analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

x64__x32__installer (1).zip

Full analysis: https://app.any.run/tasks/9256f875-a1fc-4a48-887f-4e02b23c4197
Verdict: Malicious activity
Analysis date: May 01, 2024, 18:52:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

E5F53ECB931CEFEF3B66C8F08ED97B9A

SHA1:

D395E114E7A28FF8044C7552261D6D7DE49FAC26

SHA256:

53BFA98CB9BF49F55E670DAE62BC424D6910FAD1D85C48DA76E09148E64797E4

SSDEEP:

98304:F0Ih+J8ogLmnkDg7bjH+A+EvSCv/zLDf+71nc7jsQrvfqs8S2DC7Yi1vlvh4rHTU:YEfotEnjNUMyDb

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • msiexec.exe (PID: 2024)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 4064)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 2024)

  • INFO

    • Checks supported languages

      • msiexec.exe (PID: 2204)
      • msiexec.exe (PID: 2024)
      • msiexec.exe (PID: 692)
      • msiexec.exe (PID: 2284)

    • Manual execution by a user

      • msiexec.exe (PID: 1060)
      • msiexec.exe (PID: 2036)
      • WinRAR.exe (PID: 4064)
      • msiexec.exe (PID: 1852)

    • Reads the computer name

      • msiexec.exe (PID: 692)
      • msiexec.exe (PID: 2024)
      • msiexec.exe (PID: 2204)
      • msiexec.exe (PID: 2284)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 692)
      • msiexec.exe (PID: 2204)
      • msiexec.exe (PID: 2024)
      • msiexec.exe (PID: 2284)

    • Create files in a temporary directory

      • msiexec.exe (PID: 2036)
      • msiexec.exe (PID: 1852)
      • msiexec.exe (PID: 1060)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 4064)

    • Application launched itself

      • msiexec.exe (PID: 2024)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 4064)
      • msiexec.exe (PID: 2024)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: password.jpg
ZipUncompressedSize: 976722
ZipCompressedSize: 3255
ZipCRC: 0xe45c29f2
ZipModifyDate: 2024:05:01 17:31:36
ZipCompression: Deflated
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
9
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs winrar.exe msiexec.exe no specs msiexec.exe msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3976"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\x64__x32__installer (1).zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
4064"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\x64__x32___setup.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2036"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\Desktop\setup.msi" C:\Windows\System32\msiexec.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
1603
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2024C:\Windows\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2204C:\Windows\system32\MsiExec.exe -Embedding C903C2DCB6A5C07DBBFCF522A771515FC:\Windows\System32\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1060"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\Desktop\setup.msi" C:\Windows\System32\msiexec.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
1603
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
692C:\Windows\system32\MsiExec.exe -Embedding 0ED417DF292476380E1B868E15B18ED9C:\Windows\System32\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1852"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\Desktop\setup.msi" C:\Windows\System32\msiexec.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
1603
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2284C:\Windows\system32\MsiExec.exe -Embedding 4124712E560053911249DCD7CF178105C:\Windows\System32\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
14 377
Read events
14 321
Write events
44
Delete events
12

Modification events

(PID) Process:(3976) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3976) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3976) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3976) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3976) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3976) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(3976) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\x64__x32__installer (1).zip
(PID) Process:(3976) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3976) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3976) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
18
Suspicious files
1
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
4064WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb4064.37304\setup.msi —
MD5:—
SHA256:—
2024msiexec.exeC:\Windows\Installer\10d1aa.msi —
MD5:—
SHA256:—
2024msiexec.exeC:\Windows\Installer\10d1ab.msi —
MD5:—
SHA256:—
2024msiexec.exeC:\Windows\Installer\10d1ac.msi —
MD5:—
SHA256:—
4064WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb4064.37304\iasnap\iasnap.dllexecutable
MD5:9159148D50715F59A725A977967898B7
SHA256:7C1DFB2B669A3346DB1C72AA240AA0C8C11AE874F295957A4AE5225AEA5CE338
4064WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb4064.37304\winmde\daxexec.dllexecutable
MD5:AA304599017322A35B85A25C05B2181C
SHA256:DB2FE02682D410DE2E4FA6E9435B9DC14B3739922FE1E6796E8B94942F711944
4064WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb4064.37304\iasnap\mprddm.dllexecutable
MD5:AA6C7B6257F5C9175979A36A29B66BE7
SHA256:6B7AAB5FC92181204E2FA92058C3D1A321377827580164C47973930F3D8335AC
4064WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb4064.37304\cdosys\cdosys.dllexecutable
MD5:4B32087670A6EC10C30F19B44B55FD81
SHA256:5BBDD7DFD38A030620F8FF5EA02AE4F045D733D9AF39655E168E18F48BC5FAFF
4064WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb4064.37304\winmde\mi.dllexecutable
MD5:0987DB6E1D0563E9A91E8C8FBF266482
SHA256:5271E8C2759227B34A2E28C5172798B1D79E86F6EEB325979141D903B8F1F7AB
4064WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb4064.37304\winmde\MMDevAPI.dllexecutable
MD5:8123FCED22F5424445BAA833E790ABE8
SHA256:0A5E682042A3DAD4BF67AB9A0E3542683A12B75C727EC4972820CF15E5CF59C2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
x64__x32__installer (1).zip