analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

WinDie V2.zip

Full analysis: https://app.any.run/tasks/d58ea1db-ed23-42f5-945a-7ca2dd877248
Verdict: Malicious activity
Analysis date: March 30, 2020, 19:16:47
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

E73ADC10887397F92E2D32F46CACE641

SHA1:

B5E611406C489AE597C3B35547902EFCB39835AD

SHA256:

503ACC26F96A3A89305C1F601579CE6741B595F7702058BB1FDD6768837396D7

SSDEEP:

6:5j9BuVxVjfaJ3uQsIbEEHeHxlLEwBuuauwWuB+lit/:5j9BaVjf8eyJHeRywBLbkBai1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • cmd.exe (PID: 3228)

    • Tries to delete the host file

      • cmd.exe (PID: 3228)

  • SUSPICIOUS

    • Executed as Windows Service

      • SearchIndexer.exe (PID: 1332)
      • SearchIndexer.exe (PID: 3380)

    • Creates files in the program directory

      • SearchIndexer.exe (PID: 1332)
      • SearchIndexer.exe (PID: 3380)

    • Creates files in the Windows directory

      • SearchIndexer.exe (PID: 3380)

    • Removes files from Windows directory

      • cmd.exe (PID: 3228)

  • INFO

    • Manual execution by user

      • cmd.exe (PID: 3228)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2020:03:30 19:13:21
ZipCRC: 0x187cfbee
ZipCompressedSize: 134
ZipUncompressedSize: 175
ZipFileName: break.bat
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
50
Monitored processes
8
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs cmd.exe timeout.exe no specs searchindexer.exe no specs searchindexer.exe no specs searchprotocolhost.exe no specs searchfilterhost.exe no specs searchprotocolhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
604"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\WinDie V2.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3228"C:\Windows\System32\cmd.exe" /C "C:\Users\admin\Desktop\break.bat" C:\Windows\System32\cmd.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2564timeout 5C:\Windows\system32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
timeout - pauses command processing
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1332C:\Windows\system32\SearchIndexer.exe /EmbeddingC:\Windows\system32\SearchIndexer.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Indexer
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
3380C:\Windows\system32\SearchIndexer.exe /EmbeddingC:\Windows\system32\SearchIndexer.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Indexer
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
3356"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\system32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
2852"C:\Windows\system32\SearchFilterHost.exe" 0 520 524 532 65536 528 C:\Windows\system32\SearchFilterHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Windows Search Filter Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
3732"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1302019708-1500728564-335382590-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1302019708-1500728564-335382590-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"C:\Windows\system32\SearchProtocolHost.exe—SearchIndexer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
Total events
3 493
Read events
1 852
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
19
Text files
2
Unknown types
7

Dropped files

PID
Process
Filename
Type
604WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa604.16185\break.bat —
MD5:—
SHA256:—
1332SearchIndexer.exeC:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb —
MD5:—
SHA256:—
1332SearchIndexer.exeC:\ProgramData\Microsoft\Search\Data\Applications\Windows\tmp.edb —
MD5:—
SHA256:—
3380SearchIndexer.exeC:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSStmp.log —
MD5:—
SHA256:—
3380SearchIndexer.exeC:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log —
MD5:—
SHA256:—
3380SearchIndexer.exeC:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb —
MD5:—
SHA256:—
1332SearchIndexer.exeC:\ProgramData\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.11.gthrtext
MD5:19BD6DEDCA5778497B1B0E4330FF52C2
SHA256:83F3D7A9D684E3FC2D03A206CE98ADC5BF3B64ED4AE3ABFE7C190CAA18B8B6E9
1332SearchIndexer.exeC:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chkbinary
MD5:FD53A676899F28A32AFD454C29D3805E
SHA256:6BB2A002FBE8CABC7BAA487301991952A0036A029F6085541FAE087F5891741C
1332SearchIndexer.exeC:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.logbinary
MD5:59B6363E358C18C4F670F93AEF3E23E8
SHA256:4E0FF6D35263637592F734C00A515A35F6B5E9159D55943AB12AB120CACB7AE3
3380SearchIndexer.exeC:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chkbinary
MD5:D380C00A909AE460DA5AA6A724D17ECD
SHA256:86471E4124ACD7AC467CBF8163573031C908B0028C1A98C3E2F24A5AB1A23E15
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
WinDie V2.zip