analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Список док-ов за прошлый месяц.001

Full analysis: https://app.any.run/tasks/692e7d54-bee4-4caa-8a5e-f3b65db50dbe
Verdict: Malicious activity
Analysis date: October 14, 2019, 10:31:51
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

91861FD3E18AC68FF47A66AEE0F5A108

SHA1:

1962D2C9C978852A1A139932754B3D748C9B464D

SHA256:

33BC07770775C641077A82A234B9EBED450F51F7367727955E6F4626BC3E9C90

SSDEEP:

1536:OsAvTG/ZguVvrWZQj8bnbv7tDEWVUlYgUdw78eMoQb3/tEg:fAvTG/xW/vBpVU+d40oQb1r

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Список док-ов за прошлый месяц.exe (PID: 2124)
      • Список док-ов за прошлый месяц.exe (PID: 1016)

  • SUSPICIOUS

    • Uses RUNDLL32.EXE to load library

      • WinRAR.exe (PID: 1756)

    • Starts Internet Explorer

      • rundll32.exe (PID: 1216)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1756)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 2880)

    • Changes internet zones settings

      • iexplore.exe (PID: 2880)

    • Reads internet explorer settings

      • iexplore.exe (PID: 1488)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2880)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2880)

    • Creates files in the user directory

      • iexplore.exe (PID: 1488)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 1488)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2880)

    • Application was crashed

      • Список док-ов за прошлый месяц.exe (PID: 2124)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
8
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start start winrar.exe rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs iexplore.exe iexplore.exe список док-ов за прошлый месяц.exe список док-ов за прошлый месяц.exe

Process information

PID
CMD
Path
Indicators
Parent process
1756"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Список док-ов за прошлый месяц.001.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
2968"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\Rar$DIa1756.14720\Список док-ов за прошлый месяц.ex_C:\Windows\system32\rundll32.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2860"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\Rar$DIa1756.14824\Список док-ов за прошлый месяц.ex_C:\Windows\system32\rundll32.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1216"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\Rar$DIa1756.14829\Список док-ов за прошлый месяц.ex_C:\Windows\system32\rundll32.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2880"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
1488"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2880 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2124"C:\Users\admin\AppData\Local\Temp\Rar$EXa1756.18423\Список док-ов за прошлый месяц.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa1756.18423\Список док-ов за прошлый месяц.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
1016"C:\Users\admin\AppData\Local\Temp\Rar$EXa1756.18423\Список док-ов за прошлый месяц.exe" dfsrC:\Users\admin\AppData\Local\Temp\Rar$EXa1756.18423\Список док-ов за прошлый месяц.exe
Список док-ов за прошлый месяц.exe
User:
admin
Integrity Level:
MEDIUM
Total events
1 011
Read events
885
Write events
0
Delete events
0

Modification events

No data
Executable files
4
Suspicious files
1
Text files
23
Unknown types
6

Dropped files

PID
Process
Filename
Type
2880iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\favicon[1].ico —
MD5:—
SHA256:—
2880iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
1488iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@bing[2].txt —
MD5:—
SHA256:—
1488iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\HIFZ4ISR\search[1].txt —
MD5:—
SHA256:—
1756WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa1756.14829\Список док-ов за прошлый месяц.ex_executable
MD5:608750B1779C67BB598737690140B09E
SHA256:F38C795EA17880BE245A351E07EAFCF85D8B47DFCD5C51161E3D8D73F86D29B1
1488iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@bing[1].txttext
MD5:D320D8A5C775F9E6491732DAE3B4724F
SHA256:6FCE8D8BD5B2E688FF6B33583015E0DCC4CDECB160267880CBF345C5240E66B5
1488iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DATdbf
MD5:D52DB6EBED3A4ED299CBDD902599D416
SHA256:4FC4B4DF6FBD2DC5CCF87E67C59EE49B7284819830E76DFD036CA85B121C250D
1488iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.datdat
MD5:24A83213E9D1FC6849B6495525527116
SHA256:566217D04E84399443E89DAABD185892BD879668D4C0E771FE3FCDA44D68636D
1488iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txttext
MD5:6ABFC3877136A666F21B4182B4E0E248
SHA256:B53F7639F44B2B57B54F82824F5592B5980FD7DC47FD72491AB90DE9601ED9A0
2880iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012019101420191015\index.datdat
MD5:E754D46941CE5118BB045FFB0FDCEB50
SHA256:0FC2F486ABA2DCB9CBC204EB4C02B6C90D86B06BD356938DACE9D5A0F4C65C5A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
15
DNS requests
6
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1488
iexplore.exe
GET
301
2.16.186.24:80
http://shell.windows.com/fileassoc/fileassoc.asp?Ext=ex_
unknown
—
—
whitelisted
2880
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2880
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
2880
iexplore.exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
1488
iexplore.exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
1488
iexplore.exe
104.108.44.35:80
go.microsoft.com
Akamai Technologies, Inc.
NL
whitelisted
1488
iexplore.exe
2.16.186.24:80
shell.windows.com
Akamai International B.V.
—
whitelisted
1488
iexplore.exe
40.90.23.247:443
login.live.com
Microsoft Corporation
US
unknown
1016
Список док-ов за прошлый месяц.exe
104.16.55.3:443
blockchain.info
Cloudflare Inc
US
shared
1016
Список док-ов за прошлый месяц.exe
54.164.0.55:443
api.blockcypher.com
Amazon.com, Inc.
US
malicious

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
go.microsoft.com
  • 104.108.44.35
whitelisted
shell.windows.com
  • 2.16.186.24
  • 2.16.186.27
whitelisted
login.live.com
  • 40.90.23.247
  • 40.90.137.125
  • 40.90.137.126
whitelisted
blockchain.info
  • 104.16.55.3
  • 104.16.54.3
shared
api.blockcypher.com
  • 54.164.0.55
  • 34.206.50.228
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Список док-ов за прошлый месяц.001