analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

3573cfc1532dcfd367452038c5e54664cc21831f1cdebfdb8316d2fbde1ecc05.zip

Full analysis: https://app.any.run/tasks/8177d630-472a-4a5f-9460-f24d71647c04
Verdict: Malicious activity
Analysis date: May 21, 2022, 08:02:38
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v5.1 to extract
MD5:

7A8AF9B56FC15A345E3714CEE2298119

SHA1:

2EABAB5412C9D7883FFE8F9D97D5DC7A1CDA9D4F

SHA256:

448AB11DE133EBF8E308A9D9C090B7D8F145C60116285F679905C70510C56556

SSDEEP:

6144:sOSpwkiWdMcOUaRWGeO7VvaqyLiozfbkApT+T:tSpwpZuGeO7Vikkjke2

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • WinRAR.exe (PID: 788)
      • 3573cfc1532dcfd367452038c5e54664cc21831f1cdebfdb8316d2fbde1ecc05.exe (PID: 3392)

    • Deletes shadow copies

      • 3573cfc1532dcfd367452038c5e54664cc21831f1cdebfdb8316d2fbde1ecc05.exe (PID: 3392)

    • Application was dropped or rewritten from another process

      • 3573cfc1532dcfd367452038c5e54664cc21831f1cdebfdb8316d2fbde1ecc05.exe (PID: 3392)

  • SUSPICIOUS

    • Reads the computer name

      • WinRAR.exe (PID: 788)
      • 3573cfc1532dcfd367452038c5e54664cc21831f1cdebfdb8316d2fbde1ecc05.exe (PID: 3392)

    • Checks supported languages

      • WinRAR.exe (PID: 788)
      • 3573cfc1532dcfd367452038c5e54664cc21831f1cdebfdb8316d2fbde1ecc05.exe (PID: 3392)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 788)

    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 788)
      • 3573cfc1532dcfd367452038c5e54664cc21831f1cdebfdb8316d2fbde1ecc05.exe (PID: 3392)

    • Writes to a desktop.ini file (may be used to cloak folders)

      • 3573cfc1532dcfd367452038c5e54664cc21831f1cdebfdb8316d2fbde1ecc05.exe (PID: 3392)

  • INFO

    • Manual execution by user

      • 3573cfc1532dcfd367452038c5e54664cc21831f1cdebfdb8316d2fbde1ecc05.exe (PID: 3392)
      • NOTEPAD.EXE (PID: 3720)

    • Checks supported languages

      • vssadmin.exe (PID: 1540)
      • NOTEPAD.EXE (PID: 3720)

    • Reads the computer name

      • vssadmin.exe (PID: 1540)

    • Dropped object may contain Bitcoin addresses

      • 3573cfc1532dcfd367452038c5e54664cc21831f1cdebfdb8316d2fbde1ecc05.exe (PID: 3392)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: 3573cfc1532dcfd367452038c5e54664cc21831f1cdebfdb8316d2fbde1ecc05.exe
ZipUncompressedSize: 210432
ZipCompressedSize: 206557
ZipCRC: 0x3c83ca4b
ZipModifyDate: 2022:05:21 08:01:09
ZipCompression: Unknown (99)
ZipBitFlag: 0x0003
ZipRequiredVersion: 51
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
4
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe 3573cfc1532dcfd367452038c5e54664cc21831f1cdebfdb8316d2fbde1ecc05.exe no specs vssadmin.exe no specs notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
788"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\3573cfc1532dcfd367452038c5e54664cc21831f1cdebfdb8316d2fbde1ecc05.zip"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
3392"C:\Users\admin\Desktop\3573cfc1532dcfd367452038c5e54664cc21831f1cdebfdb8316d2fbde1ecc05.exe" C:\Users\admin\Desktop\3573cfc1532dcfd367452038c5e54664cc21831f1cdebfdb8316d2fbde1ecc05.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
1540vssadmin delete shadows /all /quietC:\Windows\system32\vssadmin.exe—3573cfc1532dcfd367452038c5e54664cc21831f1cdebfdb8316d2fbde1ecc05.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Command Line Interface for Microsoft® Volume Shadow Copy Service
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3720"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\info.txtC:\Windows\system32\NOTEPAD.EXE—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
7 440
Read events
7 418
Write events
22
Delete events
0

Modification events

(PID) Process:(788) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(788) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(788) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(788) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(788) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(788) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\3573cfc1532dcfd367452038c5e54664cc21831f1cdebfdb8316d2fbde1ecc05.zip
(PID) Process:(788) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(788) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(788) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(788) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
1
Suspicious files
826
Text files
4
Unknown types
28

Dropped files

PID
Process
Filename
Type
33923573cfc1532dcfd367452038c5e54664cc21831f1cdebfdb8316d2fbde1ecc05.exeC:\MSOCache\All Users\{90140000-0015-0407-0000-0000000FF1CE}-C\AccLR.cab —
MD5:—
SHA256:—
33923573cfc1532dcfd367452038c5e54664cc21831f1cdebfdb8316d2fbde1ecc05.exeC:\MSOCache\All Users\{90140000-0015-040C-0000-0000000FF1CE}-C\AccLR.cab —
MD5:—
SHA256:—
33923573cfc1532dcfd367452038c5e54664cc21831f1cdebfdb8316d2fbde1ecc05.exeC:\$Recycle.Bin\S-1-5-21-1302019708-1500728564-335382590-1000\info.txtbinary
MD5:1A239EAF94158D23B901672D47B7BE64
SHA256:384FFB9E9650383C832317291FC3B41960D68A43E9FD4C292648C654165B2923
33923573cfc1532dcfd367452038c5e54664cc21831f1cdebfdb8316d2fbde1ecc05.exeC:\MSOCache\All Users\{90140000-0015-0407-0000-0000000FF1CE}-C\AccLR.cab.uk6ge —
MD5:—
SHA256:—
33923573cfc1532dcfd367452038c5e54664cc21831f1cdebfdb8316d2fbde1ecc05.exeC:\$Recycle.Bin\S-1-5-21-1302019708-1500728564-335382590-1000\desktop.ini.uk6gebinary
MD5:7007A1A2F057E64C7D6A06179B888264
SHA256:CBFE6DC465D2DA34E6EF182775CAD77D39B007DC67162209B0178D9FF6689699
33923573cfc1532dcfd367452038c5e54664cc21831f1cdebfdb8316d2fbde1ecc05.exeC:\MSOCache\All Users\{90140000-0015-0407-0000-0000000FF1CE}-C\AccessMUI.xml.uk6gebinary
MD5:38A7E346BD282C40D8989358FD2C19BE
SHA256:6F4C26D7D14BB132C60D311367FCA014464FFE90AC9C1E22486A342FA66F541B
33923573cfc1532dcfd367452038c5e54664cc21831f1cdebfdb8316d2fbde1ecc05.exeC:\MSOCache\All Users\{90140000-0015-040C-0000-0000000FF1CE}-C\AccessMUI.msi.uk6gebinary
MD5:6529CC4990B5CBEFF3C5EE2256A4DBBB
SHA256:FCA35CBE600ACE04961994F5EC9F0B8665DCDE9F54BC522CCD9F06F0A6543A1B
33923573cfc1532dcfd367452038c5e54664cc21831f1cdebfdb8316d2fbde1ecc05.exeC:\MSOCache\All Users\{90140000-0015-0407-0000-0000000FF1CE}-C\Setup.xml.uk6gebinary
MD5:174D0B8C735F4B1EA48DADCBD1097E47
SHA256:ED28A65B945D71A5EE37022D35D58B4F81D3E9CB720B42CB494618137BE96403
33923573cfc1532dcfd367452038c5e54664cc21831f1cdebfdb8316d2fbde1ecc05.exeC:\MSOCache\All Users\{90140000-0015-0407-0000-0000000FF1CE}-C\AccessMUI.msibinary
MD5:C112110B53859D0D47DA4F6AEE13A0DA
SHA256:EA9BE55567DCAAA8CD3BC582C1ECB32C4BACCC9C31A72FB3650575B5DEF7700F
33923573cfc1532dcfd367452038c5e54664cc21831f1cdebfdb8316d2fbde1ecc05.exeC:\$Recycle.Bin\S-1-5-21-1302019708-1500728564-335382590-1000\desktop.inibinary
MD5:7007A1A2F057E64C7D6A06179B888264
SHA256:CBFE6DC465D2DA34E6EF182775CAD77D39B007DC67162209B0178D9FF6689699
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
3573cfc1532dcfd367452038c5e54664cc21831f1cdebfdb8316d2fbde1ecc05.zip