analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| File name: | winhex.zip |
| Full analysis: | https://app.any.run/tasks/95480ccd-918e-41e4-8d19-cd879b2fe41d |
| Verdict: | Malicious activity |
| Analysis date: | April 15, 2019, 05:22:13 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v2.0 to extract |
| MD5: | 61A9A0C13391476C5F23C456F86BFBA9 |
| SHA1: | F670EAC27209A469BD836B00921FDC51631B021F |
| SHA256: | 5077181BE75D19FED2F2F8E55B7D50A603F9C561FCD9C55BF6141F0DDEB364D6 |
| SSDEEP: | 49152:N0KRPwJnykbmiFFt5U6HpUB6ihqGhJ3e4Aoz/OjgX/QF90bNnYdwfyShrz:NxRoxyNiFFt5JHCk0qGhZZOsINyyw |
MALICIOUS
Application was dropped or rewritten from another process
- setup.exe (PID: 3168)
- setup.exe (PID: 3172)
- WinHex.exe (PID: 3200)
Loads dropped or rewritten executable
- WinHex.exe (PID: 3200)
Changes settings of System certificates
- WinHex.exe (PID: 3200)
SUSPICIOUS
Executable content was dropped or overwritten
- WinRAR.exe (PID: 3004)
- setup.exe (PID: 3168)
Creates files in the program directory
- setup.exe (PID: 3168)
Creates a software uninstall entry
- setup.exe (PID: 3168)
Modifies the open verb of a shell class
- WinHex.exe (PID: 3200)
Adds / modifies Windows certificates
- WinHex.exe (PID: 3200)
INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .zip | | | ZIP compressed archive (100) |
|---|
EXIF
ZIP
| ZipFileName: | Boot Sector FAT.tpl |
|---|---|
| ZipUncompressedSize: | 1217 |
| ZipCompressedSize: | 619 |
| ZipCRC: | 0xdefcb594 |
| ZipModifyDate: | 2019:04:08 19:08:01 |
| ZipCompression: | Deflated |
| ZipBitFlag: | - |
| ZipRequiredVersion: | 20 |
Total processes
37
Monitored processes
4
Malicious processes
3
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 3004 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\winhex.zip" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
| 3172 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa3004.26820\setup.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa3004.26820\setup.exe | — | WinRAR.exe |
User: admin Company: X-Ways Software Technology AG Integrity Level: MEDIUM Description: X-Ways setup program Exit code: 3221226540 | ||||
| 3168 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa3004.26820\setup.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa3004.26820\setup.exe | WinRAR.exe | |
User: admin Company: X-Ways Software Technology AG Integrity Level: HIGH Description: X-Ways setup program Exit code: 0 | ||||
| 3200 | "C:\Program Files\WinHex\WinHex.exe" | C:\Program Files\WinHex\WinHex.exe | setup.exe | |
User: admin Company: X-Ways Software Technology AG Integrity Level: HIGH Description: WinHex Version: 19.8 | ||||
Total events
650
Read events
605
Write events
0
Delete events
0
Modification events
Executable files
10
Suspicious files
4
Text files
38
Unknown types
9
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3004 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa3004.26820\language.dat | binary | |
MD5:486D8B7CDB6D015D043C7807A89AFAE7 | SHA256:DD81B54BBB6B9531B2E1A84611DDA2FD8ECB8F7DF72B1F70103A2F75D7382C78 | |||
| 3004 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa3004.26820\Russian.txt | text | |
MD5:713A429643BB3E2466E62E0B0D9732F4 | SHA256:47B09B9DD9F8420DE9C167F3451F51DC35419AC5334D666A0C9753B17FB8FCF3 | |||
| 3004 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa3004.26820\File Type Signatures Search.txt | text | |
MD5:C0D59B7AE0452FDCA6267D7D856A214F | SHA256:356B465DA50C49B22893C836DB8126A7F40F92D82C7D3F7074D33CDFA01EF975 | |||
| 3004 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa3004.26820\Chinese.dat | executable | |
MD5:833AB5B37FEBB906DBFA095B8793D46E | SHA256:BF96BCD2180B7D5F1C5C50D1F3D146160B8A1AD642C0049C8CF283EC5BF1A172 | |||
| 3004 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa3004.26820\Ext Inode.tpl | text | |
MD5:1D289762E99B093DF7F9CD6290EC997C | SHA256:3BF09A19E830F142AD19525479EE25A1595D1343FC45368975A1435EA9885CBA | |||
| 3004 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa3004.26820\HFS+ Volume Header.tpl | text | |
MD5:50885AA828C69EC6E50211BA33039084 | SHA256:8CD31E3896894153574B810172E6D88A5D6F035BAA83A31A0D798B5CB94043DC | |||
| 3004 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa3004.26820\Boot Sector FAT.tpl | text | |
MD5:B62F0723A54D3F41160ABC8DF575B635 | SHA256:4B16A526FAECEE899F97547A2FE05B7513DE6A6C4F807C9F6623C94EC4D2C5EC | |||
| 3004 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa3004.26820\FAT Directory Entry.tpl | text | |
MD5:DFF5148C4020973C538331501435A137 | SHA256:832039763CB2E837CD48F24B9A44C6A928702A472C77D4CA847F140C2CD83C84 | |||
| 3004 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa3004.26820\Chinese.txt | text | |
MD5:CB1C4125F7A7C8201C3B2DA95D57D907 | SHA256:99581218C7B2D23AE939B23C9214FF37E4EB835458060E8C5269CC19CFF82DD6 | |||
| 3004 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa3004.26820\Master Boot Record.tpl | text | |
MD5:2994B4FD513A4BD3AEEED65ABCF169E1 | SHA256:92D1F63048C0518B04A7E417D9A6218A9E08643490938BB0034B706D6FD55DEA | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
1
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3200 | WinHex.exe | 172.217.16.163:443 | google.de | Google Inc. | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.de |
| whitelisted |