analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

752e3_Swift Payment slip.z

Full analysis: https://app.any.run/tasks/f5a5995f-effc-481a-b1dc-46de1de9923b
Verdict: Malicious activity
Analysis date: March 31, 2020, 08:41:40
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v4, os: Win32
MD5:

752E3CA98E88B469E3E9550C390E082F

SHA1:

209B04A089271B20585773CAC0369BDF6071033F

SHA256:

6F00EABD9D2AA1FEE54051384C358376A0466A04F27C3609745924619AA16464

SSDEEP:

768:p6sIhjF7WonLgU3XY9ft1znNX+42/W2Zlrtm:pOdp5Lg6oJzF+vW2Zu

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Swift Payment slip.exe (PID: 852)
    • Actions looks like stealing of personal data

      • RegAsm.exe (PID: 3768)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3100)
    • Reads Internet Cache Settings

      • RegAsm.exe (PID: 3768)
    • Creates files in the user directory

      • RegAsm.exe (PID: 3768)
    • Connects to SMTP port

      • RegAsm.exe (PID: 3768)
    • Reads Environment values

      • RegAsm.exe (PID: 3768)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v-4.x) (58.3)
.rar | RAR compressed archive (gen) (41.6)

EXIF

ZIP

CompressedSize: 24986
UncompressedSize: 102400
OperatingSystem: Win32
ModifyDate: 2020:03:30 12:15:27
PackingMethod: Normal
ArchivedFileName: Swift Payment slip.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
3
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start winrar.exe swift payment slip.exe no specs regasm.exe

Process information

PID
CMD
Path
Indicators
Parent process
3100"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\752e3_Swift Payment slip.z.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
852"C:\Users\admin\AppData\Local\Temp\Rar$EXa3100.45784\Swift Payment slip.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3100.45784\Swift Payment slip.exeWinRAR.exe
User:
admin
Company:
WONderware
Integrity Level:
MEDIUM
Description:
SOFTDRIN
Exit code:
0
Version:
1.00
3768"C:\Users\admin\AppData\Local\Temp\Rar$EXa3100.45784\Swift Payment slip.exe" C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Swift Payment slip.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Version:
4.7.3062.0 built by: NET472REL1
Total events
524
Read events
493
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
6
Text files
1
Unknown types
3

Dropped files

PID
Process
Filename
Type
3768RegAsm.exeC:\Users\admin\AppData\Local\Temp\CabE18E.tmp
MD5:
SHA256:
3768RegAsm.exeC:\Users\admin\AppData\Local\Temp\TarE18F.tmp
MD5:
SHA256:
3768RegAsm.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BE8B021F9E811DFC8C8A28572A17C05A_0B97942EE72A6E3F514E8E84F294CC72binary
MD5:0B61F8B4FC3C5C94674B5AE304970A65
SHA256:95E00E24302C2A10B381B84A2EB84039EF2A1C4FC09366E5A424EDCBCB0AAA7D
3768RegAsm.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288Bder
MD5:E550DA03AEE5B546B436CD553D3233B9
SHA256:9ABFD4E29B96CCA442502B1DE6071FE0293455DF22B4EFF19FA3E6DF060947E7
3768RegAsm.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BE8B021F9E811DFC8C8A28572A17C05A_0B97942EE72A6E3F514E8E84F294CC72der
MD5:F26B1B29960D99AD1C44E71E3D2ABE4C
SHA256:7910B27AFDEE20EA27C4FA19221B1B63E00235E261E1A3FB9F1FB3456CBBB7AC
3768RegAsm.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288Bbinary
MD5:C4460A136D94639438C24E3B19F6DC76
SHA256:74D8599175112BC72D93134CC53DDE8D9CA444F7B0957990696C9161D2B9BBE6
3768RegAsm.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BE8B021F9E811DFC8C8A28572A17C05A_BA8650709FF65A42B9202D73C10A8F29binary
MD5:4682276E414824328AA8303C978C8692
SHA256:0524CE50AB8693D0C4880482BBB0A10EA666CAFE8F86E32C8B3F67D73EBD1C79
3768RegAsm.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BE8B021F9E811DFC8C8A28572A17C05A_BA8650709FF65A42B9202D73C10A8F29der
MD5:75D636BF532AFFBC75F461235C3B4D5C
SHA256:727247C8DCAC2B6B8A4F5890F1BCE6F8AF87B49BC38F97308E706A6A313B66AF
3100WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3100.45784\Swift Payment slip.exeexecutable
MD5:A424820071AE128C2AA49F8F709D6B4D
SHA256:C2E2CEA3FA1723EF7A8AA32D51B257D90EB3FC2F11CAD2A3C5709272D68EDD09
3768RegAsm.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\WXY0TP32.txttext
MD5:3965ADEBA4AA00F7BAF45C8F67DB8B5D
SHA256:AEC70EC5B6256E4EAC65DA60EFDE5A4C669F3D912DF49C31FE318FFEE9A9386C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
4
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3768
RegAsm.exe
GET
200
172.217.21.227:80
http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D
US
der
468 b
whitelisted
3768
RegAsm.exe
GET
200
172.217.21.227:80
http://ocsp.pki.goog/gts1o1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEFOOHQjK5IlqCAAAAAAyCmA%3D
US
der
471 b
whitelisted
3768
RegAsm.exe
GET
200
172.217.21.227:80
http://ocsp.pki.goog/gts1o1/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQDL%2FQslYWVuogIAAAAAXGdc
US
der
472 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3768
RegAsm.exe
208.91.198.143:587
smtp.seawaygroup-bd.com
PDR
US
shared
3768
RegAsm.exe
172.217.16.161:443
doc-0o-bk-docs.googleusercontent.com
Google Inc.
US
whitelisted
3768
RegAsm.exe
172.217.16.206:443
drive.google.com
Google Inc.
US
whitelisted
3768
RegAsm.exe
172.217.21.227:80
ocsp.pki.goog
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
drive.google.com
  • 172.217.16.206
shared
ocsp.pki.goog
  • 172.217.21.227
whitelisted
doc-0o-bk-docs.googleusercontent.com
  • 172.217.16.161
shared
smtp.seawaygroup-bd.com
  • 208.91.198.143
  • 208.91.199.224
  • 208.91.199.225
  • 208.91.199.223
malicious

Threats

No threats detected
No debug info