analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

download_facturas.zip

Full analysis: https://app.any.run/tasks/ccb42ad9-4c39-45f2-b69e-3dfb7b8d9d58
Verdict: Malicious activity
Analysis date: August 13, 2019, 22:00:43
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

CF749FEA5CE8A857EF39EB2CEBCCE529

SHA1:

6FCA06EE3F46B0583282D4F9CB801317F6205CB9

SHA256:

639FC4CB43BF03B709C4912B64C8898B048330C6637B7290684023406C162C25

SSDEEP:

196608:5Gylekyrw+4QWmET+QSy4r0viDz/7QeDi7VZX0nYinxkiTh9bL:MySZ8+OvGgX43xpTh1L

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • VASG054BF4Z4CZ9.exe (PID: 2364)
      • SearchProtocolHost.exe (PID: 3744)

    • Application was dropped or rewritten from another process

      • VASG054BF4Z4CZ9.exe (PID: 2364)

    • Changes the autorun value in the registry

      • VASG054BF4Z4CZ9.exe (PID: 2364)

  • SUSPICIOUS

    • Executed as Windows Service

      • vssvc.exe (PID: 2452)

    • Executed via COM

      • DrvInst.exe (PID: 3368)

    • Starts Microsoft Installer

      • WinRAR.exe (PID: 4052)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 2324)

    • Disables Form Suggestion in IE

      • VASG054BF4Z4CZ9.exe (PID: 2364)

  • INFO

    • Searches for installed software

      • msiexec.exe (PID: 2324)

    • Manual execution by user

      • WinRAR.exe (PID: 4052)

    • Application launched itself

      • msiexec.exe (PID: 2324)

    • Low-level read access rights to disk partition

      • vssvc.exe (PID: 2452)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.kmz | Google Earth saved working session (60)
.zip | ZIP compressed archive (40)

EXIF

ZIP

ZipFileName: download_facturas.msi
ZipUncompressedSize: 8961024
ZipCompressedSize: 8771193
ZipCRC: 0x08fc31d2
ZipModifyDate: 2019:08:13 10:55:17
ZipCompression: Deflated
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
9
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start rundll32.exe no specs winrar.exe no specs msiexec.exe no specs msiexec.exe vssvc.exe no specs drvinst.exe no specs msiexec.exe no specs vasg054bf4z4cz9.exe searchprotocolhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1840"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\Desktop\download_facturas.zip.kmzC:\Windows\system32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
4052"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\download_facturas.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
2272"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\Rar$EXa4052.19122\download_facturas.msi" C:\Windows\System32\msiexec.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
2324C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
2452C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3368DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot22" "" "" "695c3f483" "00000000" "00000578" "00000580"C:\Windows\system32\DrvInst.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2904C:\Windows\system32\MsiExec.exe -Embedding C186D0F50334C90F29DF033849A7A7DCC:\Windows\system32\MsiExec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
2364"C:\Users\admin\Documents\VASG054BF4Z4CZ9.exe"C:\Users\admin\Documents\VASG054BF4Z4CZ9.exe
msiexec.exe
User:
admin
Company:
VMware, Inc.
Integrity Level:
MEDIUM
Description:
VMware NAT Service
Version:
12.5.6 build-5528349
3744"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe13_ Global\UsGthrCtrlFltPipeMssGthrPipe13 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
Total events
932
Read events
738
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
4
Text files
30
Unknown types
0

Dropped files

PID
Process
Filename
Type
4052WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa4052.19122\download_facturas.msi —
MD5:—
SHA256:—
2324msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
2324msiexec.exeC:\Windows\Installer\376e6e.msi —
MD5:—
SHA256:—
2324msiexec.exeC:\Windows\Installer\MSI7071.tmp —
MD5:—
SHA256:—
2324msiexec.exeC:\Windows\Installer\MSI71E9.tmp —
MD5:—
SHA256:—
2324msiexec.exeC:\Users\admin\AppData\Local\Temp\~DFB9244FBC62666F7B.TMP —
MD5:—
SHA256:—
2324msiexec.exeC:\Windows\Installer\376e70.ipi —
MD5:—
SHA256:—
2324msiexec.exeC:\Windows\Installer\MSI7277.tmp —
MD5:—
SHA256:—
2324msiexec.exeC:\Config.Msi\376e71.rbs —
MD5:—
SHA256:—
2324msiexec.exeC:\Users\admin\AppData\Local\Temp\~DFFA21F0BB335877C3.TMP —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
Process
Message
VASG054BF4Z4CZ9.exe
CodeSet_Init: no ICU
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
download_facturas.zip