Malware analysis winscp_777.zip.7z Malicious activity

Add for printing

File name:	winscp_777.zip.7z
Full analysis:	https://app.any.run/tasks/a954aca4-a598-48f8-8a79-68c73e2fc48d
Verdict:	Malicious activity
Analysis date:	November 05, 2024, 17:25:38
OS:	Windows 10 Professional (build: 19045, 64 bit)
Tags:	arch-exec
Indicators:
MIME:	application/x-7z-compressed
File info:	7-zip archive data, version 0.4
MD5:	80569555360EFDA6EA557929066F1703
SHA1:	050D724FD43C3437A4AAEBFEC6E984A73797CF30
SHA256:	36EF2E99513BF6790EB8F7CDA198DBD9FD58D992F747CB3DDDFEE8B986A595CF
SSDEEP:	49152:dTjGEichdHPjoAgY7xAwdI423qxMgP/MDUxcgQKaMsiHABnjjWrjIxNvqEHx+we8:dTjG3SPgQWh423qx9pIMs+ABnPWWvqEs

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 60 seconds
Heavy Evasion option:
Network geolocation:: off
Additional time used:: none
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- Generic archive extractor
  - WinRAR.exe (PID: 6364)
SUSPICIOUS
- Application launched itself
  - winscp_777.exe (PID: 700)
  - winscp_777.exe (PID: 3620)
- Potential Corporate Privacy Violation
  - winscp_777.exe (PID: 6916)
INFO
- Executable content was dropped or overwritten
  - WinRAR.exe (PID: 1248)
  - WinRAR.exe (PID: 6660)
- Manual execution by a user
  - WinRAR.exe (PID: 1248)
  - winscp_777.exe (PID: 5264)
  - winscp_777.exe (PID: 3620)
  - WinRAR.exe (PID: 6660)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.7z	\|	7-Zip compressed archive (v0.4) (57.1)
.7z	\|	7-Zip compressed archive (gen) (42.8)

EXIF

ZIP

FileVersion:	7z v0.04
ModifyDate:	2024:11:05 17:22:38+00:00
ArchivedFileName:	winscp_777.zip

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

147

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

700

"C:\Users\admin\AppData\Local\Temp\Rar$EXa6660.41296\winscp_777.exe"

C:\Users\admin\AppData\Local\Temp\Rar$EXa6660.41296\winscp_777.exe

WinRAR.exe

User:

admin

Company:

W3i, LLC

Integrity Level:

HIGH

Description:

InstallIQ Installation Utility

Version:

2.105.0.0

Modules

Images
c:\users\admin\appdata\local\temp\rar$exa6660.41296\winscp_777.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll

1248

"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Desktop\winscp_777.zip" C:\Users\admin\Desktop\

C:\Program Files\WinRAR\WinRAR.exe

explorer.exe

User:

admin

Company:

Alexander Roshal

Integrity Level:

MEDIUM

Description:

WinRAR archiver

Exit code:

Version:

5.91.0

Modules

Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll

3620

"C:\Users\admin\Desktop\winscp_777.exe"

C:\Users\admin\Desktop\winscp_777.exe

explorer.exe

User:

admin

Company:

W3i, LLC

Integrity Level:

HIGH

Description:

InstallIQ Installation Utility

Version:

2.105.0.0

Modules

Images
c:\users\admin\desktop\winscp_777.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll

4448

"C:\Users\admin\AppData\Local\Temp\Rar$EXa6660.41296\winscp_777.exe" /wrapper /dir="C:\Users\admin\AppData\Local\Temp\pkg_111a2cf60"

C:\Users\admin\AppData\Local\Temp\Rar$EXa6660.41296\winscp_777.exe

—

winscp_777.exe

User:

admin

Company:

W3i, LLC

Integrity Level:

HIGH

Description:

InstallIQ Installation Utility

Version:

2.105.0.0

Modules

Images
c:\users\admin\appdata\local\temp\rar$exa6660.41296\winscp_777.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll

4676

"C:\Users\admin\AppData\Local\Temp\Rar$EXa6660.41296\winscp_777.exe"

C:\Users\admin\AppData\Local\Temp\Rar$EXa6660.41296\winscp_777.exe

—

WinRAR.exe

User:

admin

Company:

W3i, LLC

Integrity Level:

MEDIUM

Description:

InstallIQ Installation Utility

Exit code:

3221226540

Version:

2.105.0.0

Modules

Images
c:\users\admin\appdata\local\temp\rar$exa6660.41296\winscp_777.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll

5264

"C:\Users\admin\Desktop\winscp_777.exe"

C:\Users\admin\Desktop\winscp_777.exe

—

explorer.exe

User:

admin

Company:

W3i, LLC

Integrity Level:

MEDIUM

Description:

InstallIQ Installation Utility

Exit code:

3221226540

Version:

2.105.0.0

Modules

Images
c:\users\admin\desktop\winscp_777.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll

6332

"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -Embedding

C:\Program Files\Internet Explorer\iexplore.exe

svchost.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Internet Explorer

Version:

11.00.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll

6364

"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\winscp_777.zip.7z

C:\Program Files\WinRAR\WinRAR.exe

—

explorer.exe

User:

admin

Company:

Alexander Roshal

Integrity Level:

MEDIUM

Description:

WinRAR archiver

Version:

5.91.0

Modules

Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll

6660

"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\winscp_777.zip"

C:\Program Files\WinRAR\WinRAR.exe

explorer.exe

User:

admin

Company:

Alexander Roshal

Integrity Level:

MEDIUM

Description:

WinRAR archiver

Version:

5.91.0

Modules

Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll

6680

"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding

C:\Program Files (x86)\Internet Explorer\ielowutil.exe

—

svchost.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Internet Low-Mic Utility Tool

Version:

11.00.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\program files (x86)\internet explorer\ielowutil.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll

Add for printing

Total events

7 938

Read events

7 839

Write events

Delete events

Modification events


(PID) Process:	(6364) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:	write	Name:	1
Value: C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:	(6364) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:	write	Name:	0
Value: C:\Users\admin\AppData\Local\Temp\winscp_777.zip.7z
(PID) Process:	(6364) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	name
Value: 120
(PID) Process:	(6364) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	size
Value: 80
(PID) Process:	(6364) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	type
Value: 120
(PID) Process:	(6364) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	mtime
Value: 100
(PID) Process:	(6364) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:	delete value	Name:	15
Value:
(PID) Process:	(6364) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:	delete value	Name:	14
Value:
(PID) Process:	(6364) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:	delete value	Name:	13
Value:
(PID) Process:	(6364) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:	delete value	Name:	12
Value:

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
1248	WinRAR.exe	C:\Users\admin\Desktop\winscp_777.exe		executable
		MD5:14917E98FAD49B52419271A2F00958D8	SHA256:268E54968B35D028C28FD0B3349A49887CC37CDF033B0E1831521CBF74B69A59
6364	WinRAR.exe	C:\Users\admin\AppData\Local\Temp\winscp_777.zip\winscp_777.zip		compressed
		MD5:393F51503F849531B85B02A8E920D1B2	SHA256:CA4F7A3D99A0A1805B01234F44848840ADAF90C33DB28E3673FEFCA632DAFBCC
6364	WinRAR.exe	C:\Users\admin\Desktop\winscp_777.zip		compressed
		MD5:393F51503F849531B85B02A8E920D1B2	SHA256:CA4F7A3D99A0A1805B01234F44848840ADAF90C33DB28E3673FEFCA632DAFBCC
3620	winscp_777.exe	C:\Users\admin\AppData\Local\Temp\pkg_111a1a2fa0\stub.log		text
		MD5:F789C6444B87207B0198F7D0F05BFDF3	SHA256:08AAB9CEA231F932F34151450AA7EEB152482BE76FECCD0CE85AF65F5BA8C99B
7080	iexplore.exe	C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187		binary
		MD5:C0EF978F645BBBD2D756CDBD7B33F8F1	SHA256:7900093A0B4CAD3B1837C7D3F485D6AA8DA596447BACA8397AC6A140B59924AC
700	winscp_777.exe	C:\Users\admin\AppData\Local\Temp\pkg_111a2cf60\wrapper.xml		text
		MD5:7DF4B6DB3FBBD712D68509779B2ED8FB	SHA256:357DA15A7E543CF183942D2E0E125D8814DD2BDB225AC5FE7D1FAE0601B4473B
7080	iexplore.exe	C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187		binary
		MD5:EB52315CAB0D78E0196C057DABFD645D	SHA256:F3D5B1ACBD1107502A40663E6BC5F1CBE180291EDDE507C58CD1A3F73F5E3A08
7080	iexplore.exe	C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C389FD106AACA95B265CC81A85B3522B_9F52C64361FCD114CE5C99F87871559D		binary
		MD5:3F2CFB7B4E56F8AA5D9F5482C8C6A5FD	SHA256:AB3C199EEBFD3120BFA8AFB15E5CAC244EB87BC720B298C6D32149FA2A619F66
700	winscp_777.exe	C:\Users\admin\AppData\Local\Temp\pkg_111a2cf60\stub.log		text
		MD5:C229BD2C7DF0C9F3AC1BC94ADBF1F610	SHA256:A1FE8F5792A3FD042217106F9520DE83EB93DD20DE83E28A8F8FDF39CF9D7A80
7080	iexplore.exe	C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C389FD106AACA95B265CC81A85B3522B_9F52C64361FCD114CE5C99F87871559D		binary
		MD5:A1A90649B125AA5AEB57EAFDA9177FBE	SHA256:BE5667517AF9369D80060923B6C024065322EEE1568A6FB60A05DAE19402DEE5

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
4904	firefox.exe	GET	200	34.107.221.82:80	http://detectportal.firefox.com/canonical.html	unknown	—	—	whitelisted
6332	iexplore.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D	unknown	—	—	whitelisted
4904	firefox.exe	GET	200	34.107.221.82:80	http://detectportal.firefox.com/success.txt?ipv4	unknown	—	—	whitelisted
6944	svchost.exe	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
6944	svchost.exe	GET	200	2.16.164.43:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
2776	svchost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
4360	SearchApp.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D	unknown	—	—	whitelisted
7052	SIHClient.exe	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl	unknown	—	—	whitelisted
4304	backgroundTaskHost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted
7052	SIHClient.exe	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
5488	MoUsoCoreWorker.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4	System	192.168.100.255:137	—	—	—	whitelisted
6944	svchost.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
7036	RUXIMICS.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
4904	firefox.exe	34.107.221.82:80	detectportal.firefox.com	GOOGLE	US	whitelisted
6944	svchost.exe	2.16.164.43:80	crl.microsoft.com	Akamai International B.V.	NL	whitelisted
6944	svchost.exe	184.30.21.171:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
5488	MoUsoCoreWorker.exe	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4360	SearchApp.exe	2.23.209.160:443	www.bing.com	Akamai International B.V.	GB	whitelisted

DNS requests

Domain	IP	Reputation
google.com	142.250.185.238	whitelisted
detectportal.firefox.com	34.107.221.82	whitelisted
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82 2600:1901:0:38d7::	whitelisted
example.org	93.184.215.14	whitelisted
ipv4only.arpa	192.0.0.171 192.0.0.170	whitelisted
crl.microsoft.com	2.16.164.43 2.16.164.9	whitelisted
www.microsoft.com	184.30.21.171	whitelisted
settings-win.data.microsoft.com	40.127.240.158 51.124.78.146	whitelisted
www.bing.com	2.23.209.160 2.23.209.179 2.23.209.161 2.23.209.177 2.23.209.181 2.23.209.176 2.23.209.150 2.23.209.158 2.23.209.149 104.126.37.169 104.126.37.146 104.126.37.162 104.126.37.170 104.126.37.155 104.126.37.168 104.126.37.160 104.126.37.152 104.126.37.171	whitelisted
ocsp.digicert.com	192.229.221.95	whitelisted

Threats

PID	Process	Class	Message
6916	winscp_777.exe	Potential Corporate Privacy Violation	ET POLICY InstallIQ Updater Software request
6916	winscp_777.exe	Potential Corporate Privacy Violation	ET POLICY InstallIQ Updater Software request
—	—	Potential Corporate Privacy Violation	ET POLICY InstallIQ Updater Software request

Add for printing

No debug info

General Info

winscp_777.zip.7z

80569555360EFDA6EA557929066F1703

050D724FD43C3437A4AAEBFEC6E984A73797CF30

36EF2E99513BF6790EB8F7CDA198DBD9FD58D992F747CB3DDDFEE8B986A595CF

49152:dTjGEichdHPjoAgY7xAwdI423qxMgP/MDUxcgQKaMsiHABnjjWrjIxNvqEHx+we8:dTjG3SPgQWh423qx9pIMs+ABnPWWvqEs

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Generic archive extractor

SUSPICIOUS

Application launched itself

Potential Corporate Privacy Violation

INFO

Executable content was dropped or overwritten

Manual execution by a user

Malware configuration

Static information

TRiD

EXIF

ZIP

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings