File name:

____--____--___--__---.exe.zip

Full analysis: https://app.any.run/tasks/4d6045b5-b505-460a-9ecd-702e68104cc5
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Malware Trends Tracker     >>>
Analysis date: December 27, 2023, 00:38:46
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
sinkhole
trojan
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

0B08D919B518A0BDA0065AFCA5615AE2

SHA1:

CA8193066E9F1776BDFF05C2FEF0365C1F617767

SHA256:

50A5328C2C7F68921D2A738A0D2BED3B1E78C18FD8D91CB551035C131AAFB15A

SSDEEP:

98304:Kj9hEUQOQiWU2uXoaRYs5+70f3zeQyPNWpfz0uIfB9dIrkou7cI5dssrz2XJDQOk:oOdB+Fcr/7hVEmF5

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual connection from system programs

      • rundll32.exe (PID: 1560)

    • Connects to the CnC server

      • msiexec.exe (PID: 2396)

  • SUSPICIOUS

    • Reads the Internet Settings

      • cmd.exe (PID: 2448)
      • rundll32.exe (PID: 1560)
      • msiexec.exe (PID: 2396)
      • cmd.exe (PID: 3148)

    • Executing commands from a ".bat" file

      • ____--____--___--__---.exe (PID: 1540)
      • explorer.exe (PID: 2100)

    • Starts CMD.EXE for commands execution

      • ____--____--___--__---.exe (PID: 1540)
      • explorer.exe (PID: 2100)

    • Starts application with an unusual extension

      • rundll32.exe (PID: 1560)

  • INFO

    • Manual execution by a user

      • ____--____--___--__---.exe (PID: 1540)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 124)
      • ____--____--___--__---.exe (PID: 1540)
      • cmd.exe (PID: 2448)
      • msiexec.exe (PID: 2396)

    • Checks supported languages

      • ____--____--___--__---.exe (PID: 1540)
      • New4D02.tmp (PID: 2560)

    • Checks proxy server information

      • rundll32.exe (PID: 1560)
      • msiexec.exe (PID: 2396)

    • Reads the Internet Settings

      • explorer.exe (PID: 2444)
      • explorer.exe (PID: 2100)
      • explorer.exe (PID: 2376)
      • explorer.exe (PID: 2936)

    • Create files in a temporary directory

      • rundll32.exe (PID: 1560)
      • ____--____--___--__---.exe (PID: 1540)
      • msiexec.exe (PID: 2396)

    • Creates files or folders in the user directory

      • ____--____--___--__---.exe (PID: 1540)
      • msiexec.exe (PID: 2396)

    • Reads the computer name

      • New4D02.tmp (PID: 2560)

    • Changes appearance of the Explorer extensions

      • msiexec.exe (PID: 2396)

    • Creates files in the program directory

      • msiexec.exe (PID: 2396)

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 2396)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 2396)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2023:12:27 00:27:00
ZipCRC: 0x8735308d
ZipCompressedSize: 7586385
ZipUncompressedSize: 8856576
ZipFileName: ____--____--___--__---.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
62
Monitored processes
17
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe no specs ____--____--___--__---.exe cmd.exe no specs rundll32.exe explorer.exe no specs explorer.exe no specs new4d02.tmp no specs msiexec.exe explorer.exe no specs explorer.exe no specs rundll32.exe no specs explorer.exe no specs explorer.exe no specs cmd.exe no specs rundll32.exe no specs explorer.exe no specs explorer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
124"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\____--____--___--__---.exe.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1124 /n,"C:\ "C:\Windows\explorer.exe—rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1220"C:\Windows\system32\rundll32.exe"  \___--_____--_____--__-----___---__---_---___-_-.{4682DA98-5A05-428C-A069-4DE43A6C940A},IG42qocaOMA8ScSmC:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
1540"C:\Users\admin\Desktop\____--____--___--__---.exe" C:\Users\admin\Desktop\____--____--___--__---.exe
explorer.exe
User:
admin
Company:
Streuner Corporation
Integrity Level:
HIGH
Description:
analizando el virus del acceso directo by Streuner Corp. USB File Resc
Exit code:
0
Version:
01.00.00.00
Modules
Images
c:\users\admin\desktop\____--____--___--__---.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1560"C:\Windows\system32\rundll32.exe"  \___--_____--_____--__-----___---__---_---___-_-.{4682DA98-5A05-428C-A069-4DE43A6C940A},IG42qocaOMA8ScSm C:\Windows\System32\rundll32.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
2100C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -EmbeddingC:\Windows\explorer.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2244 /n,"C:\ "C:\Windows\explorer.exe—rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2376C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -EmbeddingC:\Windows\explorer.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2396"C:\Windows\system32\msiexec.exe"C:\Windows\System32\msiexec.exe
New4D02.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2444C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -EmbeddingC:\Windows\explorer.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
21 673
Read events
21 290
Write events
383
Delete events
0

Modification events

(PID) Process:(124) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(124) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(124) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(124) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(124) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(124) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(124) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(124) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(124) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(124) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
Executable files
4
Suspicious files
7
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
1560rundll32.exeC:\Users\admin\AppData\Local\Temp\New4D02.tmp —
MD5:—
SHA256:—
2396msiexec.exeC:\ProgramData\msuxjn.exe —
MD5:—
SHA256:—
124WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa124.2597\____--____--___--__---.exeexecutable
MD5:5D2C882ADF8FB4A40165AEC69F4668FB
SHA256:9540488091CA68AA667B274ADAFF51BF71DDC7E3B1A00AD942DB18C4C216DB7E
2448cmd.exeC:\Users\admin\AppData\Local\qb0E3D72.6B\w.battext
MD5:84A1D298113AD4DABF7BB9FD60E12020
SHA256:4C68758C8C8B997B94AC2F6BDB8750014013FA28161FC195975996E7F3B96514
1540____--____--___--__---.exeC:\Users\admin\AppData\Local\qb0E3D72.6B\IndexerVolumeGuidbinary
MD5:2B75561AF27B5A5CABF45BC9D581E11C
SHA256:384ED60BFE91810679858C80D6C534BFA1B235A09F6CF8E53B23EF5741E34745
1540____--____--___--__---.exeC:\Users\admin\AppData\Local\qb0E3D72.6B\Removable Drive (4GB).lnkbinary
MD5:64B15581640887B29E1E26A96CC8C6D7
SHA256:FCC417C2CC0CB230C27FF17202E22B9E38490740477442C964C45C6B407F6541
1540____--____--___--__---.exeC:\Users\admin\AppData\Local\Temp\1540ASMP.battext
MD5:F6FE31647C8824C25C02DA4B87BE2119
SHA256:EB9649B018CDEF1996F6F4BFC8DD61BA2BC15C2CA952F60CB4E7BDE1C0A8E9CB
2448cmd.exeC:\Users\admin\AppData\Local\qb0E3D72.6B\ \___--_____--_____--__-----___---__---_---___-_-.{4682DA98-5A05-428C-A069-4DE43A6C940A}executable
MD5:B3A2C0B6C9CD93CCA2149FB60F1B262F
SHA256:4013B661AA84693602AEB486E2F6C28C2F510A1D46BA540A7880208FC6DC3A29
1540____--____--___--__---.exeC:\Users\admin\AppData\Local\qb0E3D72.6B\___--_____--_____--__-----___---__---_---___-_-.{4682DA98-5A05-428C-A069-4DE43A6C940A}executable
MD5:B3A2C0B6C9CD93CCA2149FB60F1B262F
SHA256:4013B661AA84693602AEB486E2F6C28C2F510A1D46BA540A7880208FC6DC3A29
2396msiexec.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\CLWEE7FZ.txttext
MD5:1874A0739F2976511D507FDC0D35873B
SHA256:DF840F9AD627754383177A33811377D98874B2983E89906D91A680F08DDBC9E3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
25
DNS requests
33
Threats
29

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2396
msiexec.exe
POST
200
147.75.61.38:80
http://differentia.ru/diff.php
unknown
html
607 b
unknown
2396
msiexec.exe
POST
200
34.150.171.112:80
http://disorderstatus.ru/order.php
unknown
—
—
unknown
2396
msiexec.exe
GET
200
184.24.77.202:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?e3ba139c5954a76a
unknown
compressed
65.2 Kb
unknown
2396
msiexec.exe
POST
—
35.247.124.134:80
http://disorderstatus.ru/order.php
unknown
—
—
unknown
2396
msiexec.exe
POST
200
34.91.94.238:80
http://disorderstatus.ru/order.php
unknown
—
—
unknown
2396
msiexec.exe
POST
200
34.101.226.87:80
http://differentia.ru/diff.php
unknown
—
—
unknown
2396
msiexec.exe
POST
200
35.247.124.134:80
http://differentia.ru/diff.php
unknown
—
—
unknown
2396
msiexec.exe
POST
200
35.247.124.134:80
http://disorderstatus.ru/order.php
unknown
—
—
unknown
2396
msiexec.exe
POST
200
34.101.226.87:80
http://differentia.ru/diff.php
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1560
rundll32.exe
95.101.149.131:443
www.microsoft.com
Akamai International B.V.
NL
unknown
2396
msiexec.exe
51.15.182.163:123
europe.pool.ntp.org
—
—
unknown
2396
msiexec.exe
20.72.235.82:80
update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
2396
msiexec.exe
34.150.171.112:80
disorderstatus.ru
GOOGLE-CLOUD-PLATFORM
US
unknown
2396
msiexec.exe
147.75.61.38:80
—
PACKET
US
unknown
2396
msiexec.exe
95.101.149.131:443
www.microsoft.com
Akamai International B.V.
NL
unknown
2396
msiexec.exe
34.101.226.87:443
update.microsoft.com
GOOGLE-CLOUD-PLATFORM
ID
unknown

DNS requests

Domain
IP
Reputation
www.microsoft.com
  • 95.101.149.131
whitelisted
ww1.sgvaq70s7he.ru
  • —
unknown
europe.pool.ntp.org
  • 51.15.182.163
  • 185.232.69.65
  • 5.255.124.190
  • 129.250.35.250
unknown
update.microsoft.com
  • 34.101.226.87
  • 34.91.94.238
  • 35.247.124.134
  • 20.72.235.82
whitelisted
disorderstatus.ru
  • 34.150.171.112
unknown
differentia.ru
  • —
unknown
wpad
  • —
unknown
gvaq70s7he.ru
  • 34.101.226.87
  • 35.247.124.134
  • 34.91.94.238
unknown
ctldl.windowsupdate.com
  • 184.24.77.202
  • 184.24.77.194
whitelisted
ww1.gvaq70s7he.ru
  • 34.101.226.87
  • 35.247.124.134
  • 34.91.94.238
malicious

Threats

PID
Process
Class
Message
2396
msiexec.exe
Potentially Bad Traffic
ET HUNTING Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
2396
msiexec.exe
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
2396
msiexec.exe
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst
2396
msiexec.exe
Potentially Bad Traffic
ET HUNTING Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
2396
msiexec.exe
A Network Trojan was detected
AV TROJAN Domain Sinkholed by Kryptos Logic (HTML Response)
2396
msiexec.exe
Misc activity
ET MALWARE Known Sinkhole Response Kryptos Logic
2396
msiexec.exe
Not Suspicious Traffic
ET POLICY OpenSSL Demo CA - Internet Widgits Pty (O)
2396
msiexec.exe
Not Suspicious Traffic
ET POLICY OpenSSL Demo CA - Internet Widgits Pty (O)
2396
msiexec.exe
Not Suspicious Traffic
ET POLICY OpenSSL Demo CA - Internet Widgits Pty (O)
2396
msiexec.exe
Potentially Bad Traffic
ET HUNTING Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
8 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
____--____--___--__---.exe.zip