analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Release_v1.7.7z

Full analysis: https://app.any.run/tasks/4ba846fa-3d68-4f45-8ece-b343b554bb07
Verdict: Malicious activity
Analysis date: April 25, 2019, 08:44:13
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

1BEAC1ECD44F257480C4B2E02D201668

SHA1:

03EF565290A22558E1B769CAF3F9AF0B4D0493E0

SHA256:

5F15624307033D952CEF4E6D08124FDCFC2C0E6DA5C7A8215F74FE0355432523

SSDEEP:

98304:s6CJ+mO+xiDhlU5SYSDQ+nW555rkpc43WqWBtm8u7RFr7tVy65rQVIb:sQD+xuLOXSDhW5nrorWnqnvTrkU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 1980)
      • OleViewDotNet32.exe (PID: 2636)
      • explorer.exe (PID: 252)
      • OleViewDotNet.exe (PID: 1828)
      • OleViewDotNet.exe (PID: 2772)

    • Application was dropped or rewritten from another process

      • OleViewDotNet32.exe (PID: 2636)
      • OleViewDotNet.exe (PID: 1828)
      • OleViewDotNet.exe (PID: 2772)

    • Loads the Task Scheduler DLL interface

      • explorer.exe (PID: 252)

    • Loads the Task Scheduler COM API

      • explorer.exe (PID: 252)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3088)

    • Application launched itself

      • OleViewDotNet.exe (PID: 1828)

    • Reads default file associations for system extensions

      • explorer.exe (PID: 252)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • WinRAR.exe (PID: 3088)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
7
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe searchprotocolhost.exe no specs oleviewdotnet32.exe no specs oleviewdotnet.exe no specs explorer.exe no specs taskmgr.exe no specs oleviewdotnet.exe

Process information

PID
CMD
Path
Indicators
Parent process
3088"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Release_v1.7.7z"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
1980"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe5_ Global\UsGthrCtrlFltPipeMssGthrPipe5 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
2636"C:\Users\admin\Desktop\OleViewDotNet32.exe" C:\Users\admin\Desktop\OleViewDotNet32.exe—explorer.exe
User:
admin
Company:
.
Integrity Level:
MEDIUM
Description:
OleViewDotNet
Version:
1.0.0.0
1828"C:\Users\admin\Desktop\OleViewDotNet.exe" C:\Users\admin\Desktop\OleViewDotNet.exe—explorer.exe
User:
admin
Company:
.
Integrity Level:
MEDIUM
Description:
OleViewDotNet
Version:
1.0.0.0
252C:\Windows\Explorer.EXEC:\Windows\explorer.exe——
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2936"C:\Windows\system32\taskmgr.exe" /4C:\Windows\system32\taskmgr.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Task Manager
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2772"C:\Users\admin\Desktop\OleViewDotNet.exe" C:\Users\admin\Desktop\OleViewDotNet.exe
OleViewDotNet.exe
User:
admin
Company:
.
Integrity Level:
HIGH
Description:
OleViewDotNet
Version:
1.0.0.0
Total events
299 070
Read events
298 775
Write events
0
Delete events
0

Modification events

No data
Executable files
14
Suspicious files
2
Text files
539
Unknown types
0

Dropped files

PID
Process
Filename
Type
3088WinRAR.exeC:\Users\admin\Desktop\OleViewDotNet_Formatters.ps1xmlxml
MD5:2D6098CB0D06DA10345D4B2DD7D9B979
SHA256:2E1A0B216F4B96064AB92AD0C50A019D90FE7E15C7726E912978D8DB46727B41
3088WinRAR.exeC:\Users\admin\Desktop\OleViewDotNet.psm1text
MD5:75B46EBDD14AC51EB3A82681AAF28C0F
SHA256:34FC860F3AC0EFC4BE18201E6809B29F88058FCB898BACA156137A811363AA1C
3088WinRAR.exeC:\Users\admin\Desktop\PythonLib\argparse.pytext
MD5:97C680C642F9728036F71214CFD1A2C9
SHA256:E1CCE90AD15822E467EB34A676776A57B17441948AF88FF94AD8C97CDD7F162B
3088WinRAR.exeC:\Users\admin\Desktop\OleViewDotNet.psd1text
MD5:62C9115B0F6030D26272EB301EF6798F
SHA256:A7CDA7856A046C041501C24BEEB6F937489DE9BC666ECE9630F3CC1B1F766875
3088WinRAR.exeC:\Users\admin\Desktop\OleViewDotNet.Main.dll.configxml
MD5:3BEF04B550C85FC65DFC830282FAF984
SHA256:BAEF95A23DFE732B98B6DF31C1363C29EF0CBD89CE9E00C256F43704C2E928BE
3088WinRAR.exeC:\Users\admin\Desktop\PythonLib\bisect.pytext
MD5:0F26766EB11430C3AC399053DBD3CF28
SHA256:28CE6F21F3F251B4A7FC72C70385ECDF4D71F1B239E5673EE28D32D69679F62A
3088WinRAR.exeC:\Users\admin\Desktop\PythonLib\antigravity.pytext
MD5:723360C0A5F881C8C8EF11B616D9002D
SHA256:4E704EB1D98996E474B149980A26D2E87534B4259E760AE26C7609DB0E27119A
3088WinRAR.exeC:\Users\admin\Desktop\PythonLib\bdb.pytext
MD5:345F7CC2397CD6C8D971868EF5ED489A
SHA256:7C16F656F65420A8CD3E277DAD5C2115C34A500BEF6519696B52AE7197970146
3088WinRAR.exeC:\Users\admin\Desktop\PythonLib\anydbm.pytext
MD5:D9191DDF8A526AFD955554A0AA7C8CE4
SHA256:B0D08B2261404D5BE7520C65261B3DA6752405EAF0E9E7DA864AC21985F0BC13
3088WinRAR.exeC:\Users\admin\Desktop\PythonLib\ast.pytext
MD5:79F7408883C8A6D2D86A4914F6D9ECE5
SHA256:86EA557E6A66B4448050FA3E17DB018E049D1D25102A8550365FDAA9B2A67AE9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Release_v1.7.7z