File name:

Email-Worm.zip

Full analysis: https://app.any.run/tasks/32c8e078-b9c8-469f-8820-d5ce3d5eeff6
Verdict: Malicious activity
Analysis date: March 18, 2024, 20:51:49
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v4.5 to extract, compression method=deflate
MD5:

F5A7CF4053708EF7AE4C1E9E5310F197

SHA1:

2DFD07394626D00F433F41C0464A60D97A1ED95F

SHA256:

63278688C6F335CEAD87F9E130766CC2075B9CA8D9DCA375150DDAE2D5884CB3

SSDEEP:

98304:gRSHMzxkBu/aSNeXpO+QiTUPNgMVT0fkCRzYVRLg1BoSoSpRMQd+Z+n1qVTGfaID:XaVgMrajCvY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • Duksten.exe (PID: 2096)
      • Brontok.exe (PID: 680)
      • Gruel.a.exe (PID: 3028)
      • Lacon.exe (PID: 1728)
      • Yarner.a.exe (PID: 3264)
      • smss.exe (PID: 1040)
      • winlogon.exe (PID: 2444)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3500)
      • Duksten.exe (PID: 2096)
      • Brontok.exe (PID: 680)
      • Gruel.a.exe (PID: 3028)
      • Lacon.exe (PID: 1728)
      • Prolin.exe (PID: 2828)
      • Yarner.a.exe (PID: 3264)
      • Winevar.exe (PID: 1172)
      • Maldal.a.exe (PID: 1780)
      • smss.exe (PID: 1040)

    • Creates a writable file in the system directory

      • Duksten.exe (PID: 2096)
      • Maldal.a.exe (PID: 1780)
      • Lacon.exe (PID: 1728)
      • Winevar.exe (PID: 1172)
      • smss.exe (PID: 1040)

    • Changes the login/logoff helper path in the registry

      • Brontok.exe (PID: 680)
      • smss.exe (PID: 1040)
      • winlogon.exe (PID: 2444)

    • Disables the Run the Start menu

      • Gruel.a.exe (PID: 3028)

    • Modify registry editing tools (regedit)

      • Brontok.exe (PID: 680)
      • smss.exe (PID: 1040)
      • winlogon.exe (PID: 2444)

    • Changes appearance of the Explorer extensions

      • Brontok.exe (PID: 680)
      • smss.exe (PID: 1040)
      • winlogon.exe (PID: 2444)

    • Disables the Find the Start menu

      • Gruel.a.exe (PID: 3028)

    • Create files in the Startup directory

      • Lacon.exe (PID: 1728)
      • smss.exe (PID: 1040)

    • Actions looks like stealing of personal data

      • Lacon.exe (PID: 1728)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Duksten.exe (PID: 2096)
      • Brontok.exe (PID: 680)
      • Gruel.a.exe (PID: 3028)
      • Lacon.exe (PID: 1728)
      • Maldal.a.exe (PID: 1780)
      • Prolin.exe (PID: 2828)
      • Yarner.a.exe (PID: 3264)
      • Winevar.exe (PID: 1172)
      • smss.exe (PID: 1040)

    • Drops a file with a rarely used extension (PIF)

      • Brontok.exe (PID: 680)
      • Winevar.exe (PID: 1172)
      • smss.exe (PID: 1040)

    • The process creates files with name similar to system file names

      • Brontok.exe (PID: 680)
      • Gruel.a.exe (PID: 3028)
      • Duksten.exe (PID: 2096)

    • Creates file in the systems drive root

      • Gruel.a.exe (PID: 3028)
      • Prolin.exe (PID: 2828)
      • MsWorld.exe (PID: 924)

    • Creates/Modifies COM task schedule object

      • Gruel.a.exe (PID: 3028)

    • Process drops legitimate windows executable

      • Yarner.a.exe (PID: 3264)
      • Duksten.exe (PID: 2096)

    • Starts application with an unusual extension

      • Winevar.exe (PID: 1172)

    • Starts a Microsoft application from unusual location

      • Trood.a.exe (PID: 2736)

    • Reads the Internet Settings

      • WIN68D2.pif (PID: 2612)

    • Reads security settings of Internet Explorer

      • WIN68D2.pif (PID: 2612)

    • Starts itself from another location

      • Winevar.exe (PID: 1172)
      • smss.exe (PID: 1040)
      • Brontok.exe (PID: 680)

    • Executes application which crashes

      • Duksten.exe (PID: 2096)

  • INFO

    • Checks supported languages

      • Anap.a.exe (PID: 2244)
      • Brontok.exe (PID: 680)
      • Gruel.a.exe (PID: 3028)
      • Duksten.exe (PID: 2096)
      • Kiray.exe (PID: 3088)
      • Lacon.exe (PID: 1728)
      • MsWorld.exe (PID: 924)
      • Prolin.exe (PID: 2828)
      • Maldal.a.exe (PID: 1780)
      • Winevar.exe (PID: 1172)
      • Yarner.a.exe (PID: 3264)
      • WIN68D2.pif (PID: 2612)
      • smss.exe (PID: 1040)
      • Gruel.a.exe (PID: 292)
      • services.exe (PID: 1092)
      • lsass.exe (PID: 1740)
      • winlogon.exe (PID: 2444)

    • Manual execution by a user

      • Anap.a.exe (PID: 2244)
      • Brontok.exe (PID: 680)
      • Gruel.a.exe (PID: 3028)
      • Duksten.exe (PID: 2096)
      • Kiray.exe (PID: 3088)
      • Lacon.exe (PID: 1728)
      • MeltingScreen.exe (PID: 2020)
      • Nyxem.E.exe (PID: 2616)
      • Prolin.exe (PID: 2828)
      • Maldal.a.exe (PID: 1780)
      • MyPics.a.exe (PID: 2308)
      • MsWorld.exe (PID: 924)
      • Trood.a.exe (PID: 2736)
      • Winevar.exe (PID: 1172)
      • Yarner.a.exe (PID: 3264)

    • Create files in a temporary directory

      • Brontok.exe (PID: 680)
      • Kiray.exe (PID: 3088)
      • Gruel.a.exe (PID: 3028)
      • Maldal.a.exe (PID: 1780)
      • Prolin.exe (PID: 2828)
      • MsWorld.exe (PID: 924)
      • smss.exe (PID: 1040)
      • winlogon.exe (PID: 2444)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3500)

    • Reads the machine GUID from the registry

      • Brontok.exe (PID: 680)
      • Gruel.a.exe (PID: 3028)
      • Kiray.exe (PID: 3088)
      • Maldal.a.exe (PID: 1780)
      • Prolin.exe (PID: 2828)
      • MsWorld.exe (PID: 924)
      • Lacon.exe (PID: 1728)
      • Yarner.a.exe (PID: 3264)
      • WIN68D2.pif (PID: 2612)
      • smss.exe (PID: 1040)
      • winlogon.exe (PID: 2444)

    • Reads the computer name

      • Brontok.exe (PID: 680)
      • Kiray.exe (PID: 3088)
      • Lacon.exe (PID: 1728)
      • Prolin.exe (PID: 2828)
      • MsWorld.exe (PID: 924)
      • Winevar.exe (PID: 1172)
      • Yarner.a.exe (PID: 3264)
      • WIN68D2.pif (PID: 2612)
      • smss.exe (PID: 1040)
      • winlogon.exe (PID: 2444)

    • Creates files or folders in the user directory

      • Brontok.exe (PID: 680)
      • Lacon.exe (PID: 1728)
      • smss.exe (PID: 1040)

    • Checks proxy server information

      • WIN68D2.pif (PID: 2612)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 3688)

    • Reads the Internet Settings

      • explorer.exe (PID: 3688)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 45
ZipBitFlag: 0x0800
ZipCompression: Deflated
ZipModifyDate: 2024:03:18 20:47:46
ZipCRC: 0x00000000
ZipCompressedSize: 2
ZipUncompressedSize: -
ZipFileName: Email-Worm/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
102
Monitored processes
33
Malicious processes
9
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe anap.a.exe brontok.exe duksten.exe gruel.a.exe kiray.exe lacon.exe maldal.a.exe meltingscreen.exe explorer.exe no specs msworld.exe mypics.a.exe nyxem.e.exe prolin.exe trood.a.exe winevar.exe yarner.a.exe win68d2.pif no specs explorer.exe no specs gruel.a.exe no specs gruel.a.exe smss.exe winlogon.exe at.exe no specs services.exe no specs at.exe no specs lsass.exe no specs werfault.exe no specs outlook.exe no specs outlook.exe no specs outlook.exe no specs outlook.exe no specs outlook.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
240C:\Windows\system32\WerFault.exe -u -p 2096 -s 8C:\Windows\System32\WerFault.exe—Duksten.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
3221226091
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
292"C:\Users\admin\Desktop\Email-Worm\Email-Worm\Gruel.a.exe" C:\Windows\eksplorasi.pifC:\Users\admin\Desktop\Email-Worm\Email-Worm\Gruel.a.exe
explorer.exe
User:
admin
Company:
Microsoft
Integrity Level:
HIGH
Exit code:
1073807364
Version:
1.00
Modules
Images
c:\users\admin\desktop\email-worm\email-worm\gruel.a.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
332C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE -EmbeddingC:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Outlook
Exit code:
3221226091
Version:
14.0.6025.1000
Modules
Images
c:\program files\microsoft office\office14\outlook.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
680"C:\Users\admin\Desktop\Email-Worm\Email-Worm\Brontok.exe" C:\Users\admin\Desktop\Email-Worm\Email-Worm\Brontok.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\email-worm\email-worm\brontok.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
924"C:\Users\admin\Desktop\Email-Worm\Email-Worm\MsWorld.exe" C:\Users\admin\Desktop\Email-Worm\Email-Worm\MsWorld.exe
explorer.exe
User:
admin
Company:
Macromedia, Inc.
Integrity Level:
HIGH
Description:
Flash Player 5.0 r30
Exit code:
0
Version:
5.00
Modules
Images
c:\users\admin\desktop\email-worm\email-worm\msworld.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1040C:\Users\admin\AppData\Local\smss.exeC:\Users\admin\AppData\Local\smss.exe
Brontok.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1073807364
Modules
Images
c:\users\admin\appdata\local\smss.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1092C:\Users\admin\AppData\Local\services.exeC:\Users\admin\AppData\Local\services.exe—smss.exe
User:
admin
Integrity Level:
HIGH
Exit code:
3221226091
Modules
Images
c:\users\admin\appdata\local\services.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1172"C:\Users\admin\Desktop\Email-Worm\Email-Worm\Winevar.exe" C:\Users\admin\Desktop\Email-Worm\Email-Worm\Winevar.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\email-worm\email-worm\winevar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\wsock32.dll
1384C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE -EmbeddingC:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Outlook
Exit code:
3221226091
Version:
14.0.6025.1000
Modules
Images
c:\program files\microsoft office\office14\outlook.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1728"C:\Users\admin\Desktop\Email-Worm\Email-Worm\Lacon.exe" C:\Users\admin\Desktop\Email-Worm\Email-Worm\Lacon.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1073807364
Version:
1.00
Modules
Images
c:\users\admin\desktop\email-worm\email-worm\lacon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
Total events
6 965
Read events
6 864
Write events
97
Delete events
4

Modification events

(PID) Process:(3500) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3500) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3500) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3500) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3500) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3500) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(3500) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Email-Worm.zip
(PID) Process:(3500) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3500) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3500) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
687
Suspicious files
4
Text files
2
Unknown types
4

Dropped files

PID
Process
Filename
Type
3500WinRAR.exeC:\Users\admin\Desktop\Email-Worm\Email-Worm\Quamo.exeexecutable
MD5:A1F722324492FDA51077449EC2DB2827
SHA256:FC2CED1D89845DCFAE55B6E854CD0E622FDF98BAEEB4A67A60852ECD1212F93B
3500WinRAR.exeC:\Users\admin\Desktop\Email-Worm\Email-Worm\Funsoul.exeexecutable
MD5:A13A4DB860D743A088EF7AB9BACB4DDA
SHA256:69EE59CEE5A1D39739D935701CFA917F75787B29E0B9BDA9ADA9E2642ADE434C
3500WinRAR.exeC:\Users\admin\Desktop\Email-Worm\Email-Worm\Nyxem.E.exeexecutable
MD5:A0BDCE2F937FFBB7BA548845B24749C0
SHA256:62F8364C46300BCE2E75C4CC65039DE3F060B854764DD90F0FA656EFAF31BEA9
3500WinRAR.exeC:\Users\admin\Desktop\Email-Worm\Email-Worm\Yarner.a.exeexecutable
MD5:64218AC85566808EE404A3E2ACED679C
SHA256:C8B59505E578D555976B6176732C1F19FD76860CF465CF1427E1DFA50622E067
3500WinRAR.exeC:\Users\admin\Desktop\Email-Worm\Email-Worm\Klez.e.exeexecutable
MD5:F2DB87B351770E5995E9FCAAD47D9591
SHA256:3113FA9A3CF00ED423A2C686A2FFB19586F6A047747DE65A93436A7DCA8FCFA7
3500WinRAR.exeC:\Users\admin\Desktop\Email-Worm\Email-Worm\Duksten.exeexecutable
MD5:900EBFF3E658825F828AB95B30FAD2E7
SHA256:CAEC6E664B3CFF5717DD2EFEA8DCD8715ABDCFE7F611456BE7009771F22A8F50
3500WinRAR.exeC:\Users\admin\Desktop\Email-Worm\Email-Worm\MeltingScreen.exeexecutable
MD5:4784E42C3B15D1A141A5E0C8ABC1205C
SHA256:9D355E4F9A51536B05269F696B304859155985957BA95EB575F3F38C599D913C
3500WinRAR.exeC:\Users\admin\Desktop\Email-Worm\Email-Worm\Happy99.exeexecutable
MD5:02DD0EAA9649A11E55FA5467FA4B8EF8
SHA256:4EBE3E1AF5E147C580ECCE052FE7D7D0219D5E5A2F5E6D8A7F7291735923DB18
3500WinRAR.exeC:\Users\admin\Desktop\Email-Worm\Email-Worm\Pikachu.exeexecutable
MD5:715614E09261B39DFA439FA1326C0CEC
SHA256:E1DFC005D5403FB2F356276F0ABE19DF68249CE10E5035450926D56C2F8D3652
3500WinRAR.exeC:\Users\admin\Desktop\Email-Worm\Email-Worm\Merkur.exeexecutable
MD5:E6F8F701D646B193139CF0A92229455F
SHA256:7E89FABFDBE214BF6A6F9730F3E451E69F752B62BBD54C0A81D2AAE2320ABD2C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
5
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

Domain
IP
Reputation
www.symantec.com
  • 104.18.14.245
whitelisted

Threats

No threats detected
Process
Message
Duksten.exe
Error -
Duksten.exe
RtlWerpReportException failed with status code :-1073741823. Will try to launch the process directly
Duksten.exe
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Email-Worm.zip