analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

FW_ относительно заказа123.7z

Full analysis: https://app.any.run/tasks/5c9d737d-0551-4e9f-b347-2560b0c0d193
Verdict: Malicious activity
Analysis date: May 24, 2019, 07:10:48
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
opendir
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

6C1CF451312624F958F06A20C3C3469A

SHA1:

D032F9965B6E1043BAEDF8160894A12A4A461189

SHA256:

620B33C93453CEFAA94BE745D45334C29BEE8CD727FB60347EAA11B32FCC0201

SSDEEP:

48:TJn6Ic0YuGvMSPyZxeplf29A4HkWuKfrPC+RYBx4TPiNYC6CAstZGyQgJR:56paS/plf29tHB7rsNxCstZGAJR

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    No malicious indicators.
  • SUSPICIOUS

    • Creates files in the user directory

      • OUTLOOK.EXE (PID: 2888)
    • Reads Internet Cache Settings

      • OUTLOOK.EXE (PID: 2888)
    • Starts Internet Explorer

      • OUTLOOK.EXE (PID: 2888)
    • Executable content was dropped or overwritten

      • msdt.exe (PID: 1696)
    • Uses IPCONFIG.EXE to discover IP address

      • sdiagnhost.exe (PID: 3124)
    • Executed via COM

      • sdiagnhost.exe (PID: 3124)
    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 1256)
  • INFO

    • Application launched itself

      • iexplore.exe (PID: 636)
      • iexplore.exe (PID: 3104)
      • iexplore.exe (PID: 2440)
      • iexplore.exe (PID: 3116)
      • chrome.exe (PID: 1256)
      • iexplore.exe (PID: 1652)
    • Manual execution by user

      • OUTLOOK.EXE (PID: 2888)
      • rundll32.exe (PID: 304)
      • chrome.exe (PID: 1256)
    • Creates files in the user directory

      • iexplore.exe (PID: 3064)
      • iexplore.exe (PID: 3104)
    • Changes internet zones settings

      • iexplore.exe (PID: 636)
      • iexplore.exe (PID: 2440)
      • iexplore.exe (PID: 3104)
      • iexplore.exe (PID: 3116)
      • iexplore.exe (PID: 1652)
    • Reads internet explorer settings

      • iexplore.exe (PID: 3064)
      • iexplore.exe (PID: 2580)
      • iexplore.exe (PID: 3820)
      • iexplore.exe (PID: 556)
      • iexplore.exe (PID: 1900)
    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3064)
      • iexplore.exe (PID: 2580)
      • iexplore.exe (PID: 3820)
      • iexplore.exe (PID: 556)
      • iexplore.exe (PID: 1900)
    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 2888)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
83
Monitored processes
43
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs outlook.exe iexplore.exe iexplore.exe msdt.exe sdiagnhost.exe no specs ipconfig.exe no specs route.exe no specs makecab.exe no specs control.exe no specs rundll32.exe no specs iexplore.exe iexplore.exe iexplore.exe iexplore.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs iexplore.exe iexplore.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
4024"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\FW_ относительно заказа123.7z"C:\Program Files\WinRAR\WinRAR.exeexplorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
2888"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE" /eml "C:\Users\admin\Desktop\FW_ относительно заказа.eml"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Exit code:
0
Version:
14.0.6025.1000
636"C:\Program Files\Internet Explorer\iexplore.exe" http://fruityytech.com/wp-includes/ID3/ural_940145.phpC:\Program Files\Internet Explorer\iexplore.exe
OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3064"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:636 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
1696 -modal 131752 -skip TRUE -path C:\Windows\diagnostics\system\networking -af C:\Users\admin\AppData\Local\Temp\NDFC595.tmp -ep NetworkDiagnosticsWebC:\Windows\system32\msdt.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Diagnostics Troubleshooting Wizard
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3124C:\Windows\System32\sdiagnhost.exe -EmbeddingC:\Windows\System32\sdiagnhost.exesvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Scripted Diagnostics Native Host
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2592"C:\Windows\system32\ipconfig.exe" /allC:\Windows\system32\ipconfig.exesdiagnhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
IP Configuration Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3828"C:\Windows\system32\ROUTE.EXE" printC:\Windows\system32\ROUTE.EXEsdiagnhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Route Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2716"C:\Windows\system32\makecab.exe" /f NetworkConfiguration.ddfC:\Windows\system32\makecab.exesdiagnhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Cabinet Maker
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3252"C:\Windows\System32\control.exe" /name Microsoft.Troubleshooting /page "resultPage?keywords=+;NetworkDiagnostics"C:\Windows\System32\control.exemsdt.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Control Panel
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
4 190
Read events
3 420
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
104
Text files
281
Unknown types
27

Dropped files

PID
Process
Filename
Type
2888OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVR7FB3.tmp.cvr
MD5:
SHA256:
2888OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:FE5D6D6BD12BB1EB680354708488C7D5
SHA256:D85C770E498D2D5B8CBE13C5BDC4F20F2CEE06ED7EDE0CA34CAC99C10B0E128F
636iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\favicon[1].ico
MD5:
SHA256:
3064iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.datdat
MD5:CC9EE3F51DC00EDF36A4665B67C06F4F
SHA256:A6823FD1598C880E4A9A1C2CE3C29FBD568BD01A7B22B39E4BB0816F5F1E34F5
636iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
MD5:
SHA256:
4024WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb4024.37958\FW_ относительно заказа.emltext
MD5:E06D562D15E13F511C780AD9D8C149C5
SHA256:B086996AF1A8D1DF23A63177BBAD7CFFEE77A53C265DF04E68DEB70F798C8349
2888OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\{9ECE9E04-4C08-40FB-B090-992725BDEFEF}\{1C306CB1-771E-4B4B-A902-86E897877F5B}.pngimage
MD5:7D80C0A7E3849818695EAF4989186A3C
SHA256:72DC527D78A8E99331409803811CC2D287E812C008A1C869A6AEA69D7A44B597
2888OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_Calendar_2_3256E990FBFB804BA0C103B26738F59C.datxml
MD5:B21ED3BD946332FF6EBC41A87776C6BB
SHA256:B1AAC4E817CD10670B785EF8E5523C4A883F44138E50486987DC73054A46F6F4
2888OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_ContactPrefs_2_2FF596204C2DA240A731C8C139E33A94.datxml
MD5:BBCF400BD7AE536EB03054021D6A6398
SHA256:383020065C1F31F4FB09F448599A6D5E532C390AF4E5B8AF0771FE17A23222AD
3064iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.datdat
MD5:274DB3DDBFA8A791952DFDAD6B674D2C
SHA256:3DAAABC648DCC2A6B89DD916A84E0A1FBB216B95852D78C104D6F902E984692C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
17
TCP/UDP connections
71
DNS requests
30
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3820
iexplore.exe
GET
301
95.216.12.141:80
http://fruityytech.com/wp-includes/ID3/ural_940145.php
DE
suspicious
3064
iexplore.exe
GET
301
95.216.12.141:80
http://fruityytech.com/wp-includes/ID3/ural_940145.php
DE
suspicious
3064
iexplore.exe
GET
301
95.216.12.141:80
http://fruityytech.com/wp-includes/ID3/ural_940145.php
DE
suspicious
2580
iexplore.exe
GET
301
95.216.12.141:80
http://fruityytech.com/wp-includes/ID3/ural_940145.php
DE
suspicious
984
svchost.exe
GET
301
95.216.12.141:80
http://fruityytech.com/
DE
suspicious
1256
chrome.exe
GET
301
95.216.12.141:80
http://fruityytech.com/wp-includes/ID3/ural_940145.php
DE
suspicious
556
iexplore.exe
GET
301
95.216.12.141:80
http://fruityytech.com/wp-includes/ID3/ural_940145.php
DE
suspicious
3820
iexplore.exe
GET
301
95.216.12.141:80
http://fruityytech.com/wp-includes/ID3/ural_940145.php
DE
suspicious
1900
iexplore.exe
GET
301
95.216.12.141:80
http://fruityytech.com/wp-includes/ID3/ural_940145.php
DE
suspicious
2888
OUTLOOK.EXE
GET
64.4.26.155:80
http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig
US
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2888
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
Microsoft Corporation
US
whitelisted
2440
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3064
iexplore.exe
95.216.12.141:80
fruityytech.com
Hetzner Online GmbH
DE
suspicious
636
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
984
svchost.exe
95.216.12.141:443
fruityytech.com
Hetzner Online GmbH
DE
suspicious
3064
iexplore.exe
95.216.12.141:443
fruityytech.com
Hetzner Online GmbH
DE
suspicious
95.216.12.141:443
fruityytech.com
Hetzner Online GmbH
DE
suspicious
2580
iexplore.exe
95.216.12.141:80
fruityytech.com
Hetzner Online GmbH
DE
suspicious
2580
iexplore.exe
95.216.12.141:443
fruityytech.com
Hetzner Online GmbH
DE
suspicious
984
svchost.exe
95.216.12.141:80
fruityytech.com
Hetzner Online GmbH
DE
suspicious

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
fruityytech.com
  • 95.216.12.141
unknown
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
clientservices.googleapis.com
  • 216.58.207.67
whitelisted
www.google.com.ua
  • 216.58.207.35
whitelisted
accounts.google.com
  • 172.217.22.109
shared
clients1.google.com
  • 172.217.16.206
whitelisted
ssl.gstatic.com
  • 216.58.208.35
whitelisted
www.gstatic.com
  • 172.217.21.195
whitelisted
apis.google.com
  • 172.217.16.142
whitelisted

Threats

PID
Process
Class
Message
3064
iexplore.exe
Generic Protocol Command Decode
SURICATA TLS invalid record type
3064
iexplore.exe
Generic Protocol Command Decode
SURICATA TLS invalid record type
3064
iexplore.exe
Generic Protocol Command Decode
SURICATA TLS invalid record type
3064
iexplore.exe
Generic Protocol Command Decode
SURICATA TLS invalid record type
3064
iexplore.exe
Generic Protocol Command Decode
SURICATA TLS invalid record type
3064
iexplore.exe
Generic Protocol Command Decode
SURICATA TLS invalid record type
984
svchost.exe
Generic Protocol Command Decode
SURICATA TLS invalid record type
984
svchost.exe
Generic Protocol Command Decode
SURICATA TLS invalid record type
984
svchost.exe
Generic Protocol Command Decode
SURICATA TLS invalid record type
984
svchost.exe
Generic Protocol Command Decode
SURICATA TLS invalid record type
No debug info