analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

TotalAV_Setup (1).exe (1).zip

Full analysis: https://app.any.run/tasks/e2a316c8-18ca-45e6-bbac-f47e0aff37b0
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: January 24, 2022, 18:46:11
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
stealer
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

B4CFDE815F9C43EBBA38AAE5B601EF9D

SHA1:

5E5A76A79E7215CBBD192F7FC1747D31E189E512

SHA256:

6CFC218F6AD0B370366B980C6471762BE4760C36C00A3496762522DA6708AA3E

SSDEEP:

393216:n6RnM1LO4+nUlaLrQ7sVwFEZbp+xdp1gxN:6RMUSliqMwk0gxN

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • TotalAV_Setup (1).exe (PID: 2720)
      • TotalAV_Setup (1).exe (PID: 2208)
      • SecurityService.exe (PID: 1512)
      • subinacl.exe (PID: 2796)
      • TotalAV.exe (PID: 2560)
      • SecurityService.exe (PID: 1320)
      • TotalAV.exe (PID: 4084)

    • Drops executable file immediately after starts

      • TotalAV_Setup (1).exe (PID: 2208)

    • Loads dropped or rewritten executable

      • TotalAV_Setup (1).exe (PID: 2208)
      • SecurityService.exe (PID: 1320)

    • Stealing of credential data

      • TotalAV.exe (PID: 2560)

    • Changes settings of System certificates

      • TotalAV.exe (PID: 2560)

  • SUSPICIOUS

    • Checks supported languages

      • WinRAR.exe (PID: 3900)
      • TotalAV_Setup (1).exe (PID: 2208)
      • ns6707.tmp (PID: 3736)
      • ns67E3.tmp (PID: 2368)
      • ns6851.tmp (PID: 1412)
      • ns692E.tmp (PID: 3572)
      • ns68BF.tmp (PID: 2996)
      • ns7823.tmp (PID: 1320)
      • SecurityService.exe (PID: 1512)
      • subinacl.exe (PID: 2796)
      • TotalAV.exe (PID: 2560)
      • SecurityService.exe (PID: 1320)
      • TotalAV.exe (PID: 4084)

    • Reads the computer name

      • TotalAV_Setup (1).exe (PID: 2208)
      • WinRAR.exe (PID: 3900)
      • SecurityService.exe (PID: 1512)
      • subinacl.exe (PID: 2796)
      • TotalAV.exe (PID: 2560)
      • SecurityService.exe (PID: 1320)
      • TotalAV.exe (PID: 4084)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3900)
      • TotalAV_Setup (1).exe (PID: 2208)
      • SecurityService.exe (PID: 1320)
      • TotalAV.exe (PID: 2560)

    • Starts application with an unusual extension

      • TotalAV_Setup (1).exe (PID: 2208)

    • Uses TASKKILL.EXE to kill process

      • ns6707.tmp (PID: 3736)
      • ns67E3.tmp (PID: 2368)
      • ns6851.tmp (PID: 1412)
      • ns68BF.tmp (PID: 2996)

    • Creates a directory in Program Files

      • TotalAV_Setup (1).exe (PID: 2208)
      • SecurityService.exe (PID: 1512)
      • TotalAV.exe (PID: 2560)
      • SecurityService.exe (PID: 1320)

    • Drops a file with too old compile date

      • TotalAV_Setup (1).exe (PID: 2208)

    • Creates a software uninstall entry

      • TotalAV_Setup (1).exe (PID: 2208)

    • Drops a file with a compile date too recent

      • TotalAV_Setup (1).exe (PID: 2208)

    • Creates files in the program directory

      • SecurityService.exe (PID: 1512)
      • TotalAV_Setup (1).exe (PID: 2208)
      • SecurityService.exe (PID: 1320)
      • TotalAV.exe (PID: 2560)

    • Drops a file that was compiled in debug mode

      • TotalAV_Setup (1).exe (PID: 2208)
      • SecurityService.exe (PID: 1320)
      • TotalAV.exe (PID: 2560)

    • Reads Environment values

      • TotalAV.exe (PID: 2560)

    • Creates files in the user directory

      • TotalAV.exe (PID: 2560)

    • Adds / modifies Windows certificates

      • TotalAV.exe (PID: 2560)

    • Creates files in the driver directory

      • SecurityService.exe (PID: 1320)

    • Executed as Windows Service

      • SecurityService.exe (PID: 1320)

    • Creates files in the Windows directory

      • SecurityService.exe (PID: 1320)

    • Removes files from Windows directory

      • SecurityService.exe (PID: 1320)

  • INFO

    • Checks supported languages

      • taskkill.exe (PID: 4060)
      • taskkill.exe (PID: 3152)
      • taskkill.exe (PID: 2892)
      • taskkill.exe (PID: 1236)
      • WISPTIS.EXE (PID: 2436)

    • Reads the computer name

      • taskkill.exe (PID: 4060)
      • taskkill.exe (PID: 3152)
      • taskkill.exe (PID: 2892)
      • taskkill.exe (PID: 1236)
      • WISPTIS.EXE (PID: 2436)

    • Reads settings of System Certificates

      • TotalAV.exe (PID: 2560)
      • SecurityService.exe (PID: 1320)

    • Checks Windows Trust Settings

      • SecurityService.exe (PID: 1320)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0009
ZipCompression: Deflated
ZipModifyDate: 2021:03:02 20:41:05
ZipCRC: 0x782498d3
ZipCompressedSize: 14478649
ZipUncompressedSize: 14584656
ZipFileName: TotalAV_Setup (1).exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
68
Monitored processes
20
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start drop and start start drop and start winrar.exe totalav_setup (1).exe no specs totalav_setup (1).exe ns6707.tmp no specs taskkill.exe no specs ns67e3.tmp no specs taskkill.exe no specs ns6851.tmp no specs taskkill.exe no specs ns68bf.tmp no specs taskkill.exe no specs ns692e.tmp no specs ns7823.tmp no specs securityservice.exe no specs subinacl.exe no specs totalav.exe wisptis.exe no specs wisptis.exe no specs securityservice.exe totalav.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3900"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\TotalAV_Setup (1).exe (1).zip"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\winrar\winrar.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2720"C:\Users\admin\AppData\Local\Temp\Rar$EXb3900.14040\TotalAV_Setup (1).exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb3900.14040\TotalAV_Setup (1).exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
TotalAV Ultimate Antivirus Installer
Exit code:
3221226540
Version:
4.14.31.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb3900.14040\totalav_setup (1).exe
c:\windows\system32\ntdll.dll
2208"C:\Users\admin\AppData\Local\Temp\Rar$EXb3900.14040\TotalAV_Setup (1).exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb3900.14040\TotalAV_Setup (1).exe
WinRAR.exe
User:
admin
Integrity Level:
HIGH
Description:
TotalAV Ultimate Antivirus Installer
Exit code:
0
Version:
4.14.31.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb3900.14040\totalav_setup (1).exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
3736"C:\Users\admin\AppData\Local\Temp\nsk5AB2.tmp\ns6707.tmp" "taskkill" /F /FI "WINDOWTITLE eq TotalAV"C:\Users\admin\AppData\Local\Temp\nsk5AB2.tmp\ns6707.tmp—TotalAV_Setup (1).exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nsk5ab2.tmp\ns6707.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
4060"taskkill" /F /FI "WINDOWTITLE eq TotalAV"C:\Windows\system32\taskkill.exe—ns6707.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\version.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
2368"C:\Users\admin\AppData\Local\Temp\nsk5AB2.tmp\ns67E3.tmp" "taskkill" /f /T /IM "avupdate.exe"C:\Users\admin\AppData\Local\Temp\nsk5AB2.tmp\ns67E3.tmp—TotalAV_Setup (1).exe
User:
admin
Integrity Level:
HIGH
Exit code:
128
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\users\admin\appdata\local\temp\nsk5ab2.tmp\ns67e3.tmp
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3152"taskkill" /f /T /IM "avupdate.exe"C:\Windows\system32\taskkill.exe—ns67E3.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
1412"C:\Users\admin\AppData\Local\Temp\nsk5AB2.tmp\ns6851.tmp" "taskkill" /f /T /IM "Update.Win.exe"C:\Users\admin\AppData\Local\Temp\nsk5AB2.tmp\ns6851.tmp—TotalAV_Setup (1).exe
User:
admin
Integrity Level:
HIGH
Exit code:
128
Modules
Images
c:\users\admin\appdata\local\temp\nsk5ab2.tmp\ns6851.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2892"taskkill" /f /T /IM "Update.Win.exe"C:\Windows\system32\taskkill.exe—ns6851.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
2996"C:\Users\admin\AppData\Local\Temp\nsk5AB2.tmp\ns68BF.tmp" "taskkill" /f /T /IM "PasswordExtension.Win.exe"C:\Users\admin\AppData\Local\Temp\nsk5AB2.tmp\ns68BF.tmp—TotalAV_Setup (1).exe
User:
admin
Integrity Level:
HIGH
Exit code:
128
Modules
Images
c:\users\admin\appdata\local\temp\nsk5ab2.tmp\ns68bf.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
13 627
Read events
13 471
Write events
156
Delete events
0

Modification events

(PID) Process:(3900) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3900) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3900) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3900) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3900) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3900) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\TotalAV_Setup (1).exe (1).zip
(PID) Process:(3900) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3900) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3900) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3900) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
180
Suspicious files
77
Text files
38
Unknown types
56

Dropped files

PID
Process
Filename
Type
2208TotalAV_Setup (1).exeC:\Users\admin\AppData\Local\Temp\TotalAV.7z —
MD5:—
SHA256:—
2208TotalAV_Setup (1).exeC:\Program Files\TotalAV\SecurityProductInformation.initext
MD5:9C6D9F5CAD431222C618226C1E9BED3E
SHA256:9FF35F07CE4E5A9E894DCF738BDFDD666A1BE88813A1DC1DAE3B6E982B4CCE20
3900WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3900.14040\TotalAV_Setup (1).exeexecutable
MD5:EE55C979E47BC2ED97A483CB9A944118
SHA256:D5466EB8F2FD988EA01C2CA84897372A012B71B0964D25870D736674FC786874
2208TotalAV_Setup (1).exeC:\Program Files\TotalAV\ovpn\openvpn_down.battext
MD5:08BAE2DE82FA4FB579F707376D440056
SHA256:6CAB17FEE12D3A2C43EB4D7C3A790CDBD7FC9AFC6B0C6D60DBBB61594F6CEC74
2208TotalAV_Setup (1).exeC:\Users\admin\AppData\Local\Temp\nsk5AB2.tmp\System.dllexecutable
MD5:3F176D1EE13B0D7D6BD92E1C7A0B9BAE
SHA256:FA4AB1D6F79FD677433A31ADA7806373A789D34328DA46CCB0449BBF347BD73E
2208TotalAV_Setup (1).exeC:\Users\admin\AppData\Local\Temp\nsk5AB2.tmp\modern-header.bmpimage
MD5:C493CB5A2E37620EE28BE3665A29E84B
SHA256:123918B9BC59785FA8FF2142B20D537CD1B09848BA5D88E201E70510B74BE295
2208TotalAV_Setup (1).exeC:\Users\admin\AppData\Local\Temp\nsk5AB2.tmp\modern-wizard.bmpimage
MD5:D8D29AC4330A252C15FB48D9758AA378
SHA256:42F0DA3301C3739D99DE30E1A58FF39BAED543C3E0447BCE9C15F8A95E8B3090
2208TotalAV_Setup (1).exeC:\Users\admin\AppData\Local\Temp\nsk5AB2.tmp\nsRandom.dllexecutable
MD5:AB467B8DFAA660A0F0E5B26E28AF5735
SHA256:DB267D9920395B4BADC48DE04DF99DFD21D579480D103CAE0F48E6578197FF73
2208TotalAV_Setup (1).exeC:\Program Files\TotalAV\ovpn\openvpn_up.battext
MD5:CD4D223ACDDBD08101A159B17022324B
SHA256:6ED4C6D1BA69E5AAD84434E40F97C39432BE10B903652860F8F16D7861EA79D6
2208TotalAV_Setup (1).exeC:\Program Files\TotalAV\driver\amd64\tap0901.catcat
MD5:E0762D9F662614CDC930E211884E9443
SHA256:B8913D43B03ECF24F466B7BD5046B0C35EC9C43620D10CE3D5DD6538356A85A8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
9
DNS requests
5
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2560
TotalAV.exe
GET
200
185.172.148.128:80
http://install.protected.net/windows/avirasdk/3.0.0/avira32redist.zip
DE
compressed
15.7 Mb
malicious
1320
SecurityService.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSHRqVSKsocqbcuJkRZwJjSAmttHAQUrWkGcPyAGxazqRiUa5QChl73J4wCEA8DpEdAc3HbUzijkx9jirc%3D
US
der
471 b
whitelisted
2560
TotalAV.exe
GET
—
35.190.63.3:80
http://definition.protected.net/vdf.zip
US
—
—
whitelisted
1320
SecurityService.exe
GET
200
67.27.158.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?909ec6423e6fdc6b
US
compressed
4.70 Kb
whitelisted
2560
TotalAV.exe
GET
—
35.190.63.3:80
http://definition.protected.net/vdf.zip
US
—
—
whitelisted
1320
SecurityService.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA3Q4zdKyVvb%2BmtDSypI7AY%3D
US
der
471 b
whitelisted
2560
TotalAV.exe
HEAD
200
35.190.63.3:80
http://definition.protected.net/vdf.zip
US
—
—
whitelisted
2560
TotalAV.exe
HEAD
200
35.190.63.3:80
http://definition.protected.net/vdf.zip
US
—
—
whitelisted
2560
TotalAV.exe
HEAD
200
35.190.63.3:80
http://definition.protected.net/vdf.zip
US
—
—
whitelisted
1320
SecurityService.exe
GET
200
67.27.158.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?e1e9bb3f4a988eb8
US
compressed
59.9 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2560
TotalAV.exe
185.172.148.128:80
install.protected.net
proinity GmbH
DE
malicious
2560
TotalAV.exe
35.190.63.3:80
definition.protected.net
Google Inc.
US
unknown
2560
TotalAV.exe
34.117.198.220:443
api.totalav.com
—
US
unknown
1320
SecurityService.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
1320
SecurityService.exe
67.27.158.254:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
malicious

DNS requests

Domain
IP
Reputation
install.protected.net
  • 185.172.148.128
malicious
api.totalav.com
  • 34.117.198.220
unknown
ctldl.windowsupdate.com
  • 67.27.158.254
  • 8.241.78.254
  • 8.248.119.254
  • 8.253.95.249
  • 67.26.139.254
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
definition.protected.net
  • 35.190.63.3
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
TotalAV_Setup (1).exe (1).zip