File name:

DownCraft Demo Edition V4.7 HEN.zip

Full analysis: https://app.any.run/tasks/f0b0c758-f820-4de9-b82a-a5a5a526a57e
Verdict: Malicious activity
Analysis date: April 14, 2020, 04:20:16
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
opendir
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

B85A0605C871844181FF6F5E7E06698B

SHA1:

062C4443522EABE49B2697CDFF7A14C849DA111B

SHA256:

50405FE8873AB238A4CEE244CC1E55498440B9AE477EEC7DE304CA98F1DF6E08

SSDEEP:

196608:AiVQtULJqPPsiliVeKXM+RA7pdGS0a8nkBoIbD5I2IzKLHtyPof2BBfmE:AiVQbkVeKtRANwa8kPaby5fyft

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 1412)
      • DownCraft Demo.exe (PID: 3776)
      • DownCraft Demo.exe (PID: 3608)

    • Application was dropped or rewritten from another process

      • DownCraft Demo.exe (PID: 3776)
      • DownCraft Demo.exe (PID: 3608)

  • SUSPICIOUS

    • Modifies the open verb of a shell class

      • DownCraft Demo.exe (PID: 3608)
      • DownCraft Demo.exe (PID: 3776)

    • Reads Internet Cache Settings

      • DownCraft Demo.exe (PID: 3608)
      • DownCraft Demo.exe (PID: 3776)

    • Starts Internet Explorer

      • DownCraft Demo.exe (PID: 3776)

  • INFO

    • Manual execution by user

      • WinRAR.exe (PID: 3312)
      • DownCraft Demo.exe (PID: 3776)
      • DownCraft Demo.exe (PID: 3608)

    • Application launched itself

      • iexplore.exe (PID: 3988)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3988)
      • iexplore.exe (PID: 3172)

    • Changes internet zones settings

      • iexplore.exe (PID: 3988)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2020:02:09 11:45:13
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: Musics/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
7
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs winrar.exe no specs searchprotocolhost.exe no specs downcraft demo.exe downcraft demo.exe no specs iexplore.exe no specs iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
1412"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe5_ Global\UsGthrCtrlFltPipeMssGthrPipe5 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2140"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\DownCraft Demo Edition V4.7 HEN.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3172"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3988 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3312"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\DownCraft Demo Edition V4.7 HEN.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3608"C:\Users\admin\Desktop\DownCraft Demo.exe" C:\Users\admin\Desktop\DownCraft Demo.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
DownCraft Demo
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\downcraft demo.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3776"C:\Users\admin\Desktop\DownCraft Demo.exe" C:\Users\admin\Desktop\DownCraft Demo.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
DownCraft Demo
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\downcraft demo.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3988"C:\Program Files\Internet Explorer\iexplore.exe" https://downcraft.pw/C:\Program Files\Internet Explorer\iexplore.exe—DownCraft Demo.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
1 454
Read events
1 317
Write events
133
Delete events
4

Modification events

(PID) Process:(2140) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2140) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2140) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3312) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3312) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2140) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\DownCraft Demo Edition V4.7 HEN.zip
(PID) Process:(2140) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2140) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2140) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2140) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
0
Suspicious files
2
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
3312WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3312.39056\Musics\good.wav —
MD5:—
SHA256:—
3312WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3312.39056\Musics\music.mp3 —
MD5:—
SHA256:—
3312WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3312.39056\AxInterop.WMPLib.dll —
MD5:—
SHA256:—
3312WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3312.39056\Bunifu_UI_v1.5.3.dll —
MD5:—
SHA256:—
3312WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3312.39056\discord-rpc-w32.dll —
MD5:—
SHA256:—
3312WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3312.39056\DownCraft Demo.exe —
MD5:—
SHA256:—
3312WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3312.39056\MetroFramework.Design.dll —
MD5:—
SHA256:—
3312WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3312.39056\MetroFramework.dll —
MD5:—
SHA256:—
3312WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3312.39056\MetroFramework.Fonts.dll —
MD5:—
SHA256:—
3312WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3312.39056\PS3Lib.dll —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
3
DNS requests
3
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3776
DownCraft Demo.exe
GET
200
104.219.248.113:80
http://downcraft.pw/misaki/freeupdate.php
US
text
3 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3172
iexplore.exe
104.219.248.113:443
downcraft.pw
Namecheap, Inc.
US
malicious
3776
DownCraft Demo.exe
104.219.248.113:80
downcraft.pw
Namecheap, Inc.
US
malicious

DNS requests

Domain
IP
Reputation
downcraft.pw
  • 104.219.248.113
malicious
ocsp.usertrust.com
  • 151.139.128.14
whitelisted

Threats

PID
Process
Class
Message
1052
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.pw domain - Likely Hostile
3776
DownCraft Demo.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.pw domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
DownCraft Demo Edition V4.7 HEN.zip