analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

CV.zip

Full analysis: https://app.any.run/tasks/e638b895-f1ca-489c-ae02-a481bb19bc77
Verdict: Malicious activity
Analysis date: June 19, 2019, 08:33:26
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

6A34DB2A3ADECEA4F6BE3C684DDD76CA

SHA1:

6D9F00AF4305E5456B030364B2781B5EEEDC0D05

SHA256:

58C15C193099FB4E43FF25D5463E52C46951716F013AD80EB94F5FEE6D971140

SSDEEP:

12288:uXYEjP5xpBF42cRL3/4zcE1crx3SBYSCpJycBbqAvIebu8XAf6qcaO3m0svFei:uoWxpr+RIcE1cl3m+poI6bcd3m0sR

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executed via COM

      • DllHost.exe (PID: 2480)
      • DllHost.exe (PID: 920)

    • Starts Microsoft Office Application

      • rundll32.exe (PID: 3528)
      • rundll32.exe (PID: 3912)

    • Uses RUNDLL32.EXE to load library

      • WinRAR.exe (PID: 620)

    • Starts Internet Explorer

      • rundll32.exe (PID: 3448)

  • INFO

    • Modifies the open verb of a shell class

      • rundll32.exe (PID: 3540)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2320)
      • iexplore.exe (PID: 408)

    • Changes internet zones settings

      • iexplore.exe (PID: 2492)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2320)
      • WINWORD.EXE (PID: 2544)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2492)

    • Reads internet explorer settings

      • iexplore.exe (PID: 408)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 408)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 408)
      • iexplore.exe (PID: 2492)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2492)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.pages | Pages document (83)
.zan | BlueEyes Animation (13)
.zip | ZIP compressed archive (3.8)

EXIF

ZIP

ZipFileName: Data/PresetImageFill3-13.jpg
ZipUncompressedSize: 103463
ZipCompressedSize: 103463
ZipCRC: 0x7cbd0982
ZipModifyDate: 2019:04:05 11:02:08
ZipCompression: None
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
48
Monitored processes
14
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start rundll32.exe no specs winrar.exe no specs PhotoViewer.dll no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs PhotoViewer.dll no specs rundll32.exe no specs winword.exe no specs rundll32.exe no specs winword.exe no specs rundll32.exe no specs iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
3540"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\CV.zip.pagesC:\Windows\system32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
620"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\CV.zip.pages"C:\Program Files\WinRAR\WinRAR.exe—rundll32.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
2480C:\Windows\system32\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}C:\Windows\system32\DllHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
900"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\Rar$DIa620.30155\Metadata.iwaC:\Windows\system32\rundll32.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
4076"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\Rar$DIa620.31397\DocumentIdentifierC:\Windows\system32\rundll32.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2132"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\Rar$DIa620.31857\BuildVersionHistory.plistC:\Windows\system32\rundll32.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
920C:\Windows\system32\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}C:\Windows\system32\DllHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3528"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\CV\Index\Document.iwaC:\Windows\system32\rundll32.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2320"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\CV\Index\Document.iwa"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
3912"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\Rar$DIa620.48279\BuildVersionHistory.plistC:\Windows\system32\rundll32.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
3 931
Read events
3 473
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
39
Text files
44
Unknown types
13

Dropped files

PID
Process
Filename
Type
620WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa620.30155\Metadata.iwabinary
MD5:FE4186B85227F69348869859B3148CBD
SHA256:38CFB444AD220DC629E0646B08C93F858D1FE1A5306370236D29E221B6E316F7
620WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa620.31857\BuildVersionHistory.plistxml
MD5:BDC9DDEF9656930FF5E5694AADD47D8C
SHA256:3973DC7D80AE5BE4F46B648914D7E775B5924E84EF6DBEEA8A656BE3633E3421
620WinRAR.exeC:\Users\admin\AppData\Local\Temp\CV\Data\PresetImageFill3-13.jpgimage
MD5:D268E878320475EDB2D32C3739CEB66F
SHA256:758261189A7F9244D3D3916432A936952E973F95310E77F778423390EB12EFA6
620WinRAR.exeC:\Users\admin\AppData\Local\Temp\CV\Data\PresetImageFill4-14.jpgimage
MD5:87A75F47B7D08081D33E65BCEB7D58FF
SHA256:B33E6EAA796E51635B08E696F15AEB28D2C860DE98CB79A20ECB39729BA4F1FB
620WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa620.31397\DocumentIdentifiertext
MD5:1E8E949E9AA29E3C0692861971045278
SHA256:3308C8F867DEC434BCE80D5F9CC53861C95D5BA1820B93625D822B8698B45CE4
620WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa620.33188\PresetImageFill5-15.jpgimage
MD5:BB3F785D2B1F07115E7BB58E2682336C
SHA256:3F0016F1F04072939B121BD9B95387D3AD96EE8BDE0DC22AC1FD662AD7A22E9E
620WinRAR.exeC:\Users\admin\AppData\Local\Temp\CV\Index\CalculationEngine.iwabinary
MD5:110A962C87A3F43D4BBA020D9E519F3F
SHA256:748875B90DD7228B0A869A07A9230DA03F8DC26F92B95D9DADAE8B1A4B70948A
620WinRAR.exeC:\Users\admin\AppData\Local\Temp\CV\Data\PresetImageFill0-10.jpgimage
MD5:F5FC4EF76C7B01F0754BC7C41A7A5157
SHA256:AEA5CEF4072D497520B5A2411E72A326B38F7F1AC8FEFFAA6CC0DECB57915FB8
620WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa620.28555\PresetImageFill1-11.jpgimage
MD5:E7C089092C1415595EE62CD29AF93A7B
SHA256:5338BA6C29B4A06CED68552D2C606017228FEFC14F5DB9B8FBF3717D21E16480
620WinRAR.exeC:\Users\admin\AppData\Local\Temp\CV.zipcompressed
MD5:6A34DB2A3ADECEA4F6BE3C684DDD76CA
SHA256:58C15C193099FB4E43FF25D5463E52C46951716F013AD80EB94F5FEE6D971140
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
11
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
408
iexplore.exe
GET
301
2.16.186.27:80
http://shell.windows.com/fileassoc/fileassoc.asp?Ext=iwa
unknown
—
—
whitelisted
408
iexplore.exe
GET
302
2.19.38.59:80
http://go.microsoft.com/fwlink/?LinkId=57426&Ext=iwa
unknown
—
—
whitelisted
2492
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
408
iexplore.exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
2492
iexplore.exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
2492
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
408
iexplore.exe
40.90.23.209:443
login.live.com
Microsoft Corporation
US
unknown
408
iexplore.exe
2.19.38.59:80
go.microsoft.com
Akamai International B.V.
—
whitelisted
408
iexplore.exe
2.16.186.27:80
shell.windows.com
Akamai International B.V.
—
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
go.microsoft.com
  • 2.19.38.59
whitelisted
shell.windows.com
  • 2.16.186.27
  • 2.16.186.24
whitelisted
login.live.com
  • 40.90.23.209
  • 40.90.23.234
  • 40.90.23.232
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
CV.zip