analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Virus Infection.zip

Full analysis: https://app.any.run/tasks/e1de9731-5a7f-49f8-81ec-44a8bacb1645
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Malware Trends Tracker     >>>
Analysis date: January 15, 2022, 00:03:16
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
sality
sinkhole
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

563328B7A1439A567E7B87C8232F5F44

SHA1:

93D7E9C693364A359F535A4DCA250E61C7429D59

SHA256:

70AD044E9AE1BEAAA97CD9C5478278A765ECC42628C3B1BD13710619821FDF5A

SSDEEP:

196608:8Njv+NYQf47AGyT4qreHeoX5icSVHnSHGrVYl7QS9kDkt4G/79Ss5RsQMCA:avOf47CTxe+oX5jSVHSu8QS9kD4J/0Y+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • AutoRun.akw.346c9322bc80ff97e126a7a7c3836d31.exe (PID: 784)
      • red_conapi.exe (PID: 1780)
      • Renamer.k.73dff1c450ac7df11c7b3f7f3d261569.exe (PID: 2052)
      • Sality.gen.55a00c72391b2e89c4500.exe (PID: 376)
      • Sality.s.795c5088f67de4bfbf81fcbf8b0fea1f.exe (PID: 1144)
      • Sality.ae.53a84290774665e9fcfc1576680c25c0.exe (PID: 988)
      • Fun.exe (PID: 3972)
      • dc.exe (PID: 3696)
      • Pioneer.cz.58fab99607afc5da878c0.exe (PID: 472)
      • SVIQ.EXE (PID: 380)
      • Pioneer.cz.58fab99607afc5da878c0.exe (PID: 4060)
      • Sality.aa.19e1c7f135f68a611774b74fdde7c654.exe (PID: 840)
      • Sality.aa.29f7a632ac271d2f9f38244359cc1422.exe (PID: 3992)
      • Sality.a.4575f1b529a64524ea52b160bb8fc08f.exe (PID: 2596)
      • Renamer.r.b83f9d710264a26cbe2cd36a3de05088.exe (PID: 3496)
      • Hidrag.a.d99ccff80df6a7f290fdeeed1b341ae5.exe (PID: 1752)
      • svchost.exe (PID: 2888)
      • svchost.exe (PID: 2480)
      • WinSit.exe (PID: 1564)
      • Nimnul.c.cc58573c97ac19f61e1c2f36098061cf.exe (PID: 1400)
      • Neshta.a.4e2c76a133e445783fa00.exe (PID: 856)
      • Neshta.a.4e2c76a133e445783fa00.exe (PID: 3748)
      • svchost.com (PID: 1996)
      • Message For My Princess.scr (PID: 1284)
      • Message For My Princess.scr (PID: 2528)
      • NOTEPAD.EXE (PID: 3328)
      • NOTEPAD.EXE (PID: 2868)
      • notepad.exe (PID: 516)
      • svchost.com (PID: 3248)
      • svchost.com (PID: 128)
      • notepad.exe (PID: 3592)

    • Drops executable file immediately after starts

      • Explorer.EXE (PID: 740)
      • AutoRun.akw.346c9322bc80ff97e126a7a7c3836d31.exe (PID: 784)
      • Sality.ae.53a84290774665e9fcfc1576680c25c0.exe (PID: 988)
      • Pioneer.cz.58fab99607afc5da878c0.exe (PID: 4060)
      • Sality.a.4575f1b529a64524ea52b160bb8fc08f.exe (PID: 2596)
      • Hidrag.a.d99ccff80df6a7f290fdeeed1b341ae5.exe (PID: 1752)
      • Hidrag.a.d99ccff80df6a7f290fdeeed1b341ae5.exe (PID: 2340)
      • Nimnul.c.cc58573c97ac19f61e1c2f36098061cf.exe (PID: 1400)
      • Neshta.a.4e2c76a133e445783fa00.exe (PID: 856)

    • Changes the autorun value in the registry

      • red_conapi.exe (PID: 1780)
      • Renamer.k.73dff1c450ac7df11c7b3f7f3d261569.exe (PID: 2052)
      • Sality.ae.53a84290774665e9fcfc1576680c25c0.exe (PID: 988)
      • Fun.exe (PID: 3972)
      • dc.exe (PID: 3696)
      • SVIQ.EXE (PID: 380)
      • WinSit.exe (PID: 1564)
      • Renamer.r.b83f9d710264a26cbe2cd36a3de05088.exe (PID: 3496)
      • Message For My Princess.scr (PID: 1284)
      • Message For My Princess.scr (PID: 2528)

    • Writes to the hosts file

      • red_conapi.exe (PID: 1780)

    • Tries to delete the host file

      • red_conapi.exe (PID: 1780)

    • Changes firewall settings

      • Sality.gen.55a00c72391b2e89c4500.exe (PID: 376)

    • Application was injected by another process

      • Explorer.EXE (PID: 740)
      • taskeng.exe (PID: 632)
      • ctfmon.exe (PID: 1404)
      • Dwm.exe (PID: 928)
      • WerFault.exe (PID: 3564)
      • SearchProtocolHost.exe (PID: 3684)

    • Runs injected code in another process

      • Sality.gen.55a00c72391b2e89c4500.exe (PID: 376)

    • UAC/LUA settings modification

      • Sality.gen.55a00c72391b2e89c4500.exe (PID: 376)

    • Changes Security Center notification settings

      • Sality.gen.55a00c72391b2e89c4500.exe (PID: 376)

    • Changes the login/logoff helper path in the registry

      • Sality.ae.53a84290774665e9fcfc1576680c25c0.exe (PID: 988)
      • Fun.exe (PID: 3972)
      • SVIQ.EXE (PID: 380)
      • dc.exe (PID: 3696)
      • WinSit.exe (PID: 1564)

    • Loads dropped or rewritten executable

      • Pioneer.cz.58fab99607afc5da878c0.exe (PID: 4060)
      • Sality.a.4575f1b529a64524ea52b160bb8fc08f.~01 (PID: 320)
      • Sality.a.4575f1b529a64524ea52b160bb8fc08f.exe (PID: 2596)
      • Explorer.EXE (PID: 740)
      • Fun.exe (PID: 3972)
      • dc.exe (PID: 3696)
      • SVIQ.EXE (PID: 380)
      • Renamer.r.b83f9d710264a26cbe2cd36a3de05088.exe (PID: 3496)
      • DllHost.exe (PID: 308)
      • Hidrag.a.d99ccff80df6a7f290fdeeed1b341ae5.exe (PID: 2340)
      • explorer.exe (PID: 636)
      • Explorer.exe (PID: 3852)
      • WinSit.exe (PID: 1564)
      • DllHost.exe (PID: 3832)
      • ctfmon.exe (PID: 1404)
      • explorer.exe (PID: 2760)
      • Dwm.exe (PID: 928)
      • taskhost.exe (PID: 1280)
      • Sality.gen.55a00c72391b2e89c4500.exe (PID: 376)
      • conhost.exe (PID: 3392)
      • taskeng.exe (PID: 632)
      • red_conapi.exe (PID: 1780)
      • Renamer.k.73dff1c450ac7df11c7b3f7f3d261569.exe (PID: 2052)
      • WerFault.exe (PID: 2944)
      • Neshta.a.4e2c76a133e445783fa00.exe (PID: 856)
      • DllHost.exe (PID: 2076)
      • Hidrag.a.d99ccff80df6a7f290fdeeed1b341ae5.exe (PID: 2312)
      • NOTEPAD.EXE (PID: 3328)
      • NOTEPAD.EXE (PID: 2868)
      • Message For My Princess.scr (PID: 1284)
      • rundll32.exe (PID: 3512)
      • Message For My Princess.scr (PID: 2528)
      • DllHost.exe (PID: 2488)
      • explorer.exe (PID: 3836)
      • DllHost.exe (PID: 1056)
      • DllHost.exe (PID: 2084)
      • DllHost.exe (PID: 3948)
      • notepad.exe (PID: 516)
      • notepad.exe (PID: 3592)
      • conhost.exe (PID: 524)

    • Changes appearance of the explorer extensions

      • Renamer.r.b83f9d710264a26cbe2cd36a3de05088.exe (PID: 3496)
      • Message For My Princess.scr (PID: 2528)
      • Message For My Princess.scr (PID: 1284)

    • Turns off system restore

      • Renamer.r.b83f9d710264a26cbe2cd36a3de05088.exe (PID: 3496)
      • Message For My Princess.scr (PID: 1284)
      • Message For My Princess.scr (PID: 2528)

    • Runs app for hidden code execution

      • Hidrag.a.d99ccff80df6a7f290fdeeed1b341ae5.exe (PID: 2340)
      • svchost.com (PID: 128)

    • Loads the Task Scheduler COM API

      • explorer.exe (PID: 2760)

    • Connects to CnC server

      • Sality.gen.55a00c72391b2e89c4500.exe (PID: 376)

    • Changes settings of System certificates

      • Sality.gen.55a00c72391b2e89c4500.exe (PID: 376)

    • SALITY was detected

      • Sality.gen.55a00c72391b2e89c4500.exe (PID: 376)

  • SUSPICIOUS

    • Checks supported languages

      • WinRAR.exe (PID: 3472)
      • red_conapi.exe (PID: 1780)
      • AutoRun.akw.346c9322bc80ff97e126a7a7c3836d31.exe (PID: 784)
      • Renamer.k.73dff1c450ac7df11c7b3f7f3d261569.exe (PID: 2052)
      • Sality.gen.55a00c72391b2e89c4500.exe (PID: 376)
      • Sality.s.795c5088f67de4bfbf81fcbf8b0fea1f.exe (PID: 1144)
      • Sality.ae.53a84290774665e9fcfc1576680c25c0.exe (PID: 988)
      • Fun.exe (PID: 3972)
      • dc.exe (PID: 3696)
      • SVIQ.EXE (PID: 380)
      • Pioneer.cz.58fab99607afc5da878c0.exe (PID: 4060)
      • Sality.aa.29f7a632ac271d2f9f38244359cc1422.exe (PID: 3992)
      • Sality.aa.19e1c7f135f68a611774b74fdde7c654.exe (PID: 840)
      • Sality.a.4575f1b529a64524ea52b160bb8fc08f.~01 (PID: 320)
      • Renamer.r.b83f9d710264a26cbe2cd36a3de05088.exe (PID: 3496)
      • Sality.a.4575f1b529a64524ea52b160bb8fc08f.exe (PID: 2596)
      • svchost.exe (PID: 2480)
      • Hidrag.a.d99ccff80df6a7f290fdeeed1b341ae5.exe (PID: 2340)
      • Hidrag.a.d99ccff80df6a7f290fdeeed1b341ae5.exe (PID: 1752)
      • svchost.exe (PID: 2888)
      • WinSit.exe (PID: 1564)
      • conhost.exe (PID: 3392)
      • cmd.exe (PID: 1400)
      • Nimnul.c.cc58573c97ac19f61e1c2f36098061cf.exe (PID: 1400)
      • Neshta.a.4e2c76a133e445783fa00.exe (PID: 856)
      • Neshta.a.4e2c76a133e445783fa00.exe (PID: 3748)
      • Hidrag.a.d99ccff80df6a7f290fdeeed1b341ae5.exe (PID: 2312)
      • Message For My Princess.scr (PID: 1284)
      • Message For My Princess.scr (PID: 2528)
      • svchost.com (PID: 1996)
      • svchost.com (PID: 3248)
      • notepad.exe (PID: 516)
      • notepad.exe (PID: 3592)
      • svchost.com (PID: 128)
      • conhost.exe (PID: 524)
      • cmd.exe (PID: 3256)

    • Reads the computer name

      • AutoRun.akw.346c9322bc80ff97e126a7a7c3836d31.exe (PID: 784)
      • WinRAR.exe (PID: 3472)
      • red_conapi.exe (PID: 1780)
      • Sality.gen.55a00c72391b2e89c4500.exe (PID: 376)
      • Fun.exe (PID: 3972)
      • Pioneer.cz.58fab99607afc5da878c0.exe (PID: 4060)
      • Renamer.r.b83f9d710264a26cbe2cd36a3de05088.exe (PID: 3496)
      • svchost.exe (PID: 2480)
      • Hidrag.a.d99ccff80df6a7f290fdeeed1b341ae5.exe (PID: 2340)
      • svchost.exe (PID: 2888)
      • Neshta.a.4e2c76a133e445783fa00.exe (PID: 856)
      • Hidrag.a.d99ccff80df6a7f290fdeeed1b341ae5.exe (PID: 2312)
      • Message For My Princess.scr (PID: 2528)
      • Message For My Princess.scr (PID: 1284)

    • Creates files in the Windows directory

      • AutoRun.akw.346c9322bc80ff97e126a7a7c3836d31.exe (PID: 784)
      • Renamer.k.73dff1c450ac7df11c7b3f7f3d261569.exe (PID: 2052)
      • red_conapi.exe (PID: 1780)
      • Sality.ae.53a84290774665e9fcfc1576680c25c0.exe (PID: 988)
      • Sality.a.4575f1b529a64524ea52b160bb8fc08f.exe (PID: 2596)
      • Hidrag.a.d99ccff80df6a7f290fdeeed1b341ae5.exe (PID: 1752)
      • Renamer.r.b83f9d710264a26cbe2cd36a3de05088.exe (PID: 3496)
      • Neshta.a.4e2c76a133e445783fa00.exe (PID: 856)
      • svchost.com (PID: 1996)

    • Removes files from Windows directory

      • AutoRun.akw.346c9322bc80ff97e126a7a7c3836d31.exe (PID: 784)
      • red_conapi.exe (PID: 1780)
      • svchost.com (PID: 1996)
      • svchost.com (PID: 3248)
      • svchost.com (PID: 128)

    • Drops a file with too old compile date

      • WinRAR.exe (PID: 3472)
      • Explorer.EXE (PID: 740)
      • AutoRun.akw.346c9322bc80ff97e126a7a7c3836d31.exe (PID: 784)
      • Sality.ae.53a84290774665e9fcfc1576680c25c0.exe (PID: 988)
      • Sality.gen.55a00c72391b2e89c4500.exe (PID: 376)
      • Sality.a.4575f1b529a64524ea52b160bb8fc08f.exe (PID: 2596)
      • Renamer.r.b83f9d710264a26cbe2cd36a3de05088.exe (PID: 3496)
      • Hidrag.a.d99ccff80df6a7f290fdeeed1b341ae5.exe (PID: 1752)
      • Hidrag.a.d99ccff80df6a7f290fdeeed1b341ae5.exe (PID: 2340)
      • svchost.exe (PID: 2888)
      • Nimnul.c.cc58573c97ac19f61e1c2f36098061cf.exe (PID: 1400)
      • Neshta.a.4e2c76a133e445783fa00.exe (PID: 856)

    • Drops a file that was compiled in debug mode

      • Explorer.EXE (PID: 740)
      • WinRAR.exe (PID: 3472)
      • Sality.gen.55a00c72391b2e89c4500.exe (PID: 376)
      • Nimnul.c.cc58573c97ac19f61e1c2f36098061cf.exe (PID: 1400)
      • Neshta.a.4e2c76a133e445783fa00.exe (PID: 856)
      • explorer.exe (PID: 2760)
      • Sality.a.4575f1b529a64524ea52b160bb8fc08f.exe (PID: 2596)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3472)
      • AutoRun.akw.346c9322bc80ff97e126a7a7c3836d31.exe (PID: 784)
      • Renamer.k.73dff1c450ac7df11c7b3f7f3d261569.exe (PID: 2052)
      • Sality.ae.53a84290774665e9fcfc1576680c25c0.exe (PID: 988)
      • Pioneer.cz.58fab99607afc5da878c0.exe (PID: 4060)
      • Sality.gen.55a00c72391b2e89c4500.exe (PID: 376)
      • Sality.a.4575f1b529a64524ea52b160bb8fc08f.exe (PID: 2596)
      • Renamer.r.b83f9d710264a26cbe2cd36a3de05088.exe (PID: 3496)
      • Hidrag.a.d99ccff80df6a7f290fdeeed1b341ae5.exe (PID: 1752)
      • Hidrag.a.d99ccff80df6a7f290fdeeed1b341ae5.exe (PID: 2340)
      • svchost.exe (PID: 2888)
      • Nimnul.c.cc58573c97ac19f61e1c2f36098061cf.exe (PID: 1400)
      • Neshta.a.4e2c76a133e445783fa00.exe (PID: 856)
      • explorer.exe (PID: 2760)

    • Reads Microsoft Outlook installation path

      • red_conapi.exe (PID: 1780)

    • Reads internet explorer settings

      • red_conapi.exe (PID: 1780)

    • Creates files in the driver directory

      • red_conapi.exe (PID: 1780)

    • Starts itself from another location

      • Sality.ae.53a84290774665e9fcfc1576680c25c0.exe (PID: 988)
      • Fun.exe (PID: 3972)

    • Creates files in the program directory

      • Pioneer.cz.58fab99607afc5da878c0.exe (PID: 4060)
      • WerFault.exe (PID: 3564)
      • WerFault.exe (PID: 2944)

    • Starts application with an unusual extension

      • Sality.a.4575f1b529a64524ea52b160bb8fc08f.exe (PID: 2596)
      • explorer.exe (PID: 2760)
      • rundll32.exe (PID: 3512)

    • Creates files in the user directory

      • Renamer.r.b83f9d710264a26cbe2cd36a3de05088.exe (PID: 3496)
      • Sality.gen.55a00c72391b2e89c4500.exe (PID: 376)

    • Creates executable files which already exist in Windows

      • Hidrag.a.d99ccff80df6a7f290fdeeed1b341ae5.exe (PID: 1752)
      • Renamer.r.b83f9d710264a26cbe2cd36a3de05088.exe (PID: 3496)

    • Executed as Windows Service

      • svchost.exe (PID: 2888)

    • Writes to a desktop.ini file (may be used to cloak folders)

      • Renamer.r.b83f9d710264a26cbe2cd36a3de05088.exe (PID: 3496)

    • Executed via COM

      • explorer.exe (PID: 636)

    • Starts CMD.EXE for commands execution

      • Hidrag.a.d99ccff80df6a7f290fdeeed1b341ae5.exe (PID: 2340)
      • svchost.com (PID: 128)

    • Reads the date of Windows installation

      • explorer.exe (PID: 2760)
      • Message For My Princess.scr (PID: 2528)
      • Message For My Princess.scr (PID: 1284)

    • Reads default file associations for system extensions

      • explorer.exe (PID: 2760)

    • Changes default file association

      • Neshta.a.4e2c76a133e445783fa00.exe (PID: 856)

    • Uses RUNDLL32.EXE to load library

      • explorer.exe (PID: 2760)

    • Adds / modifies Windows certificates

      • Sality.gen.55a00c72391b2e89c4500.exe (PID: 376)

  • INFO

    • Manual execution by user

      • AutoRun.akw.346c9322bc80ff97e126a7a7c3836d31.exe (PID: 784)
      • Renamer.k.73dff1c450ac7df11c7b3f7f3d261569.exe (PID: 2052)
      • Sality.gen.55a00c72391b2e89c4500.exe (PID: 376)
      • Sality.s.795c5088f67de4bfbf81fcbf8b0fea1f.exe (PID: 1144)
      • Sality.ae.53a84290774665e9fcfc1576680c25c0.exe (PID: 988)
      • Pioneer.cz.58fab99607afc5da878c0.exe (PID: 472)
      • Pioneer.cz.58fab99607afc5da878c0.exe (PID: 4060)
      • Sality.aa.29f7a632ac271d2f9f38244359cc1422.exe (PID: 3992)
      • Sality.aa.19e1c7f135f68a611774b74fdde7c654.exe (PID: 840)
      • Sality.a.4575f1b529a64524ea52b160bb8fc08f.exe (PID: 2596)
      • Renamer.r.b83f9d710264a26cbe2cd36a3de05088.exe (PID: 3496)
      • Hidrag.a.d99ccff80df6a7f290fdeeed1b341ae5.exe (PID: 1752)
      • SearchProtocolHost.exe (PID: 3324)
      • SearchFilterHost.exe (PID: 2724)

    • Checks supported languages

      • taskhost.exe (PID: 1280)
      • WerFault.exe (PID: 3564)
      • DllHost.exe (PID: 308)
      • Explorer.exe (PID: 3852)
      • explorer.exe (PID: 636)
      • DllHost.exe (PID: 3832)
      • explorer.exe (PID: 2760)
      • SearchProtocolHost.exe (PID: 3684)
      • WerFault.exe (PID: 2944)
      • SearchFilterHost.exe (PID: 3472)
      • DllHost.exe (PID: 2076)
      • rundll32.exe (PID: 3512)
      • NOTEPAD.EXE (PID: 3328)
      • NOTEPAD.EXE (PID: 2868)
      • explorer.exe (PID: 3836)
      • DllHost.exe (PID: 2488)
      • DllHost.exe (PID: 1056)
      • DllHost.exe (PID: 2084)
      • DllHost.exe (PID: 3948)
      • SearchProtocolHost.exe (PID: 3324)
      • SearchFilterHost.exe (PID: 2724)

    • Reads the computer name

      • WerFault.exe (PID: 3564)
      • DllHost.exe (PID: 308)
      • Explorer.exe (PID: 3852)
      • explorer.exe (PID: 636)
      • DllHost.exe (PID: 3832)
      • explorer.exe (PID: 2760)
      • SearchProtocolHost.exe (PID: 3684)
      • WerFault.exe (PID: 2944)
      • SearchFilterHost.exe (PID: 3472)
      • DllHost.exe (PID: 2076)
      • rundll32.exe (PID: 3512)
      • explorer.exe (PID: 3836)
      • DllHost.exe (PID: 1056)
      • DllHost.exe (PID: 2488)
      • DllHost.exe (PID: 2084)
      • DllHost.exe (PID: 3948)
      • SearchFilterHost.exe (PID: 2724)
      • SearchProtocolHost.exe (PID: 3324)

    • Dropped object may contain Bitcoin addresses

      • WerFault.exe (PID: 3564)

    • Reads Microsoft Office registry keys

      • Hidrag.a.d99ccff80df6a7f290fdeeed1b341ae5.exe (PID: 2340)
      • explorer.exe (PID: 2760)

    • Reads settings of System Certificates

      • Sality.gen.55a00c72391b2e89c4500.exe (PID: 376)

    • Checks Windows Trust Settings

      • Sality.gen.55a00c72391b2e89c4500.exe (PID: 376)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0001
ZipCompression: None
ZipModifyDate: 2019:12:30 01:13:19
ZipCRC: 0xec5a7f51
ZipCompressedSize: 129346
ZipUncompressedSize: 129346
ZipFileName: AutoRun.akw.346c9322bc80ff97e126a7a7c3836d31.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
117
Monitored processes
62
Malicious processes
27
Suspicious processes
7

Behavior graph

Click at the process to see the details
start start drop and start inject inject inject inject inject drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start winrar.exe autorun.akw.346c9322bc80ff97e126a7a7c3836d31.exe red_conapi.exe renamer.k.73dff1c450ac7df11c7b3f7f3d261569.exe #SALITY sality.gen.55a00c72391b2e89c4500.exe taskeng.exe dwm.exe explorer.exe ctfmon.exe sality.s.795c5088f67de4bfbf81fcbf8b0fea1f.exe sality.ae.53a84290774665e9fcfc1576680c25c0.exe fun.exe sviq.exe dc.exe pioneer.cz.58fab99607afc5da878c0.exe no specs pioneer.cz.58fab99607afc5da878c0.exe sality.aa.29f7a632ac271d2f9f38244359cc1422.exe sality.aa.19e1c7f135f68a611774b74fdde7c654.exe werfault.exe sality.a.4575f1b529a64524ea52b160bb8fc08f.exe sality.a.4575f1b529a64524ea52b160bb8fc08f.~01 no specs renamer.r.b83f9d710264a26cbe2cd36a3de05088.exe Thumbnail Cache Class Factory for Out of Proc Server no specs hidrag.a.d99ccff80df6a7f290fdeeed1b341ae5.exe svchost.exe no specs hidrag.a.d99ccff80df6a7f290fdeeed1b341ae5.exe svchost.exe explorer.exe no specs explorer.exe no specs winsit.exe Thumbnail Cache Class Factory for Out of Proc Server no specs cmd.exe no specs conhost.exe no specs explorer.exe taskhost.exe no specs searchprotocolhost.exe nimnul.c.cc58573c97ac19f61e1c2f36098061cf.exe werfault.exe no specs neshta.a.4e2c76a133e445783fa00.exe neshta.a.4e2c76a133e445783fa00.exe no specs searchfilterhost.exe no specs Thumbnail Cache Class Factory for Out of Proc Server no specs hidrag.a.d99ccff80df6a7f290fdeeed1b341ae5.exe no specs rundll32.exe no specs message for my princess.scr notepad.exe no specs message for my princess.scr notepad.exe no specs svchost.com no specs explorer.exe no specs Thumbnail Cache Class Factory for Out of Proc Server no specs DllHost.exe no specs Thumbnail Cache Out of Proc Server no specs Thumbnail Cache Class Factory for Out of Proc Server no specs searchprotocolhost.exe no specs searchfilterhost.exe no specs svchost.com no specs notepad.exe no specs notepad.exe no specs svchost.com no specs cmd.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3472"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Virus Infection.zip"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
784"C:\Users\admin\Desktop\AutoRun.akw.346c9322bc80ff97e126a7a7c3836d31.exe" C:\Users\admin\Desktop\AutoRun.akw.346c9322bc80ff97e126a7a7c3836d31.exe
Explorer.EXE
User:
admin
Integrity Level:
HIGH
Exit code:
0
1780"C:\Windows\system\red_conapi.exe" C:\Windows\system\red_conapi.exe
AutoRun.akw.346c9322bc80ff97e126a7a7c3836d31.exe
User:
admin
Company:
Cronograma
Integrity Level:
HIGH
Version:
1.00
2052"C:\Users\admin\Desktop\Renamer.k.73dff1c450ac7df11c7b3f7f3d261569.exe" C:\Users\admin\Desktop\Renamer.k.73dff1c450ac7df11c7b3f7f3d261569.exe
Explorer.EXE
User:
admin
Integrity Level:
HIGH
376"C:\Users\admin\Desktop\Sality.gen.55a00c72391b2e89c4500.exe" C:\Users\admin\Desktop\Sality.gen.55a00c72391b2e89c4500.exe
Explorer.EXE
User:
admin
Company:
Tonec Inc.
Integrity Level:
HIGH
Description:
Internet Download Manager agent for click monitoring in IE-based browsers
Version:
6, 22, 1, 1
632taskeng.exe {54738773-C509-4DB9-AC49-6F558536DDDE}C:\Windows\system32\taskeng.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Engine
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
928"C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Desktop Window Manager
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
740C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1404C:\Windows\System32\ctfmon.exe C:\Windows\System32\ctfmon.exe
taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
CTF Loader
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1144"C:\Users\admin\Desktop\Sality.s.795c5088f67de4bfbf81fcbf8b0fea1f.exe" C:\Users\admin\Desktop\Sality.s.795c5088f67de4bfbf81fcbf8b0fea1f.exe
Explorer.EXE
User:
admin
Company:
Nokia Mobile Phones Ltd.
Integrity Level:
HIGH
Description:
PPC Report Application
Exit code:
0
Version:
01.01.003
Total events
41 033
Read events
35 662
Write events
0
Delete events
0

Modification events

No data
Executable files
93
Suspicious files
10
Text files
46
Unknown types
4

Dropped files

PID
Process
Filename
Type
3472WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3472.16976\Renamer.h.f6b1d9829e787805d5f4c096350e8cfc.exeexecutable
MD5:F6B1D9829E787805D5F4C096350E8CFC
SHA256:D590E77F2B9F45FFE1C0E28A44105B6A50DDA63865A07D11F77147E154931946
3472WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3472.16976\Neshta.a.4e2c76a133e445783fa00.exeexecutable
MD5:05B931C1C704E2C76A133E445783FA00
SHA256:26F3239EFEEE13EF98DC6395298CBC943E45F246CE73F7D138D3E787E782E26A
3472WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3472.16976\Renamer.k.73dff1c450ac7df11c7b3f7f3d261569.exeexecutable
MD5:73DFF1C450AC7DF11C7B3F7F3D261569
SHA256:910661D15113E1BB4FA8A7C819D54EE0B6969DA73B1FBCB414D6199032528BE7
3472WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3472.16976\Sality.aa.19e1c7f135f68a611774b74fdde7c654.exeexecutable
MD5:19E1C7F135F68A611774B74FDDE7C654
SHA256:7A7FDC74AD34EEBBA03EF14210B82F3DE575780AF9BE06B13B4BAA2ECDE37BB5
3472WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3472.16976\Sality.s.795c5088f67de4bfbf81fcbf8b0fea1f.exeexecutable
MD5:795C5088F67DE4BFBF81FCBF8B0FEA1F
SHA256:E34A59CFA956FB35C201BEAD3B4D78521CC78EDB86F4455BC1CFED820290608F
740Explorer.EXEC:\Users\admin\Desktop\Hidrag.a.d99ccff80df6a7f290fdeeed1b341ae5.exeexecutable
MD5:D99CCFF80DF6A7F290FDEEED1B341AE5
SHA256:E9EF7A854CB2E8594B72CF273AAC8B9576A4760643BBC0F8F09D505B02CE7C69
3472WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3472.16976\AutoRun.akw.346c9322bc80ff97e126a7a7c3836d31.exeexecutable
MD5:346C9322BC80FF97E126A7A7C3836D31
SHA256:FE0023D84CFEFBE4A8F22E7C9E3CFA35B64F2CBCCFE5C7A0C4CC6502CE49CB70
3472WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3472.16976\Sality.aa.29f7a632ac271d2f9f38244359cc1422.exeexecutable
MD5:29F7A632AC271D2F9F38244359CC1422
SHA256:F8B85EFE253A4A3CA7885F0AB9785EB07DA338064D0580EBB9CC7CC85EAB7A56
740Explorer.EXEC:\Users\admin\Desktop\Nimnul.c.cc58573c97ac19f61e1c2f36098061cf.exeexecutable
MD5:CC58573C97AC19F61E1C2F36098061CF
SHA256:F07692154642AFBF01F12081E7DC6C124B80D2C5A80BA164534E81385945C4B1
3472WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3472.16976\Sality.a.4575f1b529a64524ea52b160bb8fc08f.exeexecutable
MD5:4575F1B529A64524EA52B160BB8FC08F
SHA256:F63D716BBA0290D410C0CF83C9CD8450B970F6AA0C31D9220EE18E3BB2C2E389
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
21
TCP/UDP connections
228
DNS requests
30
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
376
Sality.gen.55a00c72391b2e89c4500.exe
GET
—
94.101.91.137:80
http://www.ledyazilim.com/logo.gif?149912=5399624
TR
—
—
malicious
376
Sality.gen.55a00c72391b2e89c4500.exe
GET
200
173.231.189.15:80
http://ksandrafashion.com/logo.gif?150e90=5519936
US
—
—
malicious
1780
red_conapi.exe
GET
200
97.74.42.79:80
http://artistlegion.com/modules/readme_NT.txt
US
html
1.54 Kb
malicious
1780
red_conapi.exe
GET
200
97.74.42.79:80
http://artistlegion.com/modules/readme_NT.txt
US
html
1.54 Kb
malicious
376
Sality.gen.55a00c72391b2e89c4500.exe
GET
301
68.66.226.85:80
http://toalladepapel.com.ar/images/logo.gif?15117e=11045872
US
—
—
malicious
376
Sality.gen.55a00c72391b2e89c4500.exe
GET
200
199.59.243.200:80
http://www.lafyeri.com/images/logo.gif?150fa9=8281590
US
html
1.33 Kb
malicious
376
Sality.gen.55a00c72391b2e89c4500.exe
GET
200
206.189.61.126:80
http://kulppasur.com/logo.gif?1510d2=4141686
US
—
—
malicious
376
Sality.gen.55a00c72391b2e89c4500.exe
GET
200
63.251.106.25:80
http://koonadance2.com/images/logo.gif?15219b=13848590
US
—
—
malicious
376
Sality.gen.55a00c72391b2e89c4500.exe
GET
200
104.18.30.182:80
http://ocsp.comodoca.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEQDwHUvue3yjezwFZqwFlyRY
US
der
728 b
whitelisted
376
Sality.gen.55a00c72391b2e89c4500.exe
GET
200
63.251.106.25:80
http://www.ecole-saint-simon.net/index_top/logo.gif?151edc=9689092
US
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1780
red_conapi.exe
142.250.186.132:80
www.google.com
Google Inc.
US
whitelisted
1780
red_conapi.exe
162.241.217.189:80
www.interneland.com
CyrusOne LLC
US
suspicious
1780
red_conapi.exe
97.74.42.79:80
artistlegion.com
GoDaddy.com, LLC
US
malicious
—
—
142.250.186.132:80
www.google.com
Google Inc.
US
whitelisted
376
Sality.gen.55a00c72391b2e89c4500.exe
94.101.91.137:80
www.ledyazilim.com
Radore Veri Merkezi Hizmetleri A.S.
TR
malicious
376
Sality.gen.55a00c72391b2e89c4500.exe
173.231.189.15:80
ksandrafashion.com
Voxel Dot Net, Inc.
US
malicious
376
Sality.gen.55a00c72391b2e89c4500.exe
104.18.30.182:80
ocsp.comodoca.com
Cloudflare Inc
US
suspicious
376
Sality.gen.55a00c72391b2e89c4500.exe
2.16.186.56:80
ctldl.windowsupdate.com
Akamai International B.V.
—
whitelisted
376
Sality.gen.55a00c72391b2e89c4500.exe
206.189.61.126:80
kulppasur.com
—
US
malicious
376
Sality.gen.55a00c72391b2e89c4500.exe
199.59.243.200:80
www.lafyeri.com
—
US
malicious

DNS requests

Domain
IP
Reputation
www.google.com
  • 142.250.186.132
whitelisted
www.industriaboston.com
  • —
unknown
artistlegion.com
  • 97.74.42.79
malicious
www.interneland.com
  • 162.241.217.189
suspicious
pagansoftheworld.com
  • —
unknown
www.beetzy.net
  • —
unknown
www.google-analytics.com
  • 142.250.185.142
whitelisted
dns.msftncsi.com
  • 131.107.255.255
shared
www.ledyazilim.com
  • 94.101.91.137
malicious
ksandrafashion.com
  • 173.231.189.15
malicious

Threats

PID
Process
Class
Message
1780
red_conapi.exe
A Network Trojan was detected
AV USER_AGENTS Suspicious User-Agent (vb wininet)
1780
red_conapi.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
1780
red_conapi.exe
A Network Trojan was detected
AV USER_AGENTS Suspicious User-Agent (vb wininet)
1780
red_conapi.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
1780
red_conapi.exe
A Network Trojan was detected
AV USER_AGENTS Suspicious User-Agent (vb wininet)
1780
red_conapi.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
1780
red_conapi.exe
A Network Trojan was detected
AV USER_AGENTS Suspicious User-Agent (vb wininet)
1780
red_conapi.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
1780
red_conapi.exe
A Network Trojan was detected
AV USER_AGENTS Suspicious User-Agent (vb wininet)
1780
red_conapi.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Virus Infection.zip