analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

AIO Combo Tools.zip

Full analysis: https://app.any.run/tasks/37bd5f95-68f9-4559-ac26-18a4d1232d02
Verdict: Malicious activity
Analysis date: February 10, 2019, 19:31:04
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

FFA249938BE50B64D01CF0C6B8D0BA22

SHA1:

4AF1DD48DF0592D942806039D51A14FFBB91947F

SHA256:

54EC3572AD0AB92F0B4E8528589C15442F61EB2B27D64835B3C291229C78490D

SSDEEP:

196608:eSoEjXYF6K6Swvfop06hZaeiXpOKzBfBr6lJM6dlLIBlfngzoB1:eSbHjSwoW6CeiZHR6X97Smo1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 3076)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3284)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: AIO Combo Tools/
ZipUncompressedSize: -
ZipCompressedSize: -
ZipCRC: 0x00000000
ZipModifyDate: 2019:01:08 07:48:01
ZipCompression: None
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
33
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe searchprotocolhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3284"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\AIO Combo Tools.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3076"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe7_ Global\UsGthrCtrlFltPipeMssGthrPipe7 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\system32\SearchProtocolHost.exeSearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
Total events
812
Read events
797
Write events
15
Delete events
0

Modification events

(PID) Process:(3284) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3284) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3284) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3284) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\AIO Combo Tools.zip
(PID) Process:(3284) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3284) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3284) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3284) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3284) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3284) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
5
Suspicious files
0
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
3284WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3284.13642\AIO Combo Tools\AIO Combo Tools.exe
MD5:
SHA256:
3284WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3284.10781\AIO Combo Tools\Output\Combo_AZ.txttext
MD5:FBCBAE07B625C7719519102230C7F23E
SHA256:4DD003D4AEC6FF95403194F345375566C616F4C8DC9A6D172DA1E6EFFE46FE1A
3284WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3284.13642\AIO Combo Tools\Leaf.xNet.dllexecutable
MD5:AD825CA35732E4433B7D210962C8EB4F
SHA256:80058B633359F732427EDBD3C0DDE418BF6190FC87A5809F0DA181D0E750F44C
3284WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3284.10781\AIO Combo Tools\combo.txttext
MD5:A62EBD03334AABDAE0300630E2CCA6E1
SHA256:E2C599BFE65316A52B9FA3771A4D66A8039563260A0E61BD445B0ED3BF4F208C
3284WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3284.13642\AIO Combo Tools\combo.txttext
MD5:A62EBD03334AABDAE0300630E2CCA6E1
SHA256:E2C599BFE65316A52B9FA3771A4D66A8039563260A0E61BD445B0ED3BF4F208C
3284WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3284.10781\AIO Combo Tools\Leaf.xNet.dllexecutable
MD5:AD825CA35732E4433B7D210962C8EB4F
SHA256:80058B633359F732427EDBD3C0DDE418BF6190FC87A5809F0DA181D0E750F44C
3284WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3284.13642\AIO Combo Tools\Output\Combo_AZ.txttext
MD5:FBCBAE07B625C7719519102230C7F23E
SHA256:4DD003D4AEC6FF95403194F345375566C616F4C8DC9A6D172DA1E6EFFE46FE1A
3284WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3284.10781\AIO Combo Tools\AIO Combo Tools.exeexecutable
MD5:3942F469D853E7FC7D79EFA47E36A4BC
SHA256:7004B7007E6332DE4EFAA1592A633E98307B22A35981D8BEE949153A79A4208A
3284WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3284.10781\AIO Combo Tools\Colorful.Console.dllexecutable
MD5:5F3D2CFBC21591B8FEEF1EFA3E59A4D0
SHA256:F31D4FD7E729FC6CF4ECAB972B6B1EE897918A325B1CA572030966F831E768FB
3284WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3284.13642\AIO Combo Tools\Colorful.Console.dllexecutable
MD5:5F3D2CFBC21591B8FEEF1EFA3E59A4D0
SHA256:F31D4FD7E729FC6CF4ECAB972B6B1EE897918A325B1CA572030966F831E768FB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info