analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
download:

MEMZ.zip

Full analysis: https://app.any.run/tasks/d82e0762-1c20-45b1-8b49-fa14effcda16
Verdict: Malicious activity
Analysis date: October 14, 2019, 16:41:39
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

69977A5D1C648976D47B69EA3AA8FCAA

SHA1:

4630CC15000C0D3149350B9ECDA6CFC8F402938A

SHA256:

61CA4D8DD992C763B47BEBB9B5FACB68A59FF0A594C2FF215AA4143B593AE9DC

SSDEEP:

192:8xI2dw4xXlsUjs1ScK3ZeD6dUqENj710+MZ9R1SVBIpp:b2dHiosKA6OqEx2t9R1SLIL

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0001
ZipCompression: Deflated
ZipModifyDate: 2016:12:03 13:51:10
ZipCRC: 0xd987e890
ZipCompressedSize: 8489
ZipUncompressedSize: 14848
ZipFileName: [email protected]
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
74
Monitored processes
27
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs [email protected] [email protected] no specs [email protected] [email protected] no specs [email protected] [email protected] no specs [email protected] no specs [email protected] no specs [email protected] no specs [email protected] no specs [email protected] notepad.exe no specs iexplore.exe iexplore.exe iexplore.exe iexplore.exe iexplore.exe iexplore.exe wordpad.exe no specs taskmgr.exe no specs iexplore.exe mmc.exe no specs msconfig.exe no specs iexplore.exe no specs iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2508"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\MEMZ.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
3908"C:\Users\admin\Desktop\[email protected]" C:\Users\admin\Desktop\[email protected]
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
2004"C:\Users\admin\Desktop\[email protected]" C:\Users\admin\Desktop\[email protected]—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
2456"C:\Users\admin\Desktop\[email protected]" C:\Users\admin\Desktop\[email protected]
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
2156"C:\Users\admin\Desktop\[email protected]" C:\Users\admin\Desktop\[email protected]—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
3228"C:\Users\admin\Desktop\[email protected]" C:\Users\admin\Desktop\[email protected]
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
1484"C:\Users\admin\Desktop\[email protected]" /watchdogC:\Users\admin\Desktop\[email protected]—[email protected]
User:
admin
Integrity Level:
HIGH
4032"C:\Users\admin\Desktop\[email protected]" /watchdogC:\Users\admin\Desktop\[email protected]—[email protected]
User:
admin
Integrity Level:
HIGH
2500"C:\Users\admin\Desktop\[email protected]" /watchdogC:\Users\admin\Desktop\[email protected]—[email protected]
User:
admin
Integrity Level:
HIGH
3836"C:\Users\admin\Desktop\[email protected]" /watchdogC:\Users\admin\Desktop\[email protected]—[email protected]
User:
admin
Integrity Level:
HIGH
Total events
2 710
Read events
2 284
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
15
Text files
103
Unknown types
7

Dropped files

PID
Process
Filename
Type
2508WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2508.33234\[email protected] —
MD5:—
SHA256:—
1560iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt —
MD5:—
SHA256:—
2840iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\favicon[1].ico —
MD5:—
SHA256:—
2840iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
1560iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\search[1].txt —
MD5:—
SHA256:—
1560iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\search[1].htmhtml
MD5:454CBBF8B280646B27C56927D195E00E
SHA256:A105C5B7C085747416074FB1215E3D97A990A70EF95714187DE4DB2CBF7EE3E9
1560iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\rs=ACT90oF7WTeH-jXMsNB36un98SDMskq2TA[1]text
MD5:6C54A0CF217C46401359A74B1CA77FCD
SHA256:7B79C5044FD94121C011F37E2E75E8A2EDC1E1FA65149101A07742D0E758BEAC
1560iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txttext
MD5:4F5F777A71E16B2D6A0594F92C5AA4BA
SHA256:15E85F231598E80A3E40FC8EAF0BE14A30E7469E82D8882A4C5B47926AB7DD0E
1560iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\images[1].jpgimage
MD5:A82070B3562B218684F65889B948ACD2
SHA256:B3F6375CCC2AF89ADF533B0E3FD134049B887DB58B1E3ED8A2270F92556FF2F0
1560iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\images[2].jpgimage
MD5:082EF899B4B3EE5786513430886EC9EB
SHA256:07552719DF6D7AED991BD30F267FD8E355F451FF9AAD4F7BC71C199341989B69
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
18
TCP/UDP connections
80
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1560
iexplore.exe
GET
301
216.58.207.36:80
http://google.co.ck/search?q=is+illuminati+real
US
html
248 b
whitelisted
3940
iexplore.exe
GET
302
172.217.22.67:80
http://www.google.co.ck/search?q=g3t+r3kt
US
html
254 b
whitelisted
3128
iexplore.exe
GET
301
216.58.207.36:80
http://google.co.ck/search?q=virus+builder+legit+free+download
US
html
263 b
whitelisted
2840
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
3940
iexplore.exe
GET
301
216.58.207.36:80
http://google.co.ck/search?q=g3t+r3kt
US
html
238 b
whitelisted
3680
iexplore.exe
GET
302
172.217.22.67:80
http://www.google.co.ck/search?q=g3t+r3kt
US
html
254 b
whitelisted
2124
iexplore.exe
GET
301
216.58.207.36:80
http://google.co.ck/search?q=virus.exe
US
html
239 b
whitelisted
2124
iexplore.exe
GET
302
172.217.22.67:80
http://www.google.co.ck/search?q=virus.exe
US
html
255 b
whitelisted
2244
iexplore.exe
GET
302
172.217.22.67:80
http://www.google.co.ck/search?q=how+to+create+your+own+ransomware
US
html
279 b
whitelisted
3680
iexplore.exe
GET
301
216.58.207.36:80
http://google.co.ck/search?q=g3t+r3kt
US
html
238 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1560
iexplore.exe
172.217.22.67:80
www.google.co.ck
Google Inc.
US
whitelisted
1560
iexplore.exe
172.217.22.110:443
encrypted-tbn1.gstatic.com
Google Inc.
US
whitelisted
1560
iexplore.exe
172.217.22.67:443
www.google.co.ck
Google Inc.
US
whitelisted
2840
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
1560
iexplore.exe
216.58.207.36:80
google.co.ck
Google Inc.
US
whitelisted
3940
iexplore.exe
216.58.207.36:80
google.co.ck
Google Inc.
US
whitelisted
3940
iexplore.exe
172.217.22.67:443
www.google.co.ck
Google Inc.
US
whitelisted
3940
iexplore.exe
172.217.22.67:80
www.google.co.ck
Google Inc.
US
whitelisted
1560
iexplore.exe
172.217.22.14:443
encrypted-tbn0.gstatic.com
Google Inc.
US
whitelisted
1560
iexplore.exe
216.58.205.238:443
encrypted-tbn3.gstatic.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
google.co.ck
  • 216.58.207.36
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
www.google.co.ck
  • 172.217.22.67
whitelisted
encrypted-tbn3.gstatic.com
  • 216.58.205.238
whitelisted
encrypted-tbn1.gstatic.com
  • 172.217.22.110
whitelisted
encrypted-tbn0.gstatic.com
  • 172.217.22.14
whitelisted
encrypted-tbn2.gstatic.com
  • 172.217.23.142
whitelisted
www.youtube.com
  • 172.217.22.46
  • 172.217.22.78
  • 216.58.210.14
  • 172.217.18.110
  • 172.217.23.174
  • 172.217.21.206
  • 216.58.205.238
  • 172.217.21.238
  • 172.217.22.14
  • 172.217.18.14
  • 172.217.18.174
  • 172.217.23.142
  • 216.58.206.14
  • 172.217.23.110
  • 216.58.207.46
  • 216.58.207.78
whitelisted
s.ytimg.com
  • 216.58.205.238
whitelisted
fonts.gstatic.com
  • 172.217.22.35
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
MEMZ.zip