File name:

PrimoCache 3.2.0.zip

Full analysis: https://app.any.run/tasks/a38709bd-48dc-4df0-a84e-c3ece5910a60
Verdict: Malicious activity
Analysis date: April 10, 2020, 13:09:38
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

824BD6D1B1354D40BF6B8CE1BFFE16E2

SHA1:

63F855C2AE96761EEF216B5A0DEBB2A752A22DB9

SHA256:

4AF3823814515D100AEF22129A4A61649E30AE0813B01E5B92A825D25074AA18

SSDEEP:

12288:OfmGgcaDwhPaQ7moXgBdvHgYB089D9TwDu+qyZDyC1yXq56QX4vN4VSAN9ooqt2:ImVchkmgBdvHNB083w6+qyZDywyXqsXs

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • PrimoCache 3.2.0.exe (PID: 3020)
      • PrimoCache 3.2.0.exe (PID: 1720)
      • sysinfo.exe (PID: 4072)

    • Uses Task Scheduler to run other applications

      • sysinfo.exe (PID: 4072)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 3040)
      • schtasks.exe (PID: 2220)

    • Actions looks like stealing of personal data

      • explorer.exe (PID: 772)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • PrimoCache 3.2.0.exe (PID: 3020)
      • PrimoCache 3.2.0.tmp (PID: 1332)
      • PrimoCache 3.2.0.exe (PID: 1720)
      • 7za.exe (PID: 2888)

    • Reads the Windows organization settings

      • PrimoCache 3.2.0.tmp (PID: 1332)

    • Reads Windows owner or organization settings

      • PrimoCache 3.2.0.tmp (PID: 1332)

    • Creates files in the user directory

      • PrimoCache 3.2.0.tmp (PID: 1332)
      • sysinfo.exe (PID: 4072)

    • Executed via COM

      • explorer.exe (PID: 772)

  • INFO

    • Manual execution by user

      • PrimoCache 3.2.0.exe (PID: 3020)

    • Application was dropped or rewritten from another process

      • 7za.exe (PID: 2660)
      • PrimoCache 3.2.0.tmp (PID: 2408)
      • 7za.exe (PID: 3016)
      • 7za.exe (PID: 2888)
      • PrimoCache 3.2.0.tmp (PID: 1332)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0001
ZipCompression: Deflated
ZipModifyDate: 2020:04:10 16:09:00
ZipCRC: 0xac6b8a1e
ZipCompressedSize: 697357
ZipUncompressedSize: 771230
ZipFileName: PrimoCache 3.2.0.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
59
Monitored processes
15
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start winrar.exe no specs primocache 3.2.0.exe primocache 3.2.0.tmp no specs primocache 3.2.0.exe primocache 3.2.0.tmp 7za.exe no specs 7za.exe 7za.exe no specs sysinfo.exe no specs schtasks.exe no specs schtasks.exe no specs explorer.exe no specs explorer.exe notepad.exe no specs notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
772C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -EmbeddingC:\Windows\explorer.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1332"C:\Users\admin\AppData\Local\Temp\is-5QJ73.tmp\PrimoCache 3.2.0.tmp" /SL5="$70216,369076,121344,C:\Users\admin\Desktop\PrimoCache 3.2.0.exe" /SPAWNWND=$601EA /NOTIFYWND=$801C2 C:\Users\admin\AppData\Local\Temp\is-5QJ73.tmp\PrimoCache 3.2.0.tmp
PrimoCache 3.2.0.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-5qj73.tmp\primocache 3.2.0.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1720"C:\Users\admin\Desktop\PrimoCache 3.2.0.exe" /SPAWNWND=$601EA /NOTIFYWND=$801C2 C:\Users\admin\Desktop\PrimoCache 3.2.0.exe
PrimoCache 3.2.0.tmp
User:
admin
Company:
Integrity Level:
HIGH
Description:
Exit code:
0
Version:
4.9
Modules
Images
c:\users\admin\desktop\primocache 3.2.0.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1800"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\PrimoCache 3.2.0.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2220"C:\Windows\system32\schtasks.exe" /Create /f /XML "C:\Users\admin\AppData\Roaming\SystemDiag\data.xml" /tn "Microsoft\Windows\Windows Error Reporting\SystemInfo"C:\Windows\system32\schtasks.exe—sysinfo.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2364"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\PrimoCache 3.2.0\license.txtC:\Windows\system32\NOTEPAD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\notepad.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2408"C:\Users\admin\AppData\Local\Temp\is-IGK8P.tmp\PrimoCache 3.2.0.tmp" /SL5="$801C2,369076,121344,C:\Users\admin\Desktop\PrimoCache 3.2.0.exe" C:\Users\admin\AppData\Local\Temp\is-IGK8P.tmp\PrimoCache 3.2.0.tmp—PrimoCache 3.2.0.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-igk8p.tmp\primocache 3.2.0.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2660"C:\Users\admin\AppData\Local\Temp\is-HO79I.tmp\7za.exe" x "C:\Users\admin\AppData\Local\Temp\is-HO79I.tmp\sub.res" -p"b1lig@n_vl"C:\Users\admin\AppData\Local\Temp\is-HO79I.tmp\7za.exe—PrimoCache 3.2.0.tmp
User:
admin
Company:
Igor Pavlov
Integrity Level:
HIGH
Description:
7-Zip Standalone Console
Exit code:
0
Version:
4.65
Modules
Images
c:\users\admin\appdata\local\temp\is-ho79i.tmp\7za.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
2720"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\PrimoCache 3.2.0\license.txtC:\Windows\system32\NOTEPAD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\notepad.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2888"C:\Users\admin\AppData\Local\Temp\is-HO79I.tmp\7za.exe" x "C:\Users\admin\AppData\Local\Temp\is-HO79I.tmp\form.res" -p"b1lig@n_vl"C:\Users\admin\AppData\Local\Temp\is-HO79I.tmp\7za.exe
PrimoCache 3.2.0.tmp
User:
admin
Company:
Igor Pavlov
Integrity Level:
HIGH
Description:
7-Zip Standalone Console
Exit code:
0
Version:
4.65
Modules
Images
c:\users\admin\appdata\local\temp\is-ho79i.tmp\7za.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
Total events
1 415
Read events
1 275
Write events
136
Delete events
4

Modification events

(PID) Process:(1800) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1800) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1800) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1800) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\PrimoCache 3.2.0.zip
(PID) Process:(1800) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1800) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1800) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1800) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1800) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(1332) PrimoCache 3.2.0.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
34050000002DE36F390FD601
Executable files
5
Suspicious files
3
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
1800WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1800.3537\PrimoCache 3.2.0.exe —
MD5:—
SHA256:—
1332PrimoCache 3.2.0.tmpC:\Users\admin\AppData\Local\Temp\{13B7293C-20F1-44E2-9249-C1B421E35CD9}\is-Q8SCP.tmp —
MD5:—
SHA256:—
1332PrimoCache 3.2.0.tmpC:\Users\admin\AppData\Local\Temp\{13B7293C-20F1-44E2-9249-C1B421E35CD9}\license.txt —
MD5:—
SHA256:—
4072sysinfo.exeC:\Users\admin\AppData\Roaming\SystemDiag\data.xml —
MD5:—
SHA256:—
1332PrimoCache 3.2.0.tmpC:\Users\admin\Desktop\PrimoCache 3.2.0\license.txttext
MD5:—
SHA256:—
1332PrimoCache 3.2.0.tmpC:\Users\admin\AppData\Local\Temp\is-HO79I.tmp\sub.rescompressed
MD5:AE50AD46B7EF3517F5DF5EDF2B96443E
SHA256:F4A2B3FA7460606D58AD078D320AFCEAD400285304DC49E8F2BA3FA9800854DC
3020PrimoCache 3.2.0.exeC:\Users\admin\AppData\Local\Temp\is-IGK8P.tmp\PrimoCache 3.2.0.tmpexecutable
MD5:34ACC2BDB45A9C436181426828C4CB49
SHA256:9C81817ACD4982632D8C7F1DF3898FCA1477577738184265D735F49FC5480F07
1332PrimoCache 3.2.0.tmpC:\Users\admin\AppData\Roaming\SystemDiag\sysinfo.exeexecutable
MD5:—
SHA256:—
1332PrimoCache 3.2.0.tmpC:\Users\admin\AppData\Local\Temp\is-HO79I.tmp\misc.rescompressed
MD5:—
SHA256:—
28887za.exeC:\Users\admin\AppData\Local\Temp\is-HO79I.tmp\form.exeexecutable
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
2
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1332
PrimoCache 3.2.0.tmp
GET
200
104.28.30.94:80
http://video-box.org/getchannel
US
binary
1 b
malicious
1332
PrimoCache 3.2.0.tmp
POST
200
172.217.22.78:80
http://www.google-analytics.com/collect
US
image
35 b
whitelisted
1332
PrimoCache 3.2.0.tmp
POST
200
172.217.22.78:80
http://www.google-analytics.com/collect
US
image
35 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1332
PrimoCache 3.2.0.tmp
104.28.30.94:80
video-box.org
Cloudflare Inc
US
shared
1332
PrimoCache 3.2.0.tmp
172.217.22.78:80
www.google-analytics.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
www.google-analytics.com
  • 172.217.22.78
whitelisted
video-box.org
  • 104.28.30.94
  • 104.28.31.94
malicious

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
PrimoCache 3.2.0.zip