analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Your-File-is-Ready-f_789458824.zip

Full analysis: https://app.any.run/tasks/158cd675-5e53-463f-868e-9e5a607a549a
Verdict: Malicious activity
Analysis date: August 19, 2021, 01:54:24
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

59C7B5B14798A740BD7947A93852D5A9

SHA1:

F15118D679EA36C2CF841D50B5FCE2DDE1D3852E

SHA256:

36C2700AF2687239545E01E26D71F7664594F73D314E89C5860787715F62EB52

SSDEEP:

196608:k7iha/qgW4JmrqVgHUWUu1zmhASQPgj8GBLIE0YFiRnp0CaPvALGk3C:yqeWkRgHZX1zmhVQPgwG9inpMPP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • _rlqtpelh.r1r.exe (PID: 3908)
      • _rlqtpelh.r1r.exe (PID: 3348)
      • Your-File-is-Ready-f_789458824.exe (PID: 3340)
      • Your-File-is-Ready-f_789458824.exe (PID: 1956)
      • _rlqtpelh.r1r.exe (PID: 3520)
      • _rlqtpelh.r1r.exe (PID: 3704)
      • CClipboardCm.exe (PID: 2072)
      • CClipboard.exe (PID: 1276)
      • CClipboardCm.exe (PID: 4072)
      • CClipboard.exe (PID: 3300)
      • COptions.exe (PID: 2480)

    • Drops executable file immediately after starts

      • Explorer.EXE (PID: 1724)
      • _rlqtpelh.r1r.exe (PID: 3908)
      • _rlqtpelh.r1r.exe (PID: 3348)
      • Your-File-is-Ready-f_789458824.exe (PID: 3340)
      • Your-File-is-Ready-f_789458824.exe (PID: 1956)
      • Your-File-is-Ready-f_789458824.tmp (PID: 3112)
      • _rlqtpelh.r1r.exe (PID: 3520)
      • _rlqtpelh.r1r.exe (PID: 3704)

    • Loads dropped or rewritten executable

      • regsvr32.exe (PID: 3748)
      • ctfmon.exe (PID: 1488)
      • DllHost.exe (PID: 520)
      • CClipboardCm.exe (PID: 4072)
      • svchost.exe (PID: 1772)
      • Explorer.EXE (PID: 1724)
      • CClipboard.exe (PID: 3300)
      • DllHost.exe (PID: 2288)

    • Registers / Runs the DLL via REGSVR32.EXE

      • _rlqtpelh.r1r.tmp (PID: 1552)

  • SUSPICIOUS

    • Checks supported languages

      • _rlqtpelh.r1r.exe (PID: 3348)
      • WinRAR.exe (PID: 3176)
      • _rlqtpelh.r1r.exe (PID: 3908)
      • _rlqtpelh.r1r.tmp (PID: 3876)
      • _rlqtpelh.r1r.tmp (PID: 1552)
      • Your-File-is-Ready-f_789458824.exe (PID: 1956)
      • Your-File-is-Ready-f_789458824.exe (PID: 3340)
      • Your-File-is-Ready-f_789458824.tmp (PID: 1284)
      • Your-File-is-Ready-f_789458824.tmp (PID: 3112)
      • Eius.exe (PID: 460)
      • _rlqtpelh.r1r.tmp (PID: 2908)
      • _rlqtpelh.r1r.exe (PID: 3520)
      • _rlqtpelh.r1r.exe (PID: 3704)
      • _rlqtpelh.r1r.tmp (PID: 3556)
      • CClipboard.exe (PID: 3300)
      • CClipboardCm.exe (PID: 4072)
      • COptions.exe (PID: 2480)

    • Reads the computer name

      • WinRAR.exe (PID: 3176)
      • _rlqtpelh.r1r.tmp (PID: 3876)
      • Your-File-is-Ready-f_789458824.tmp (PID: 1284)
      • Your-File-is-Ready-f_789458824.tmp (PID: 3112)
      • _rlqtpelh.r1r.tmp (PID: 1552)
      • _rlqtpelh.r1r.tmp (PID: 2908)
      • Eius.exe (PID: 460)
      • CClipboard.exe (PID: 3300)

    • Reads the date of Windows installation

      • _rlqtpelh.r1r.tmp (PID: 3876)
      • _rlqtpelh.r1r.tmp (PID: 2908)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3176)
      • _rlqtpelh.r1r.exe (PID: 3908)
      • Your-File-is-Ready-f_789458824.exe (PID: 1956)
      • _rlqtpelh.r1r.exe (PID: 3348)
      • Your-File-is-Ready-f_789458824.exe (PID: 3340)
      • Your-File-is-Ready-f_789458824.tmp (PID: 3112)
      • _rlqtpelh.r1r.exe (PID: 3704)
      • _rlqtpelh.r1r.exe (PID: 3520)
      • _rlqtpelh.r1r.tmp (PID: 1552)

    • Reads Windows owner or organization settings

      • Your-File-is-Ready-f_789458824.tmp (PID: 3112)
      • _rlqtpelh.r1r.tmp (PID: 1552)

    • Reads the Windows organization settings

      • _rlqtpelh.r1r.tmp (PID: 1552)
      • Your-File-is-Ready-f_789458824.tmp (PID: 3112)

    • Reads Microsoft Outlook installation path

      • Eius.exe (PID: 460)

    • Drops a file with a compile date too recent

      • Your-File-is-Ready-f_789458824.tmp (PID: 3112)

    • Creates a directory in Program Files

      • _rlqtpelh.r1r.tmp (PID: 1552)
      • CClipboard.exe (PID: 3300)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 3748)

    • Creates files in the user directory

      • CClipboard.exe (PID: 3300)

    • Creates files in the program directory

      • CClipboard.exe (PID: 3300)

    • Reads default file associations for system extensions

      • Explorer.EXE (PID: 1724)

  • INFO

    • Manual execution by user

      • _rlqtpelh.r1r.exe (PID: 3908)
      • Your-File-is-Ready-f_789458824.exe (PID: 1956)
      • _rlqtpelh.r1r.exe (PID: 3704)

    • Application was dropped or rewritten from another process

      • _rlqtpelh.r1r.tmp (PID: 3876)
      • _rlqtpelh.r1r.tmp (PID: 1552)
      • Your-File-is-Ready-f_789458824.tmp (PID: 3112)
      • Your-File-is-Ready-f_789458824.tmp (PID: 1284)
      • Eius.exe (PID: 460)
      • _rlqtpelh.r1r.tmp (PID: 3556)
      • _rlqtpelh.r1r.tmp (PID: 2908)

    • Checks supported languages

      • DllHost.exe (PID: 520)
      • regsvr32.exe (PID: 3748)
      • regsvr32.exe (PID: 3568)
      • DllHost.exe (PID: 2288)

    • Creates a software uninstall entry

      • _rlqtpelh.r1r.tmp (PID: 1552)

    • Reads the computer name

      • DllHost.exe (PID: 520)
      • DllHost.exe (PID: 2288)

    • Loads dropped or rewritten executable

      • _rlqtpelh.r1r.tmp (PID: 3876)
      • _rlqtpelh.r1r.tmp (PID: 3556)
      • Eius.exe (PID: 460)
      • Your-File-is-Ready-f_789458824.tmp (PID: 3112)
      • _rlqtpelh.r1r.tmp (PID: 2908)

    • Creates files in the program directory

      • _rlqtpelh.r1r.tmp (PID: 1552)

    • Checks Windows Trust Settings

      • CClipboard.exe (PID: 3300)

    • Reads settings of System Certificates

      • CClipboard.exe (PID: 3300)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2019:12:17 19:30:18
ZipCRC: 0xd7503770
ZipCompressedSize: 4864419
ZipUncompressedSize: 4973240
ZipFileName: _rlqtpelh.r1r.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
71
Monitored processes
26
Malicious processes
12
Suspicious processes
4

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start winrar.exe _rlqtpelh.r1r.exe _rlqtpelh.r1r.tmp no specs _rlqtpelh.r1r.exe _rlqtpelh.r1r.tmp your-file-is-ready-f_789458824.exe your-file-is-ready-f_789458824.tmp no specs your-file-is-ready-f_789458824.exe your-file-is-ready-f_789458824.tmp eius.exe _rlqtpelh.r1r.exe _rlqtpelh.r1r.tmp no specs _rlqtpelh.r1r.exe _rlqtpelh.r1r.tmp no specs regsvr32.exe no specs regsvr32.exe no specs cclipboard.exe no specs cclipboard.exe cclipboardcm.exe no specs cclipboardcm.exe no specs explorer.exe no specs ctfmon.exe no specs DllHost.exe no specs svchost.exe no specs Thumbnail Cache Out of Proc Server no specs coptions.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3176"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Your-File-is-Ready-f_789458824.zip"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
3908"C:\Users\admin\Desktop\_rlqtpelh.r1r.exe" C:\Users\admin\Desktop\_rlqtpelh.r1r.exe
Explorer.EXE
User:
admin
Company:
Comfort Software Group
Integrity Level:
MEDIUM
Description:
Comfort Clipboard Pro 9.1.1.0 Setup
Exit code:
0
Version:
9.1.1.0
3876"C:\Users\admin\AppData\Local\Temp\is-URCPD.tmp\_rlqtpelh.r1r.tmp" /SL5="$C0192,4409556,180736,C:\Users\admin\Desktop\_rlqtpelh.r1r.exe" C:\Users\admin\AppData\Local\Temp\is-URCPD.tmp\_rlqtpelh.r1r.tmp—_rlqtpelh.r1r.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
3348"C:\Users\admin\Desktop\_rlqtpelh.r1r.exe" /SPAWNWND=$120144 /NOTIFYWND=$C0192 C:\Users\admin\Desktop\_rlqtpelh.r1r.exe
_rlqtpelh.r1r.tmp
User:
admin
Company:
Comfort Software Group
Integrity Level:
HIGH
Description:
Comfort Clipboard Pro 9.1.1.0 Setup
Exit code:
0
Version:
9.1.1.0
1552"C:\Users\admin\AppData\Local\Temp\is-QIGJ0.tmp\_rlqtpelh.r1r.tmp" /SL5="$110176,4409556,180736,C:\Users\admin\Desktop\_rlqtpelh.r1r.exe" /SPAWNWND=$120144 /NOTIFYWND=$C0192 C:\Users\admin\AppData\Local\Temp\is-QIGJ0.tmp\_rlqtpelh.r1r.tmp
_rlqtpelh.r1r.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
1956"C:\Users\admin\Desktop\Your-File-is-Ready-f_789458824.exe" C:\Users\admin\Desktop\Your-File-is-Ready-f_789458824.exe
Explorer.EXE
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Dolores Setup
Version:
1284"C:\Users\admin\AppData\Local\Temp\is-UGFMP.tmp\Your-File-is-Ready-f_789458824.tmp" /SL5="$D01A0,4418666,780800,C:\Users\admin\Desktop\Your-File-is-Ready-f_789458824.exe" C:\Users\admin\AppData\Local\Temp\is-UGFMP.tmp\Your-File-is-Ready-f_789458824.tmp—Your-File-is-Ready-f_789458824.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Version:
51.1052.0.0
3340"C:\Users\admin\Desktop\Your-File-is-Ready-f_789458824.exe" /SPAWNWND=$100180 /NOTIFYWND=$D01A0 C:\Users\admin\Desktop\Your-File-is-Ready-f_789458824.exe
Your-File-is-Ready-f_789458824.tmp
User:
admin
Company:
Integrity Level:
HIGH
Description:
Dolores Setup
Version:
3112"C:\Users\admin\AppData\Local\Temp\is-I84NV.tmp\Your-File-is-Ready-f_789458824.tmp" /SL5="$140182,4418666,780800,C:\Users\admin\Desktop\Your-File-is-Ready-f_789458824.exe" /SPAWNWND=$100180 /NOTIFYWND=$D01A0 C:\Users\admin\AppData\Local\Temp\is-I84NV.tmp\Your-File-is-Ready-f_789458824.tmp
Your-File-is-Ready-f_789458824.exe
User:
admin
Company:
Integrity Level:
HIGH
Description:
Setup/Uninstall
Version:
51.1052.0.0
460"C:\Users\admin\AppData\Local\Temp\is-MUA6F.tmp\Eius.exe" 6cb7add20650a0a6289d2deb5605b187C:\Users\admin\AppData\Local\Temp\is-MUA6F.tmp\Eius.exe
Your-File-is-Ready-f_789458824.tmp
User:
admin
Integrity Level:
HIGH
Total events
12 752
Read events
12 220
Write events
0
Delete events
0

Modification events

No data
Executable files
29
Suspicious files
6
Text files
128
Unknown types
105

Dropped files

PID
Process
Filename
Type
1552_rlqtpelh.r1r.tmpC:\Program Files\ComfortClipboard\Lang\ar.txttext
MD5:8B3AFAF9D2CD7C1278D974F40DEC4BD8
SHA256:E3DD5F495724A2DDE20EED88AB2737B57D316C9EC325A8B98DA322E442ED0360
1552_rlqtpelh.r1r.tmpC:\Program Files\ComfortClipboard\Lang\be.txttext
MD5:57ED9F355E65EF5FDC9D7C60A4361D61
SHA256:77FEECFEFFDB1D5618E954CB4E007CC07A774F365ECB35C70EB76BDDD6D3E94F
1552_rlqtpelh.r1r.tmpC:\Program Files\ComfortClipboard\Lang\bg.txttext
MD5:D4FBFE141E014679DA2B4C0107D297A3
SHA256:8F33C2B49DE3EC662D4CEBB8C342432691B749A7AB941DD3CFB24943DC68BE01
1552_rlqtpelh.r1r.tmpC:\Program Files\ComfortClipboard\unins000.exeexecutable
MD5:D29050098035688999EB8EB4F086EF25
SHA256:942F16143197A229892470086930839A5A63BF5CE9CD2F5D55670F0908E8B125
3176WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3176.26465\_rlqtpelh.r1r.exeexecutable
MD5:1F48B2B2B55E0CAEC93705AC57EEEDC6
SHA256:6B64CAF1083EB17E9878A5B05013D191E5D72852C1E49AA1BCE006955D941255
3340Your-File-is-Ready-f_789458824.exeC:\Users\admin\AppData\Local\Temp\is-I84NV.tmp\Your-File-is-Ready-f_789458824.tmpexecutable
MD5:352FB97C10B28D24579ED9E2EB6338C8
SHA256:81622D0D3B02297EE07F48594E894E17A4A205B77DC4B5AEE29900714D419C62
1724Explorer.EXEC:\Users\admin\Desktop\_rlqtpelh.r1r.exeexecutable
MD5:1F48B2B2B55E0CAEC93705AC57EEEDC6
SHA256:6B64CAF1083EB17E9878A5B05013D191E5D72852C1E49AA1BCE006955D941255
3908_rlqtpelh.r1r.exeC:\Users\admin\AppData\Local\Temp\is-URCPD.tmp\_rlqtpelh.r1r.tmpexecutable
MD5:D29050098035688999EB8EB4F086EF25
SHA256:942F16143197A229892470086930839A5A63BF5CE9CD2F5D55670F0908E8B125
1956Your-File-is-Ready-f_789458824.exeC:\Users\admin\AppData\Local\Temp\is-UGFMP.tmp\Your-File-is-Ready-f_789458824.tmpexecutable
MD5:352FB97C10B28D24579ED9E2EB6338C8
SHA256:81622D0D3B02297EE07F48594E894E17A4A205B77DC4B5AEE29900714D419C62
3348_rlqtpelh.r1r.exeC:\Users\admin\AppData\Local\Temp\is-QIGJ0.tmp\_rlqtpelh.r1r.tmpexecutable
MD5:D29050098035688999EB8EB4F086EF25
SHA256:942F16143197A229892470086930839A5A63BF5CE9CD2F5D55670F0908E8B125
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
7
DNS requests
5
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1672
svchost.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?0968e9df1e2aec06
US
—
—
whitelisted
1672
svchost.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?65aa4131f7afa66c
US
—
—
whitelisted
3300
CClipboard.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
460
Eius.exe
POST
—
172.67.177.45:80
http://jorjifornk.live/v3/api
US
—
—
malicious
460
Eius.exe
POST
—
172.67.177.45:80
http://jorjifornk.live/v3/api
US
—
—
malicious
3300
CClipboard.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?83c7148e1baea2e5
US
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3300
CClipboard.exe
104.21.24.80:443
www.comfort-software.com
Cloudflare Inc
US
malicious
—
—
172.67.177.45:80
jorjifornk.live
—
US
malicious
3300
CClipboard.exe
104.21.57.22:443
www.comfortsoftware.com
Cloudflare Inc
US
unknown
460
Eius.exe
172.67.177.45:80
jorjifornk.live
—
US
malicious
3300
CClipboard.exe
93.184.221.240:80
ctldl.windowsupdate.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3300
CClipboard.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
1672
svchost.exe
93.184.221.240:80
ctldl.windowsupdate.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted

DNS requests

Domain
IP
Reputation
jorjifornk.live
  • 172.67.177.45
  • 104.21.80.102
unknown
www.comfort-software.com
  • 104.21.24.80
  • 172.67.218.15
malicious
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
www.comfortsoftware.com
  • 104.21.57.22
  • 172.67.140.157
malicious

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Your-File-is-Ready-f_789458824.zip