File name:

Archive.zip__d7273xo9zcihec1b.exe.bin

Full analysis: https://app.any.run/tasks/be47ddd3-9ec6-489b-a88d-6b2dcfd2f87a
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Analysis date: March 14, 2019, 11:55:58
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
evasion
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

050DF58E34F530B716159BAC88E6EEFE

SHA1:

422DD2E7F41A676CB373E21B75C75426A9CC9938

SHA256:

410828750C57D4DA9A7331C9D7A2ACAF2EC512E4C3CF606CC834CD1DD53F1981

SSDEEP:

6144:7I3qqkPf2Lo35xauEIDwtOlneJ2N6MGOpP5m8lC5SEe4uI1O3AOp8tZr1973:7I3qXPf2U35xauEIDwtc1hpxm8lCEELh

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Connects to CnC server

      • Archive.zip__d7273xo9zcihec1b.exe.bin.exe (PID: 3360)
    • Disables Windows Defender Real-time monitoring

      • Archive.zip__d7273xo9zcihec1b.exe.bin.exe (PID: 3360)
    • Loads the Task Scheduler COM API

      • Archive.zip__d7273xo9zcihec1b.exe.bin.exe (PID: 3360)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Archive.zip__d7273xo9zcihec1b.exe.bin.exe (PID: 3360)
    • Checks for external IP

      • Archive.zip__d7273xo9zcihec1b.exe.bin.exe (PID: 3360)
    • Creates files in the user directory

      • Archive.zip__d7273xo9zcihec1b.exe.bin.exe (PID: 3360)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:03:08 15:14:32+01:00
PEType: PE32
LinkerVersion: 14.16
CodeSize: 232960
InitializedDataSize: 116224
UninitializedDataSize: -
EntryPoint: 0x20d37
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 08-Mar-2019 14:14:32
Detected languages:
  • English - United States
Debug artifacts:
  • C:\Work\installer\Release\installer_.pdb

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000118

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 08-Mar-2019 14:14:32
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00038C7C
0x00038E00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.57005
.rdata
0x0003A000
0x000170AE
0x00017200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.12635
.data
0x00052000
0x00001F80
0x00001200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3.59739
.rsrc
0x00054000
0x000001E8
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.77204
.reloc
0x00055000
0x000030B8
0x00003200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.50294

Resources

Title
Entropy
Size
Codepage
Language
Type
1
4.89623
392
UNKNOWN
English - United States
RT_MANIFEST

Imports

ADVAPI32.dll
KERNEL32.dll
OLEAUT32.dll
RPCRT4.dll
SHELL32.dll
USER32.dll
WININET.dll
ole32.dll
urlmon.dll
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
33
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start archive.zip__d7273xo9zcihec1b.exe.bin.exe archive.zip__d7273xo9zcihec1b.exe.bin.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2968"C:\Users\admin\AppData\Local\Temp\Archive.zip__d7273xo9zcihec1b.exe.bin.exe" C:\Users\admin\AppData\Local\Temp\Archive.zip__d7273xo9zcihec1b.exe.bin.exeexplorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\archive.zip__d7273xo9zcihec1b.exe.bin.exe
c:\systemroot\system32\ntdll.dll
3360"C:\Users\admin\AppData\Local\Temp\Archive.zip__d7273xo9zcihec1b.exe.bin.exe" C:\Users\admin\AppData\Local\Temp\Archive.zip__d7273xo9zcihec1b.exe.bin.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\archive.zip__d7273xo9zcihec1b.exe.bin.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
50
Read events
27
Write events
23
Delete events
0

Modification events

(PID) Process:(3360) Archive.zip__d7273xo9zcihec1b.exe.bin.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender
Operation:writeName:DisableAntiSpyware
Value:
1
(PID) Process:(3360) Archive.zip__d7273xo9zcihec1b.exe.bin.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection
Operation:writeName:DisableBehaviorMonitoring
Value:
1
(PID) Process:(3360) Archive.zip__d7273xo9zcihec1b.exe.bin.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection
Operation:writeName:DisableOnAccessProtection
Value:
1
(PID) Process:(3360) Archive.zip__d7273xo9zcihec1b.exe.bin.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection
Operation:writeName:DisableScanOnRealtimeEnable
Value:
1
(PID) Process:(3360) Archive.zip__d7273xo9zcihec1b.exe.bin.exeKey:HKEY_CURRENT_USER\Software\Microsoft\WindowsUpdater
Operation:writeName:installed
Value:
1
(PID) Process:(3360) Archive.zip__d7273xo9zcihec1b.exe.bin.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Archive_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3360) Archive.zip__d7273xo9zcihec1b.exe.bin.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Archive_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3360) Archive.zip__d7273xo9zcihec1b.exe.bin.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Archive_RASAPI32
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(3360) Archive.zip__d7273xo9zcihec1b.exe.bin.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Archive_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
4294901760
(PID) Process:(3360) Archive.zip__d7273xo9zcihec1b.exe.bin.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Archive_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
Executable files
3
Suspicious files
0
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
3360Archive.zip__d7273xo9zcihec1b.exe.bin.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0UU90R59\things[1].xmltext
MD5:
SHA256:
3360Archive.zip__d7273xo9zcihec1b.exe.bin.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\count[1].htmtext
MD5:
SHA256:
3360Archive.zip__d7273xo9zcihec1b.exe.bin.exeC:\Users\admin\AppData\Roaming\Microsoft\Launcher.exeexecutable
MD5:
SHA256:
3360Archive.zip__d7273xo9zcihec1b.exe.bin.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\xml[1].xmlxml
MD5:
SHA256:
3360Archive.zip__d7273xo9zcihec1b.exe.bin.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D2YPIJ90\visit[1].htmtext
MD5:81051BCC2CF1BEDF378224B0A93E2877
SHA256:7EB70257593DA06F682A3DDDA54A9D260D4FC514F645237F5CA74B08F8DA61A6
3360Archive.zip__d7273xo9zcihec1b.exe.bin.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D2YPIJ90\pushbot[1].exeexecutable
MD5:
SHA256:
3360Archive.zip__d7273xo9zcihec1b.exe.bin.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\count[1].htmtext
MD5:
SHA256:
3360Archive.zip__d7273xo9zcihec1b.exe.bin.exeC:\Users\admin\AppData\Local\Temp\95CE.tmp.exeexecutable
MD5:
SHA256:
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
13
DNS requests
10
Threats
10

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3360
Archive.zip__d7273xo9zcihec1b.exe.bin.exe
GET
200
40.117.102.133:80
http://offer101.tk/click.php?cnv_id=d7273xo9zcihec1b
US
malicious
GET
200
185.194.141.58:80
http://ip-api.com/xml
DE
xml
656 b
malicious
GET
200
137.135.79.79:80
http://adcash.cf/20190118/things.xml
US
text
4.57 Kb
malicious
3360
Archive.zip__d7273xo9zcihec1b.exe.bin.exe
POST
200
216.58.206.4:80
http://google-analytics.com/collect
US
image
35 b
whitelisted
3360
Archive.zip__d7273xo9zcihec1b.exe.bin.exe
POST
200
216.58.206.4:80
http://google-analytics.com/collect
US
image
35 b
whitelisted
GET
200
137.135.79.79:80
http://adcash.cf/source/pp/visit.php
US
text
2 b
malicious
GET
200
137.135.79.79:80
http://www.adcash.cf/20190118/pushbot.exe
US
executable
144 Kb
malicious
GET
200
137.135.79.79:80
http://adcash.cf/osc/count.php
US
text
5 b
malicious
GET
200
137.135.79.79:80
http://adcash.cf/osck/count.php
US
text
3 b
malicious
GET
302
104.18.56.101:80
http://minimal.beneficiary.shop/gor?param1=test&param2=bt
US
html
133 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3360
Archive.zip__d7273xo9zcihec1b.exe.bin.exe
185.194.141.58:80
ip-api.com
netcup GmbH
DE
unknown
3360
Archive.zip__d7273xo9zcihec1b.exe.bin.exe
40.117.102.133:80
offer101.tk
Microsoft Corporation
US
malicious
137.135.79.79:80
adcash.cf
Microsoft Corporation
US
suspicious
216.58.206.4:80
google-analytics.com
Google Inc.
US
whitelisted
104.18.56.101:80
minimal.beneficiary.shop
Cloudflare Inc
US
shared
172.217.16.141:443
accounts.google.com
Google Inc.
US
suspicious
172.217.16.195:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
138.68.113.179:443
click.dailynews.support
Digital Ocean, Inc.
DE
unknown
172.217.22.67:443
www.gstatic.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
offer101.tk
  • 40.117.102.133
malicious
ip-api.com
  • 185.194.141.58
malicious
google-analytics.com
  • 216.58.206.4
whitelisted
adcash.cf
  • 137.135.79.79
malicious
www.adcash.cf
  • 137.135.79.79
malicious
minimal.beneficiary.shop
  • 104.18.56.101
  • 104.18.57.101
unknown
www.gstatic.com
  • 172.217.22.67
whitelisted
clientservices.googleapis.com
  • 172.217.16.195
whitelisted
accounts.google.com
  • 172.217.16.141
shared
click.dailynews.support
  • 138.68.113.179
unknown

Threats

PID
Process
Class
Message
3360
Archive.zip__d7273xo9zcihec1b.exe.bin.exe
Potentially Bad Traffic
ET POLICY HTTP Request to a *.tk domain
Potentially Bad Traffic
ET INFO DNS Query for Suspicious .cf Domain
3360
Archive.zip__d7273xo9zcihec1b.exe.bin.exe
Potential Corporate Privacy Violation
ET POLICY External IP Lookup ip-api.com
3360
Archive.zip__d7273xo9zcihec1b.exe.bin.exe
A Network Trojan was detected
MALWARE [PTsecurity] Win32/QwertMiner CoinMiner UA
3360
Archive.zip__d7273xo9zcihec1b.exe.bin.exe
A Network Trojan was detected
MALWARE [PTsecurity] Win32/QwertMiner CoinMiner UA
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
4 ETPRO signatures available at the full report
Process
Message
Archive.zip__d7273xo9zcihec1b.exe.bin.exe
[14/03/2019 11:56:22:0229] 3.0
Archive.zip__d7273xo9zcihec1b.exe.bin.exe
[14/03/2019 11:56:22:0229] CommandLine: i