File name:

Yeni alış sifariş siyahısı.zip

Full analysis: https://app.any.run/tasks/861fe78c-5a9c-4bd9-9241-de13ebe22c43
Verdict: Malicious activity
Analysis date: August 08, 2020, 11:35:34
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

6868D4A97FA709A20CB920F19A0A8991

SHA1:

343E69ECBEF23111B27092C44CD2D52CF6151C41

SHA256:

49AF1EB21D42899EEA8A4384E4DEE2BB5EEC81803E9EE64591EEB60416F9BE56

SSDEEP:

24576:VA7ZeBS1vCq+9lVoqISmbQN0K/B7rV2XWIi7gUYtZYgsYK2DDT:VvBcCq+ZrISm0NNB7wmTEUYnYgsaj

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes settings of System certificates

      • Yeni alış sifariş siyahısı.exe (PID: 3788)

    • Application was dropped or rewritten from another process

      • Yeni alış sifariş siyahısı.exe (PID: 372)
      • Yeni alış sifariş siyahısı.exe (PID: 3788)

  • SUSPICIOUS

    • Reads Internet Cache Settings

      • Yeni alış sifariş siyahısı.exe (PID: 3788)
      • Yeni alış sifariş siyahısı.exe (PID: 372)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1912)

    • Starts CMD.EXE for commands execution

      • cmmon32.exe (PID: 1412)

    • Adds / modifies Windows certificates

      • Yeni alış sifariş siyahısı.exe (PID: 3788)

    • Creates files in the user directory

      • Yeni alış sifariş siyahısı.exe (PID: 3788)

  • INFO

    • Manual execution by user

      • Yeni alış sifariş siyahısı.exe (PID: 372)
      • cmmon32.exe (PID: 1412)

    • Reads the hosts file

      • cmmon32.exe (PID: 1412)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
6
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start start winrar.exe yeni alış sifariş siyahısı.exe yeni alış sifariş siyahısı.exe no specs tapiunattend.exe no specs cmmon32.exe no specs cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
372"C:\Users\admin\Desktop\Yeni alış sifariş siyahısı.exe" C:\Users\admin\Desktop\Yeni alış sifariş siyahısı.exe—explorer.exe
User:
admin
Company:
Sysinternals - www.sysinternals.com
Integrity Level:
MEDIUM
Description:
Sysinternals Process Explorer
Exit code:
0
Version:
16.21
Modules
Images
c:\users\admin\desktop\yeni alış sifariş siyahısı.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1412"C:\Windows\System32\cmmon32.exe"C:\Windows\System32\cmmon32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Connection Manager Monitor
Exit code:
0
Version:
7.02.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\cmmon32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cmutil.dll
1832/c del "C:\Windows\System32\TapiUnattend.exe"C:\Windows\System32\cmd.exe—cmmon32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1912"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Yeni alış sifariş siyahısı.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2388C:\Windows\System32\TapiUnattend.exeC:\Windows\System32\TapiUnattend.exe—Yeni alış sifariş siyahısı.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Windows(TM) Telephony Unattend Action
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\tapiunattend.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\wdscore.dll
c:\windows\system32\oleaut32.dll
3788"C:\Users\admin\AppData\Local\Temp\Rar$EXa1912.39028\Yeni alış sifariş siyahısı.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa1912.39028\Yeni alış sifariş siyahısı.exe
WinRAR.exe
User:
admin
Company:
Sysinternals - www.sysinternals.com
Integrity Level:
MEDIUM
Description:
Sysinternals Process Explorer
Exit code:
0
Version:
16.21
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa1912.39028\yeni alış sifariş siyahısı.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
Total events
506
Read events
463
Write events
41
Delete events
2

Modification events

(PID) Process:(1912) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1912) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1912) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\137\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1912) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\137\52C64B7E
Operation:writeName:@C:\Windows\system32\NetworkExplorer.dll,-1
Value:
Network
(PID) Process:(1912) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Yeni alış sifariş siyahısı.zip
(PID) Process:(1912) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1912) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1912) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1912) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1912) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
Executable files
1
Suspicious files
6
Text files
2
Unknown types
3

Dropped files

PID
Process
Filename
Type
1912WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1912.40634\Yeni alış sifariş siyahısı.exe —
MD5:—
SHA256:—
3788Yeni alış sifariş siyahısı.exeC:\Users\admin\AppData\Local\Temp\CabD722.tmp —
MD5:—
SHA256:—
3788Yeni alış sifariş siyahısı.exeC:\Users\admin\AppData\Local\Temp\TarD723.tmp —
MD5:—
SHA256:—
3788Yeni alış sifariş siyahısı.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\64DCC9872C5635B1B7891B30665E0558_5552C20A2631357820903FD38A8C0F9Fbinary
MD5:—
SHA256:—
3788Yeni alış sifariş siyahısı.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_979AB563CEB98F2581C14ED89B8957D4binary
MD5:—
SHA256:—
3788Yeni alış sifariş siyahısı.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6AF4EE75E3A4ABA658C0087EB9A0BB5B_F80805103A05D4F74523519C6EAD8FC0der
MD5:—
SHA256:—
3788Yeni alış sifariş siyahısı.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\64DCC9872C5635B1B7891B30665E0558_5552C20A2631357820903FD38A8C0F9Fder
MD5:—
SHA256:—
1912WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1912.39028\Yeni alış sifariş siyahısı.exeexecutable
MD5:—
SHA256:—
3788Yeni alış sifariş siyahısı.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\4IZG90I2.txttext
MD5:—
SHA256:—
3788Yeni alış sifariş siyahısı.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\Osudddd[1]text
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
4
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3788
Yeni alış sifariş siyahısı.exe
GET
200
151.139.128.14:80
http://ocsp.comodoca4.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrJdiQ%2Ficg9B19asFe73bPYs%2BreAQUdXGnGUgZvJ2d6kFH35TESHeZ03kCEFslzmkHxCZVZtM5DJmpVK0%3D
US
der
314 b
whitelisted
3788
Yeni alış sifariş siyahısı.exe
GET
200
151.139.128.14:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEBblhnjgcJQ5S9%2FbTvymO98%3D
US
der
471 b
whitelisted
3788
Yeni alış sifariş siyahısı.exe
GET
200
151.139.128.14:80
http://ocsp.comodoca4.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTOpjOEf6LG1z52jqAxwDlTxoaOCgQUQAlhZ%2FC8g3FP3hIILG%2FU1Ct2PZYCEDJAnJQUGG0bwuno3m2vDJ8%3D
US
der
279 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3788
Yeni alış sifariş siyahısı.exe
2.21.38.54:443
www.microsoft.com
GTT Communications Inc.
FR
malicious
3788
Yeni alış sifariş siyahısı.exe
151.139.128.14:80
ocsp.comodoca.com
Highwinds Network Group, Inc.
US
suspicious
3788
Yeni alış sifariş siyahısı.exe
162.159.129.233:443
cdn.discordapp.com
Cloudflare Inc
—
shared

DNS requests

Domain
IP
Reputation
www.microsoft.com
  • 2.21.38.54
whitelisted
cdn.discordapp.com
  • 162.159.129.233
  • 162.159.133.233
  • 162.159.130.233
  • 162.159.134.233
  • 162.159.135.233
shared
ocsp.comodoca.com
  • 151.139.128.14
whitelisted
ocsp.comodoca4.com
  • 151.139.128.14
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Yeni alış sifariş siyahısı.zip