analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Список док-ов за прошлый месяц.001

Full analysis: https://app.any.run/tasks/8eec72d0-893a-418c-930e-516020e2ec74
Verdict: Malicious activity
Analysis date: October 14, 2019, 09:39:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

91861FD3E18AC68FF47A66AEE0F5A108

SHA1:

1962D2C9C978852A1A139932754B3D748C9B464D

SHA256:

33BC07770775C641077A82A234B9EBED450F51F7367727955E6F4626BC3E9C90

SSDEEP:

1536:OsAvTG/ZguVvrWZQj8bnbv7tDEWVUlYgUdw78eMoQb3/tEg:fAvTG/xW/vBpVU+d40oQb1r

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Список док-ов за прошлый месяц.exe (PID: 2416)
      • Список док-ов за прошлый месяц.exe (PID: 1792)

  • SUSPICIOUS

    • Starts Internet Explorer

      • rundll32.exe (PID: 1816)

    • Uses RUNDLL32.EXE to load library

      • WinRAR.exe (PID: 2580)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2580)

  • INFO

    • Changes internet zones settings

      • iexplore.exe (PID: 4092)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 640)

    • Reads internet explorer settings

      • iexplore.exe (PID: 640)

    • Creates files in the user directory

      • iexplore.exe (PID: 640)

    • Changes settings of System certificates

      • iexplore.exe (PID: 4092)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 4092)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 4092)

    • Application was crashed

      • Список док-ов за прошлый месяц.exe (PID: 2416)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
7
Malicious processes
0
Suspicious processes
2

Behavior graph

Click at the process to see the details
drop and start start winrar.exe rundll32.exe no specs iexplore.exe iexplore.exe rundll32.exe no specs список док-ов за прошлый месяц.exe список док-ов за прошлый месяц.exe

Process information

PID
CMD
Path
Indicators
Parent process
2580"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Список док-ов за прошлый месяц.001.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
1816"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\Rar$DIa2580.47674\Список док-ов за прошлый месяц.ex_C:\Windows\system32\rundll32.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
4092"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
640"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:4092 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
4040"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\Rar$DIa2580.48819\Список док-ов за прошлый месяц.ex_C:\Windows\system32\rundll32.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2416"C:\Users\admin\AppData\Local\Temp\Rar$EXa2580.2030\Список док-ов за прошлый месяц.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2580.2030\Список док-ов за прошлый месяц.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
1792"C:\Users\admin\AppData\Local\Temp\Rar$EXa2580.2030\Список док-ов за прошлый месяц.exe" dfsrC:\Users\admin\AppData\Local\Temp\Rar$EXa2580.2030\Список док-ов за прошлый месяц.exe
Список док-ов за прошлый месяц.exe
User:
admin
Integrity Level:
MEDIUM
Total events
1 013
Read events
903
Write events
0
Delete events
0

Modification events

No data
Executable files
4
Suspicious files
3
Text files
32
Unknown types
7

Dropped files

PID
Process
Filename
Type
640iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@bing[2].txt —
MD5:—
SHA256:—
640iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\6PN1VC1Z\search[1].txt —
MD5:—
SHA256:—
640iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.datdat
MD5:FE995A52CF0AD2D8753B3D53DA57172C
SHA256:5FF702F1AA8139AA50B5A2F6666E1CC5E57C045DB42FA44640516D179E8E924B
640iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\VYJLRNIP\f8c6dd44[1].jstext
MD5:0FD0568E7B5068E209AC15210AE56FF2
SHA256:B87A66DF064550755C00F605C7463007675490E64346A26DD60246D00E8A09DE
640iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\index.datdat
MD5:0C045CF426C72DEF3ECCEB9DE4D12BF6
SHA256:6D40D04732493301B25DE0F9F61C234D5B12A2048A6FE2EA3AF9297E9938283D
640iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.datdat
MD5:4D281717A7CF07F26330ED8C332D4701
SHA256:87A5F85F85B72A07BD46E6D3A1FA61CE86D8206F36CF7FCAA36A253B2CEA93E7
640iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txttext
MD5:7964EE22AF2EA278513778F03A7D105B
SHA256:7A42C91A4207CC4DA8A620E5B0B6B171B649BD5FDBB1C90FBFFB6F5811F3C30A
640iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\6PN1VC1Z\search[1].htmhtml
MD5:9E9265B4A938CB70F1B3051341340C12
SHA256:F2BE87E9122510FEF3612BD4B2BC106307E81F73E16B1E59246FAEDC5AE85C91
640iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@bing[1].txttext
MD5:DB85165E7B4B0D5A6641902E6434143D
SHA256:6569407D02E1C8453DC038A1EBA8DDE031C600E440DB3B2AE87E7944B340DB72
2580WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa2580.47674\Список док-ов за прошлый месяц.ex_executable
MD5:608750B1779C67BB598737690140B09E
SHA256:F38C795EA17880BE245A351E07EAFCF85D8B47DFCD5C51161E3D8D73F86D29B1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
15
DNS requests
5
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
640
iexplore.exe
GET
301
2.16.186.24:80
http://shell.windows.com/fileassoc/fileassoc.asp?Ext=ex_
unknown
—
—
whitelisted
640
iexplore.exe
GET
302
2.19.38.59:80
http://go.microsoft.com/fwlink/?LinkId=57426&Ext=ex_
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
640
iexplore.exe
2.16.186.24:80
shell.windows.com
Akamai International B.V.
—
whitelisted
4092
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
4092
iexplore.exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
640
iexplore.exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
640
iexplore.exe
2.19.38.59:80
go.microsoft.com
Akamai International B.V.
—
whitelisted
1792
Список док-ов за прошлый месяц.exe
104.16.54.3:443
blockchain.info
Cloudflare Inc
US
shared
1792
Список док-ов за прошлый месяц.exe
34.206.50.228:443
api.blockcypher.com
Amazon.com, Inc.
US
malicious

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
go.microsoft.com
  • 2.19.38.59
whitelisted
shell.windows.com
  • 2.16.186.24
  • 2.16.186.27
whitelisted
blockchain.info
  • 104.16.54.3
  • 104.16.55.3
shared
api.blockcypher.com
  • 34.206.50.228
  • 54.164.0.55
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Список док-ов за прошлый месяц.001