File name:

Email-Worm.Win32.Batzback.a.zip

Full analysis: https://app.any.run/tasks/d44befaa-2778-4589-baf9-d70a6988d4c7
Verdict: Malicious activity
Analysis date: September 09, 2018, 18:13:12
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

F0048F1FBA8FAAC5A367A15DC4846587

SHA1:

7DA8C453762E9515A01D89B21F6BC2BA63DA8124

SHA256:

5FF66149B9C8DA72DFAE770FA5FC1A1E2ECA82EAF0F9C5813DE601A26F80EA33

SSDEEP:

768:2O+p813RV0Ebq19QI+sit+hHHH/q9SdiKoshYj/:b+p83H7bi9QI+sTdHf4SBosKj/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Email-Worm.Win32.Batzback.a.exe (PID: 3424)
      • Email-Worm.Win32.Batzback.a.exe (PID: 4016)
      • BatzBack.scr (PID: 3296)
      • Email-Worm.Win32.Batzback.a.exe (PID: 2792)
      • BatzBack.scr (PID: 452)
      • BatzBack.scr (PID: 3684)

    • Changes the autorun value in the registry

      • Email-Worm.Win32.Batzback.a.exe (PID: 4016)
      • BatzBack.scr (PID: 3684)
      • BatzBack.scr (PID: 3296)
      • Email-Worm.Win32.Batzback.a.exe (PID: 3424)
      • Email-Worm.Win32.Batzback.a.exe (PID: 2792)
      • BatzBack.scr (PID: 452)

  • SUSPICIOUS

    • Creates files in the Windows directory

      • Email-Worm.Win32.Batzback.a.exe (PID: 3424)

    • Starts CMD.EXE for commands execution

      • Email-Worm.Win32.Batzback.a.exe (PID: 3424)
      • Email-Worm.Win32.Batzback.a.exe (PID: 2792)

    • Executable content was dropped or overwritten

      • Email-Worm.Win32.Batzback.a.exe (PID: 3424)
      • WinRAR.exe (PID: 3912)
      • Email-Worm.Win32.Batzback.a.exe (PID: 2792)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2013:08:01 21:03:04
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: Email-Worm.Win32.Batzback.a/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
70
Monitored processes
15
Malicious processes
2
Suspicious processes
4

Behavior graph

Click at the process to see the details
start winrar.exe email-worm.win32.batzback.a.exe email-worm.win32.batzback.a.exe cmd.exe no specs cmd.exe no specs batzback.scr batzback.scr googleupdate.exe no specs cmd.exe no specs cmd.exe batzback.scr notepad.exe no specs email-worm.win32.batzback.a.exe cmd.exe no specs cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
272"C:\Program Files\Google\Update\GoogleUpdate.exe" /ua /installsource schedulerC:\Program Files\Google\Update\GoogleUpdate.exe—taskeng.exe
User:
SYSTEM
Company:
Google Inc.
Integrity Level:
SYSTEM
Description:
Google Installer
Exit code:
0
Version:
1.3.33.17
Modules
Images
c:\program files\google\update\googleupdate.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
452"C:\Windows\BatzBack.scr" /SC:\Windows\BatzBack.scr
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
2147483651
Modules
Images
c:\windows\batzback.scr
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
820"C:\Windows\System32\cmd.exe" /C "C:\Windows\BatzBack.Bat" C:\Windows\System32\cmd.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
255
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1396"C:\Windows\System32\NOTEPAD.EXE" C:\Windows\BatzBack.BatC:\Windows\System32\NOTEPAD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\notepad.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2692cmd /c ""C:\Windows\BatzBack.Bat" "C:\Windows\system32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
255
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2792"C:\Users\admin\Desktop\Email-Worm.Win32.Batzback.a.exe" C:\Users\admin\Desktop\Email-Worm.Win32.Batzback.a.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\email-worm.win32.batzback.a.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
3036cmd /c ""C:\Windows\BatzBack.Bat" "C:\Windows\system32\cmd.exe—Email-Worm.Win32.Batzback.a.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
255
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3232cmd /c ""C:\Windows\BatzBack.Bat" "C:\Windows\system32\cmd.exe—Email-Worm.Win32.Batzback.a.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
255
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3296"C:\Windows\BatzBack.scr" /SC:\Windows\BatzBack.scr
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
2147483651
Modules
Images
c:\windows\batzback.scr
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
3424"C:\Users\admin\Desktop\Email-Worm.Win32.Batzback.a.exe" C:\Users\admin\Desktop\Email-Worm.Win32.Batzback.a.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\email-worm.win32.batzback.a.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
Total events
517
Read events
476
Write events
41
Delete events
0

Modification events

(PID) Process:(3912) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3912) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3912) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3912) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Email-Worm.Win32.Batzback.a.zip
(PID) Process:(3912) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3912) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3912) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3912) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3912) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(3912) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
Executable files
5
Suspicious files
0
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
3424Email-Worm.Win32.Batzback.a.exeC:\Windows\BatzBack.Battext
MD5:A966D64144078F8951DD2B931C09B20A
SHA256:F3283214B1E83832CE83687DA9165AD9F05C9A304F4B5E1B3E81FA7ED6D97A6A
2792Email-Worm.Win32.Batzback.a.exeC:\Windows\BatzBack.Battext
MD5:A966D64144078F8951DD2B931C09B20A
SHA256:F3283214B1E83832CE83687DA9165AD9F05C9A304F4B5E1B3E81FA7ED6D97A6A
2792Email-Worm.Win32.Batzback.a.exeC:\Windows\script.initext
MD5:88851E33134BA261192A7CFA43D29B2D
SHA256:0B10464AEA6720ED9B6263FBF950FA6D55C50257B26690FE03A142FAC2291400
3912WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3912.49433\Email-Worm.Win32.Batzback.a\Email-Worm.Win32.Batzback.aexecutable
MD5:1AD398260F65F5121E65D3C66E520903
SHA256:E669931C039815510947AB19A578AAEF8DE1F76D763DE6306B2A0DED22AB3AB8
2792Email-Worm.Win32.Batzback.a.exeC:\Windows\BatzBack.screxecutable
MD5:1AD398260F65F5121E65D3C66E520903
SHA256:E669931C039815510947AB19A578AAEF8DE1F76D763DE6306B2A0DED22AB3AB8
3424Email-Worm.Win32.Batzback.a.exeC:\Windows\system32\BatzBack.screxecutable
MD5:1AD398260F65F5121E65D3C66E520903
SHA256:E669931C039815510947AB19A578AAEF8DE1F76D763DE6306B2A0DED22AB3AB8
3424Email-Worm.Win32.Batzback.a.exeC:\Windows\BatzBack.screxecutable
MD5:1AD398260F65F5121E65D3C66E520903
SHA256:E669931C039815510947AB19A578AAEF8DE1F76D763DE6306B2A0DED22AB3AB8
3424Email-Worm.Win32.Batzback.a.exeC:\Windows\script.initext
MD5:88851E33134BA261192A7CFA43D29B2D
SHA256:0B10464AEA6720ED9B6263FBF950FA6D55C50257B26690FE03A142FAC2291400
2792Email-Worm.Win32.Batzback.a.exeC:\Windows\system32\BatzBack.screxecutable
MD5:1AD398260F65F5121E65D3C66E520903
SHA256:E669931C039815510947AB19A578AAEF8DE1F76D763DE6306B2A0DED22AB3AB8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Email-Worm.Win32.Batzback.a.zip