File name:

m6.zip

Full analysis: https://app.any.run/tasks/26e6298e-8f10-483d-9f71-7f1a1a80c797
Verdict: Malicious activity
Analysis date: June 28, 2021, 15:25:35
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

2F1BD55E106A206F34A7BF5BA5DCA49B

SHA1:

F71E589318C502A9E9825F80030D54178A7657C6

SHA256:

705A4CDC86BF5C38259316E8BABDB5EF15AF52BC1EB13B0C68F5E9AF89341F55

SSDEEP:

98304:9CIHrOkl5/H7S0vQvriSrNSTJa4khUtcLmlh/ak3VjivaU4IxwPdSd:9CIq+7S2Ori+4FN3Dh/nljivB6M

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 3396)
      • lsso.exe (PID: 2796)

    • Application was dropped or rewritten from another process

      • knil.exe (PID: 2896)
      • lsso.exe (PID: 2796)

  • SUSPICIOUS

    • Drops a file that was compiled in debug mode

      • WinRAR.exe (PID: 2760)

    • Reads the computer name

      • WinRAR.exe (PID: 2760)

    • Drops a file with too old compile date

      • WinRAR.exe (PID: 2760)

    • Checks supported languages

      • WinRAR.exe (PID: 2760)
      • knil.exe (PID: 2896)
      • lsso.exe (PID: 2796)

    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 2760)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2760)

  • INFO

    • Manual execution by user

      • knil.exe (PID: 2896)
      • lsso.exe (PID: 2796)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: m6g.bin.ori
ZipUncompressedSize: 2243172
ZipCompressedSize: 952318
ZipCRC: 0x1b765bfd
ZipModifyDate: 2021:06:17 20:03:08
ZipCompression: Unknown (99)
ZipBitFlag: 0x0009
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
4
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe searchprotocolhost.exe no specs knil.exe no specs lsso.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2760"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\m6.zip"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2796"C:\Users\admin\Desktop\m6\lsso.exe" C:\Users\admin\Desktop\m6\lsso.exe—Explorer.EXE
User:
admin
Company:
The OpenSSL Project, https://www.openssl.org/
Integrity Level:
MEDIUM
Description:
OpenSSL application
Exit code:
3221225786
Version:
1.1.1g
Modules
Images
c:\users\admin\desktop\m6\lsso.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\desktop\m6\libssl-1_1.dll
c:\users\admin\desktop\m6\libcrypto-1_1.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
2896"C:\Users\admin\Desktop\m6\knil.exe" C:\Users\admin\Desktop\m6\knil.exe—Explorer.EXE
User:
admin
Company:
Simon Tatham
Integrity Level:
MEDIUM
Description:
Command-line SSH, Telnet, and Rlogin client
Exit code:
1
Version:
Release 0.73
Modules
Images
c:\users\admin\desktop\m6\knil.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3396"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe5_ Global\UsGthrCtrlFltPipeMssGthrPipe5 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\system32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7601.24542 (win7sp1_ldr_escrow.191209-2211)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
1 821
Read events
1 789
Write events
32
Delete events
0

Modification events

(PID) Process:(2760) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2760) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2760) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2760) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2760) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\m6.zip
(PID) Process:(2760) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2760) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2760) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2760) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2760) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\DialogEditHistory\ExtrPath
Operation:writeName:0
Value:
C:\Users\admin\Desktop\m6
Executable files
8
Suspicious files
2
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
2760WinRAR.exeC:\Users\admin\Desktop\m6\kr.bintext
MD5:—
SHA256:—
2760WinRAR.exeC:\Users\admin\Desktop\m6\m6g.bin.oriexecutable
MD5:—
SHA256:—
2760WinRAR.exeC:\Users\admin\Desktop\m6\knil.exeexecutable
MD5:—
SHA256:—
2760WinRAR.exeC:\Users\admin\Desktop\m6\libssl-1_1.dllexecutable
MD5:B619BAAEE878AD391CF4A1E7177C1458
SHA256:157505FDCC8A5B72AD711D95C7A5C44D071FF45E988F2246FDE0D9D684E2DBE7
2760WinRAR.exeC:\Users\admin\Desktop\m6\BVrHdkhg.exeexecutable
MD5:04029E121A0CFA5991749937DD22A1D9
SHA256:9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F
2760WinRAR.exeC:\Users\admin\Desktop\m6\m6g.binbinary
MD5:—
SHA256:—
2760WinRAR.exeC:\Users\admin\Desktop\m6\m6.binbinary
MD5:—
SHA256:—
2760WinRAR.exeC:\Users\admin\Desktop\m6\m6.bin.oriexecutable
MD5:—
SHA256:—
2760WinRAR.exeC:\Users\admin\Desktop\m6\2U7psLD4qd.exeexecutable
MD5:CDA48FC75952AD12D99E526D0B6BF70A
SHA256:908B64B1971A979C7E3E8CE4621945CBA84854CB98D76367B791A6E22B5F6D53
2760WinRAR.exeC:\Users\admin\Desktop\m6\lsso.exeexecutable
MD5:FF7827342264D3B3F6A8E47F7603DAE3
SHA256:1F71B444A836C9ED8E76B160A7EE29F65317F2E85D6766B174E6FAA0D58339E8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
m6.zip