analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

7486336127.zip

Full analysis: https://app.any.run/tasks/6242ab7e-fd54-4e0b-a76f-16a056f2894d
Verdict: Malicious activity
Analysis date: May 20, 2022, 20:59:57
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

C3290C0664F13D0189196CBDF6EE9F0D

SHA1:

C622BDDF49FB40ADAF5CD09C839A28B8EBE5AD4E

SHA256:

4A72C78CE228A67780FFA05E8F4BFA6307540C30B1E355D127F3FD9799E4590B

SSDEEP:

96:sI/RROU7oh9FWPA5GNxXjgo3JIqO3/KtAsj9NJhHhBGbWOxl89kHzIxp:s0Xz7qXpA/HhBGbWOxC9qzop

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • WinRAR.exe (PID: 3120)

    • Application was dropped or rewritten from another process

      • go.exe (PID: 2868)

  • SUSPICIOUS

    • Checks supported languages

      • WinRAR.exe (PID: 3120)
      • go.exe (PID: 2868)

    • Reads the computer name

      • WinRAR.exe (PID: 3120)
      • go.exe (PID: 2868)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3120)

    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 3120)

    • Reads Environment values

      • go.exe (PID: 2868)

  • INFO

    • Manual execution by user

      • go.exe (PID: 2868)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: 6c4397aa90e39b4017e97803aa3fe5cd33d4ed90fcf1b1b3dc46f069b1c1dcf3
ZipUncompressedSize: 12288
ZipCompressedSize: 4138
ZipCRC: 0x3db0c9bb
ZipModifyDate: 1980:00:00 00:00:00
ZipCompression: Deflated
ZipBitFlag: 0x0009
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
2
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe go.exe

Process information

PID
CMD
Path
Indicators
Parent process
3120"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\7486336127.zip"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2868"C:\Users\admin\Desktop\go.exe" C:\Users\admin\Desktop\go.exe
Explorer.EXE
User:
admin
Company:
CPUID
Integrity Level:
MEDIUM
Description:
HWMonitor
Version:
1.3.4.0
Modules
Images
c:\users\admin\desktop\go.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
1 378
Read events
1 344
Write events
34
Delete events
0

Modification events

(PID) Process:(3120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3120) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\7486336127.zip
(PID) Process:(3120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
1
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
3120WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3120.6254\6c4397aa90e39b4017e97803aa3fe5cd33d4ed90fcf1b1b3dc46f069b1c1dcf3executable
MD5:1259083B68C743DFDD95D78E9BC4CDCC
SHA256:6C4397AA90E39B4017E97803AA3FE5CD33D4ED90FCF1B1B3DC46F069B1C1DCF3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2868
go.exe
GET
200
103.20.234.247:80
http://safeinthehandsofthegoodbois.com/cgi-sys/suspendedpage.cgi
AU
html
13.4 Kb
suspicious
2868
go.exe
GET
302
103.20.234.247:80
http://safeinthehandsofthegoodbois.com/loader/uploads/MSBuildUpdate2.4.6_Asfzbwkl.jpg
AU
html
683 b
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2868
go.exe
103.20.234.247:80
safeinthehandsofthegoodbois.com
Over The Wire Pty Ltd
AU
suspicious

DNS requests

Domain
IP
Reputation
safeinthehandsofthegoodbois.com
  • 103.20.234.247
suspicious

Threats

PID
Process
Class
Message
2868
go.exe
Potentially Bad Traffic
ET WEB_CLIENT Hex Obfuscation of String.fromCharCode % Encoding
2868
go.exe
Potentially Bad Traffic
ET WEB_CLIENT Hex Obfuscation of charCodeAt % Encoding
2868
go.exe
Potentially Bad Traffic
ET WEB_CLIENT Hex Obfuscation of document.write % Encoding
2868
go.exe
Potentially Bad Traffic
ET WEB_CLIENT Hex Obfuscation of parseInt % Encoding
2868
go.exe
Potentially Bad Traffic
ET WEB_CLIENT Hex Obfuscation of unescape % Encoding
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
7486336127.zip