File name:

leaked by xakep-illya.7z

Full analysis: https://app.any.run/tasks/4576a687-6a46-4ab6-997b-d753c5ed6824
Verdict: Malicious activity
Analysis date: February 15, 2024, 23:47:56
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

128BB26FEA797F3817DBEEBAD6968CB9

SHA1:

59E6B02B429F1FB0D480103F1E37F00A8137554B

SHA256:

4642D79EA650349FDD95AF222826B28D91B5945F8EE3C19A67857495B01AEAE8

SSDEEP:

98304:tVs1QSepIa7CYh1QfpXZFzxADH7mTAUBwO23Req6HeMVghXQNh5mVP64phDReHnZ:+AiE9bnkLZJJ9/a8

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 1384)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 1384)

    • The process creates files with name similar to system file names

      • WinRAR.exe (PID: 1384)

    • Reads security settings of Internet Explorer

      • TianMa~.exe (PID: 1492)
      • TianMa~.exe (PID: 696)
      • t.exe (PID: 2592)

    • Reads the Internet Settings

      • TianMa~.exe (PID: 1492)
      • TianMa~.exe (PID: 696)
      • t.exe (PID: 2592)

  • INFO

    • Checks supported languages

      • wmpnscfg.exe (PID: 3348)
      • TianMa~.exe (PID: 1492)
      • TianMa~.exe (PID: 696)
      • wmpnscfg.exe (PID: 2960)
      • t.exe (PID: 2592)

    • Reads the computer name

      • wmpnscfg.exe (PID: 3348)
      • TianMa~.exe (PID: 1492)
      • wmpnscfg.exe (PID: 2960)
      • TianMa~.exe (PID: 696)
      • t.exe (PID: 2592)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3348)
      • TianMa~.exe (PID: 1492)
      • TianMa~.exe (PID: 696)
      • wmpnscfg.exe (PID: 2960)
      • t.exe (PID: 2592)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1384)

    • Reads the machine GUID from the registry

      • TianMa~.exe (PID: 1492)
      • TianMa~.exe (PID: 696)
      • t.exe (PID: 2592)

    • Checks proxy server information

      • TianMa~.exe (PID: 1492)
      • TianMa~.exe (PID: 696)
      • t.exe (PID: 2592)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
49
Monitored processes
6
Malicious processes
0
Suspicious processes
4

Behavior graph

Click at the process to see the details
start winrar.exe wmpnscfg.exe no specs tianma~.exe no specs tianma~.exe no specs wmpnscfg.exe no specs t.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
696"C:\Users\admin\Desktop\TianMa~.exe" C:\Users\admin\Desktop\TianMa~.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
TianMa~程序改变世界 代码描绘人生!
Exit code:
0
Version:
1, 0, 0, 1
Modules
Images
c:\users\admin\desktop\tianma~.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\avifil32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1384"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\leaked by xakep-illya.7z"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1492"C:\Users\admin\Desktop\TianMa~.exe" C:\Users\admin\Desktop\TianMa~.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
TianMa~程序改变世界 代码描绘人生!
Exit code:
0
Version:
1, 0, 0, 1
Modules
Images
c:\users\admin\desktop\tianma~.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\avifil32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2592"C:\Users\admin\Desktop\t.exe" C:\Users\admin\Desktop\t.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
TianMa~程序改变世界 代码描绘人生!
Exit code:
0
Version:
1, 0, 0, 1
Modules
Images
c:\users\admin\desktop\t.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\avifil32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2960"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3348"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
5 106
Read events
4 947
Write events
120
Delete events
39

Modification events

(PID) Process:(1384) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1384) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1384) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1384) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(1384) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(1384) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(1384) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\leaked by xakep-illya.7z
(PID) Process:(1384) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1384) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1384) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
22
Suspicious files
3
Text files
16
Unknown types
0

Dropped files

PID
Process
Filename
Type
1384WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1384.37679\Plugins\C_SCREEN.h —
MD5:—
SHA256:—
1384WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1384.37679\Tools\QQwry.dat —
MD5:—
SHA256:—
1384WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1384.37679\HFS\hfs.ips.txttext
MD5:9B3DE729FB9E735152EBA9C76E0A211A
SHA256:999A3D461D1628A91CBE0BA27D4A88CAA82DB6A1D3490A06318EF9CAB65A321A
1384WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1384.37679\Plugins\AnyFileToByte.exeexecutable
MD5:FF83181FDFF4572E4D21D3273B02E9F2
SHA256:A87637DB46B2076A44CA7399EB4D87A2FE0113147AA403B3B9C8AC7D365432F1
1384WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1384.37679\Plugins\C_VIDEO.htext
MD5:60617511F58E15D10C1563D7F2CD833B
SHA256:891E87582E4DEFFE432A7AD89F14F0A7B8A9BD93D82A4A846FECE8B33E4F74D0
1384WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1384.37679\Plugins\C_SCREEN2.htext
MD5:441A3AFA363FC713C46AEB7273CE2DB0
SHA256:37BB3DE9D80E0CBBA12EB6FEC27E42D5E7A420B19484CE044E33B55AFA9B682F
1384WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1384.37679\Plugins\DllToByte..ebinary
MD5:2C26D1F5227E922EF7EC87CCE3D4FDA3
SHA256:A1B85D9926A497DBE89EF5B1354BBB591E80C9CE4496B5B533EDE36DE5BB50BC
1384WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1384.37679\Tools\Encode.ebinary
MD5:8A87CD9B1CF6068752C4E60A671D1EE3
SHA256:08C3B55936F5E7963E92C1A90D77EB66F3CA171FE737375DCDFDAFDBEE8E6655
1384WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1384.37679\Plugins\C_SYSTEM.htext
MD5:F08646171DCC15FB45F1CA1901ED59BB
SHA256:BEFC38FC6009B793D4469CA95BB439F87389320C3CC0F9CE8D5E5807C698CD16
1384WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1384.37679\Plugins\C_SERVICE.htext
MD5:15171A514B7EF21891B74AE618C811B2
SHA256:8054EF6D7FB23906D70533B869F5EC4A5AB1A06C3A2A689D689D40823588A8FB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
15

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

PID
Process
Class
Message
1080
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Check Domain in DNS Lookup (whois .pconline .com .cn)
1080
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Check Domain in DNS Lookup (whois .pconline .com .cn)
1080
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Check Domain in DNS Lookup (whois .pconline .com .cn)
1080
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Check Domain in DNS Lookup (whois .pconline .com .cn)
1080
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Check Domain in DNS Lookup (whois .pconline .com .cn)
1080
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Check Domain in DNS Lookup (whois .pconline .com .cn)
1080
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Check Domain in DNS Lookup (whois .pconline .com .cn)
1080
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Check Domain in DNS Lookup (whois .pconline .com .cn)
1080
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Check Domain in DNS Lookup (whois .pconline .com .cn)
1080
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Check Domain in DNS Lookup (whois .pconline .com .cn)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
leaked by xakep-illya.7z