analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

7d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464.zip

Full analysis: https://app.any.run/tasks/8f80b6bd-efdb-419d-9f1e-7d5114fbf554
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: July 12, 2020, 15:55:24
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ransomware
sodinokibi
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

693955CFC19DD00D5C9BC29A90643A4C

SHA1:

0DCD14D9980AF60CEF0FC58B48EB3838E926674A

SHA256:

4D1BC523855425AEE031B5ED7D67F8CB9F84E17EB7FD55C0EFABF5ACD9F5B0F4

SSDEEP:

3072:aaIItCSHhtCqI1bsYrcIf3k8knR1jv+FSJqbSPpe0xFeoPBb4nzBhwBtPXKWclG:aHI8kRI1Vcjb+F1d+ZknTkVJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • 7d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464.exe (PID: 3020)
      • 7d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464.exe (PID: 2152)

    • Application was dropped or rewritten from another process

      • 7d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464.exe (PID: 3020)
      • 7d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464.exe (PID: 2152)
      • 7d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464.exe (PID: 2140)
      • 7d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464.exe (PID: 3452)

    • Sodinokibi ransom note found

      • 7d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464.exe (PID: 3452)

    • Renames files like Ransomware

      • 7d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464.exe (PID: 3452)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 7d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464.exe (PID: 3020)
      • 7d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464.exe (PID: 2152)

    • Application launched itself

      • 7d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464.exe (PID: 3020)
      • 7d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464.exe (PID: 2140)
      • 7d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464.exe (PID: 2152)

    • Executed via COM

      • unsecapp.exe (PID: 2292)

    • Creates files in the program directory

      • 7d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464.exe (PID: 3452)

    • Executed as Windows Service

      • vssvc.exe (PID: 2940)

    • Executes PowerShell scripts

      • 7d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464.exe (PID: 3452)

    • Creates files in the user directory

      • powershell.exe (PID: 3116)

    • Creates files like Ransomware instruction

      • 7d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464.exe (PID: 3452)

  • INFO

    • Manual execution by user

      • 7d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464.exe (PID: 3020)

    • Dropped object may contain TOR URL's

      • 7d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464.exe (PID: 3452)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0003
ZipCompression: Unknown (99)
ZipModifyDate: 2020:07:12 15:25:19
ZipCRC: 0xfe27fa9d
ZipCompressedSize: 166240
ZipUncompressedSize: 180089
ZipFileName: 7d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
49
Monitored processes
8
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs 7d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464.exe 7d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464.exe no specs 7d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464.exe #SODINOKIBI 7d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464.exe no specs powershell.exe no specs unsecapp.exe no specs vssvc.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3228"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\7d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3020"C:\Users\admin\Desktop\7d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464.exe" C:\Users\admin\Desktop\7d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.0.0.0
2140"C:\Users\admin\Desktop\7d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464.exe" C:\Users\admin\Desktop\7d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464.exe—7d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.0.0.0
2152"C:\Users\admin\Desktop\7d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464.exe" C:\Users\admin\Desktop\7d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464.exe
7d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
1.0.0.0
3452"C:\Users\admin\Desktop\7d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464.exe" C:\Users\admin\Desktop\7d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464.exe
7d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
1.0.0.0
3116powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—7d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2292C:\Windows\system32\wbem\unsecapp.exe -EmbeddingC:\Windows\system32\wbem\unsecapp.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Sink to receive asynchronous callbacks for WMI client application
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2940C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
1 082
Read events
1 006
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
163
Text files
1
Unknown types
4

Dropped files

PID
Process
Filename
Type
3228WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3228.17669\7d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464.exe —
MD5:—
SHA256:—
3116powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\FBJBJU9SY2D9M4SQ2KO7.temp —
MD5:—
SHA256:—
34527d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464.exeC:\Recovery\345b46fe-a9f9-11e7-a83c-e8a4f72b1d33\boot.sdi —
MD5:—
SHA256:—
34527d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464.exeC:\recovery\l6wj9-readme.txtbinary
MD5:8320370D2DCA2AB3007004AADD97DE2C
SHA256:7BA310419F3F667B8F09498C5BD3CD71E15EEB987608892C7D273F9C5D3E461A
34527d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464.exeC:\users\admin\contacts\l6wj9-readme.txtbinary
MD5:8320370D2DCA2AB3007004AADD97DE2C
SHA256:7BA310419F3F667B8F09498C5BD3CD71E15EEB987608892C7D273F9C5D3E461A
34527d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464.exeC:\users\administrator\l6wj9-readme.txtbinary
MD5:8320370D2DCA2AB3007004AADD97DE2C
SHA256:7BA310419F3F667B8F09498C5BD3CD71E15EEB987608892C7D273F9C5D3E461A
34527d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464.exeC:\users\l6wj9-readme.txtbinary
MD5:8320370D2DCA2AB3007004AADD97DE2C
SHA256:7BA310419F3F667B8F09498C5BD3CD71E15EEB987608892C7D273F9C5D3E461A
3116powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF286483.TMPbinary
MD5:17691DBE05169A3F5E1D4F8FED3B59B4
SHA256:7ECF78E14C72A002593D0576866318632906327947AF38A1764BA7B3D764E0D6
34527d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464.exeC:\recovery\345b46fe-a9f9-11e7-a83c-e8a4f72b1d33\l6wj9-readme.txtbinary
MD5:8320370D2DCA2AB3007004AADD97DE2C
SHA256:7BA310419F3F667B8F09498C5BD3CD71E15EEB987608892C7D273F9C5D3E461A
30207d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464.exeC:\Users\admin\AppData\Local\Temp\272344127binary
MD5:00BB146ECB6F0A326D17293DD51C0FEE
SHA256:02D529D0836B9E7E0CE3B288B0CC5463A2C735CBBA3DDFC432E7F6E776DB6666
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
7d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464.zip