Malware analysis Sample.7z Malicious activity | ANY.RUN

Add for printing

File name:	Sample.7z
Full analysis:	https://app.any.run/tasks/d0190ca5-c4eb-4079-b41f-66c21c8ea673
Verdict:	Malicious activity
Analysis date:	October 25, 2024, 09:24:04
OS:	Windows 10 Professional (build: 19045, 64 bit)
Tags:	arch-exec
Indicators:
MIME:	application/x-7z-compressed
File info:	7-zip archive data, version 0.4
MD5:	BBE30FA2F3521E9A7B21D77D3F5BD4DA
SHA1:	C35608944855D406274271618D62A1F322F88CEB
SHA256:	533CA17F56490490EB92D519F23B5A0A8EAB09BD7D2570BB0C2DB6C6D1E780E9
SSDEEP:	196608:zYm7DAIhlUxv3X9jt41Quc30PVhT7OKCq8TpK:z1jhlkPXJt4Nckd97VP8TpK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 60 seconds
Heavy Evasion option:
Network geolocation:: off
Additional time used:: none
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
No malicious indicators.
SUSPICIOUS
- Process drops legitimate windows executable
  - WinRAR.exe (PID: 3620)
  - Setup.exe (PID: 692)
- Executable content was dropped or overwritten
  - Setup.exe (PID: 692)
  - more.com (PID: 6192)
- Starts application with an unusual extension
  - Setup.exe (PID: 692)
- The process drops C-runtime libraries
  - WinRAR.exe (PID: 3620)
  - Setup.exe (PID: 692)
INFO
- Manual execution by a user
  - Setup.exe (PID: 692)
- Executable content was dropped or overwritten
  - WinRAR.exe (PID: 3620)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.7z	\|	7-Zip compressed archive (v0.4) (57.1)
.7z	\|	7-Zip compressed archive (gen) (42.8)

EXIF

ZIP

FileVersion:	7z v0.04
ModifyDate:	2024:10:24 21:16:32+00:00
ArchivedFileName:	fobd

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

126

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

692

"C:\Users\admin\Desktop\Setup.exe"

C:\Users\admin\Desktop\Setup.exe

explorer.exe

User:

admin

Company:

Rene.E Laboratory

Integrity Level:

MEDIUM

Description:

Renee Facebook Share Widget

Exit code:

Version:

Modules

Images
c:\users\admin\desktop\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll

1804

C:\Users\admin\AppData\Local\Temp\AutoIt3.exe

—

more.com

User:

admin

Company:

AutoIt Team

Integrity Level:

MEDIUM

Description:

AutoIt v3 Script (Beta)

Version:

3, 3, 15, 1

Modules

Images
c:\users\admin\appdata\local\temp\huhsadkie
c:\users\admin\appdata\local\temp\autoit3.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\psapi.dll

3620

"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\Sample.7z

C:\Program Files\WinRAR\WinRAR.exe

explorer.exe

User:

admin

Company:

Alexander Roshal

Integrity Level:

MEDIUM

Description:

WinRAR archiver

Exit code:

Version:

5.91.0

Modules

Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll

5896

\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

—

more.com

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Console Window Host

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

6192

C:\WINDOWS\SysWOW64\more.com

C:\Windows\SysWOW64\more.com

Setup.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

More Utility

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\syswow64\more.com
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll

Add for printing

Total events

1 633

Read events

1 606

Write events

Delete events

Modification events


(PID) Process:	(3620) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:	delete value	Name:	15
Value:
(PID) Process:	(3620) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:	delete value	Name:	14
Value:
(PID) Process:	(3620) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:	delete value	Name:	13
Value:
(PID) Process:	(3620) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:	delete value	Name:	12
Value:
(PID) Process:	(3620) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:	delete value	Name:	11
Value:
(PID) Process:	(3620) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:	delete value	Name:	10
Value:
(PID) Process:	(3620) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:	delete value	Name:	9
Value:
(PID) Process:	(3620) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:	delete value	Name:	8
Value:
(PID) Process:	(3620) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:	delete value	Name:	7
Value:
(PID) Process:	(3620) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:	delete value	Name:	6
Value:

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
3620	WinRAR.exe	C:\Users\admin\Desktop\iasdatastore.dll		executable
		MD5:E50E4D385A74164D581523F88B38537C	SHA256:B96DADF3676D2DBBB44AC2639B43EC71D2C87B3285BAC85B11CF0291A7077939
3620	WinRAR.exe	C:\Users\admin\Desktop\opengl64.dll		executable
		MD5:0A84667145E7EFEF026C888D4B768126	SHA256:DD575F3C64382193610815909BD2C52490244ECBBB9BBA6EEF5FE4F0BB43BB4D
3620	WinRAR.exe	C:\Users\admin\Desktop\QtCore4.dll		executable
		MD5:FECC62A37D37D9759E6B02041728AA23	SHA256:94C1395153D7758900979351E633AB68D22AE9B306EF8E253B712A1AAB54C805
6192	more.com	C:\Users\admin\AppData\Local\Temp\huhsadkie		—
		MD5:—	SHA256:—
3620	WinRAR.exe	C:\Users\admin\Desktop\QtGui4.dll		executable
		MD5:831BA3A8C9D9916BDF82E07A3E8338CC	SHA256:D2C8C8B6CC783E4C00A5EF3365457D776DFC1205A346B676915E39D434F5A52D
3620	WinRAR.exe	C:\Users\admin\Desktop\msvcr100.dll		executable
		MD5:67EC459E42D3081DD8FD34356F7CAFC1	SHA256:1221A09484964A6F38AF5E34EE292B9AFEFCCB3DC6E55435FD3AAF7C235D9067
3620	WinRAR.exe	C:\Users\admin\Desktop\AdTree.dll		executable
		MD5:530957A391C6BC978AE7179179594B12	SHA256:9FBEAB4BCFCEC34DC13CAD90609101B2EA099069AB173555635F174597E4EA09
3620	WinRAR.exe	C:\Users\admin\Desktop\AbRoot.dll		executable
		MD5:530957A391C6BC978AE7179179594B12	SHA256:9FBEAB4BCFCEC34DC13CAD90609101B2EA099069AB173555635F174597E4EA09
3620	WinRAR.exe	C:\Users\admin\Desktop\fobd		binary
		MD5:EFF9E5153BB86111E330ED737FF4B148	SHA256:401096F8C03EC2212C7796C4B566A90700239752DC88AAACBD832CF663A3F64D
692	Setup.exe	C:\Users\admin\AppData\Roaming\EDD\msvcp100.dll		executable
		MD5:03E9314004F504A14A61C3D364B62F66	SHA256:A3BA6421991241BEA9C8334B62C3088F8F131AB906C3CC52113945D05016A35F

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
5488	MoUsoCoreWorker.exe	GET	200	23.53.41.90:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5488	MoUsoCoreWorker.exe	GET	200	23.52.120.96:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
—	—	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D	unknown	—	—	whitelisted
6180	SIHClient.exe	GET	200	23.52.120.96:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl	unknown	—	—	whitelisted
2364	svchost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
4316	backgroundTaskHost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted
6180	SIHClient.exe	GET	200	23.52.120.96:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:137	—	—	—	whitelisted
6944	svchost.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
5640	RUXIMICS.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
—	—	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
5488	MoUsoCoreWorker.exe	23.53.41.90:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
4360	SearchApp.exe	2.16.110.195:443	www.bing.com	Akamai International B.V.	DE	whitelisted
5488	MoUsoCoreWorker.exe	23.52.120.96:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
—	—	192.229.221.95:80	ocsp.digicert.com	EDGECAST	US	whitelisted
4020	svchost.exe	239.255.255.250:1900	—	—	—	whitelisted
—	—	192.168.100.255:138	—	—	—	whitelisted

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	51.124.78.146 40.127.240.158	whitelisted
crl.microsoft.com	23.53.41.90 23.53.40.176	whitelisted
www.bing.com	2.16.110.195 2.16.110.138 2.16.110.152 2.16.110.130 2.16.110.161 2.16.110.168 2.16.110.171 2.23.209.179 2.23.209.162 2.23.209.168 2.23.209.174 2.23.209.171 2.23.209.176 2.23.209.166 2.23.209.178 2.23.209.177	whitelisted
google.com	216.58.206.78	whitelisted
www.microsoft.com	23.52.120.96	whitelisted
ocsp.digicert.com	192.229.221.95	whitelisted
login.live.com	40.126.32.134 40.126.32.136 40.126.32.72 40.126.32.68 20.190.160.22 20.190.160.14 40.126.32.76 40.126.32.74	whitelisted
th.bing.com	2.23.209.186 2.23.209.185 2.23.209.131 2.23.209.182 2.23.209.130 2.23.209.189 2.23.209.193 2.23.209.191 2.23.209.187	whitelisted
go.microsoft.com	23.213.166.81	whitelisted
arc.msn.com	20.223.36.55	whitelisted

Threats

No threats detected

Add for printing

No debug info

General Info

Sample.7z

BBE30FA2F3521E9A7B21D77D3F5BD4DA

C35608944855D406274271618D62A1F322F88CEB

533CA17F56490490EB92D519F23B5A0A8EAB09BD7D2570BB0C2DB6C6D1E780E9

196608:zYm7DAIhlUxv3X9jt41Quc30PVhT7OKCq8TpK:z1jhlkPXJt4Nckd97VP8TpK

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

Process drops legitimate windows executable

Executable content was dropped or overwritten

Starts application with an unusual extension

The process drops C-runtime libraries

INFO

Manual execution by a user

Executable content was dropped or overwritten

Malware configuration

Static information

TRiD

EXIF

ZIP

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings