1924Endermanch@Ana.exeC:\Users\admin\AppData\Local\Temp\EN.EXEexecutable
MD5:621F2279F69686E8547E476B642B6C46
SHA256:C17A18CF2C243303B8A6688AAD83B3E6E9B727FCD89F69065785EF7F1A2A3E38
1924Endermanch@Ana.exeC:\Users\admin\AppData\Local\Temp\GB.EXEexecutable
MD5:FE731B4C6684D643EB5B55613EF9ED31
SHA256:E7953DAAD7A68F8634DED31A21A31F0C2AA394CA9232E2F980321F7B69176496
2780AV.EXEC:\Users\admin\AppData\Local\Temp\Rar$EXb844.39263\tsa.crttext
MD5:6E630504BE525E953DEBD0CE831B9AA0
SHA256:2563FE2F793F119A1BAE5CCA6EAB9D8C20409AA1F1E0DB341C623E1251244EF5
1116SB.EXEC:\Users\admin\AppData\Local\Temp\A240.tmpexecutable
MD5:E670CDD55B7BA36F96B0C7B9A0E27E16
SHA256:C1CB673B1CA6734C7C9EC126AA43C0C2E346AC94D4E7BD6545E1066107A3B703
1116SB.EXEC:\Users\admin\AppData\Local\Temp\A22F.tmpexecutable
MD5:9252E1BE9776AF202D6AD5C093637022
SHA256:CE822FF86E584F15B6ABD14C61453BD3B481D4EC3FDEB961787FCEB52ACD8BD6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
32
DNS requests
17
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3064
DB.EXE
66.96.162.135:80
middlechrist.com
BIZLAND-SD
US
unknown
2628
AV2.EXE
178.162.174.147:80
—
LeaseWeb Netherlands B.V.
NL
unknown
4040
iK17766NiLjK17766.exe
178.162.174.147:80
—
LeaseWeb Netherlands B.V.
NL
unknown
1992
DB.EXE
66.96.162.135:80
middlechrist.com
BIZLAND-SD
US
unknown
1616
DB.EXE
66.96.162.135:80
middlechrist.com
BIZLAND-SD
US
unknown
1216
spoolsv.exe
95.143.193.138:80
—
Internetport Sweden AB
SE
unknown

DNS requests

Domain
IP
Reputation
aeravine.com
  • —
unknown
middlechrist.com
  • 66.96.162.135
unknown
bemachin.com
  • —
unknown
dns.msftncsi.com
  • 131.107.255.255
shared
go.microsoft.com
  • 2.19.230.153
whitelisted
config.edge.skype.com
  • 52.123.243.213
  • 52.123.224.64
  • 52.123.243.222
whitelisted
nav-edge.smartscreen.microsoft.com
  • 20.105.95.163
whitelisted
edge.microsoft.com
  • 13.107.21.239
  • 204.79.197.239
whitelisted
wrou1xamwafgmca8ip.com
  • —
unknown

Threats

No threats detected
Process
Message
Endermanch@Ana.exe
C:\Users\admin\AppData\Local\Temp\AV.EXE
Endermanch@Ana.exe
C:\Users\admin\AppData\Local\Temp\AV2.EXE
Endermanch@Ana.exe
C:\Users\admin\AppData\Local\Temp\DB.EXE
Endermanch@Ana.exe
C:\Users\admin\AppData\Local\Temp\EN.EXE
Endermanch@Ana.exe
C:\Users\admin\AppData\Local\Temp\GB.EXE
Endermanch@Ana.exe
C:\Users\admin\AppData\Local\Temp\SB.EXE
Endermanch@Ana.exe
C:\Users\admin\AppData\Local\Temp\AV.EXE
Endermanch@Ana.exe
C:\Users\admin\AppData\Local\Temp\AV2.EXE
Endermanch@Ana.exe
C:\Users\admin\AppData\Local\Temp\DB.EXE
Endermanch@Ana.exe
C:\Users\admin\AppData\Local\Temp\EN.EXE
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Ana.zip