analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

CXSplay.7z

Full analysis: https://app.any.run/tasks/5835b662-7e10-4a3d-9e89-8a24bdcafb24
Verdict: Malicious activity
Analysis date: July 18, 2019, 09:50:49
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

35AB59EA398C4161FBCAA3F71DCEC841

SHA1:

16FD4AB0C82CE369326AC3A547B5229355003B69

SHA256:

71F968BE37712D982777D9131DB833763BF2C98A64D4075045C36CE38EA0F83B

SSDEEP:

24576:ZzZbCqLbUAdvpKgkU1bHs1GycPWHPDO4y8pQXiweHDvoLaR:qq34TIbHVNJLX+ALy

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • CXSplay.exe (PID: 3468)
      • Server.exe (PID: 3148)
      • svchost.exe (PID: 2568)
      • svchost.exe (PID: 2828)
      • explorerr.exe (PID: 1464)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3384)
      • CXSplay.exe (PID: 3468)
      • Server.exe (PID: 3148)

    • Creates files in the Windows directory

      • Server.exe (PID: 3148)
      • CXSplay.exe (PID: 3468)

    • Creates executable files which already exist in Windows

      • Server.exe (PID: 3148)

    • Executed as Windows Service

      • svchost.exe (PID: 2828)

    • Application launched itself

      • svchost.exe (PID: 2828)

    • Creates or modifies windows services

      • Server.exe (PID: 3148)
      • svchost.exe (PID: 2568)

  • INFO

    • Manual execution by user

      • CXSplay.exe (PID: 3468)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
6
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start winrar.exe cxsplay.exe explorerr.exe no specs server.exe svchost.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
3384"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Downloads\CXSplay.7z"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
3468"C:\Users\admin\Desktop\CXSplay.exe" C:\Users\admin\Desktop\CXSplay.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
应用程序
Version:
1.0.0.0
1464C:\Windows\explorerr.exeC:\Windows\explorerr.exe—CXSplay.exe
User:
admin
Integrity Level:
HIGH
Description:
易语言程序
Version:
1.0.0.0
3148C:\Windows\Server.exeC:\Windows\Server.exe
CXSplay.exe
User:
admin
Integrity Level:
HIGH
Description:
5555 MFC Application
Exit code:
0
Version:
1, 0, 0, 1
2828C:\Windows\svchost.exeC:\Windows\svchost.exe
services.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Description:
5555 MFC Application
Exit code:
0
Version:
1, 0, 0, 1
2568C:\Windows\svchost.exe Win7C:\Windows\svchost.exe
svchost.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Description:
5555 MFC Application
Version:
1, 0, 0, 1
Total events
493
Read events
452
Write events
41
Delete events
0

Modification events

(PID) Process:(3384) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3384) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3384) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\70\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3384) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Downloads\CXSplay.7z
(PID) Process:(3384) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3384) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3384) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3384) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3384) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\DialogEditHistory\ExtrPath
Operation:writeName:0
Value:
C:\Users\admin\Desktop
(PID) Process:(3384) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
Executable files
7
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
3468CXSplay.exeC:\Users\admin\Desktop\1.dll —
MD5:—
SHA256:—
3468CXSplay.exeC:\Users\admin\AppData\Local\Temp\933359\TemporaryFile —
MD5:—
SHA256:—
3468CXSplay.exeC:\Windows\explorerr.exeexecutable
MD5:D8DB6DBCB2DBE9CDF084261A02EB615D
SHA256:924A5B0940F847701AB848D2B66636DDED4D5B2469ABEB40C910D329C31ECC83
3468CXSplay.exeC:\Users\admin\AppData\Local\Temp\933359\....\TemporaryFileexecutable
MD5:960A505759EF8CFA5AA6E8689D3E04BC
SHA256:0E201DB06D2E2E58A0600C631FB5DAB0DB328A339CCD2E623C0E1D9CE75ADAB7
3148Server.exeC:\Windows\svchost.exeexecutable
MD5:5DFB5C71F501AA9B006F8CB38D6DF7EC
SHA256:425BCBC612A2339965E845A039CDEC3180D101FED601CEC218E7DA9B48A6FD50
3468CXSplay.exeC:\Windows\Server.exeexecutable
MD5:5DFB5C71F501AA9B006F8CB38D6DF7EC
SHA256:425BCBC612A2339965E845A039CDEC3180D101FED601CEC218E7DA9B48A6FD50
3384WinRAR.exeC:\Users\admin\Desktop\CXSplay.exeexecutable
MD5:960A505759EF8CFA5AA6E8689D3E04BC
SHA256:0E201DB06D2E2E58A0600C631FB5DAB0DB328A339CCD2E623C0E1D9CE75ADAB7
3148Server.exeC:\Windows\system32\934421.bakexecutable
MD5:5DFB5C71F501AA9B006F8CB38D6DF7EC
SHA256:425BCBC612A2339965E845A039CDEC3180D101FED601CEC218E7DA9B48A6FD50
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
4
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

Domain
IP
Reputation
w1.zhexi.tech
  • —
unknown
localhost.ptlogin2.qq.com
  • —
unknown
2018.ip138.com
  • —
malicious

Threats

No threats detected
Process
Message
Server.exe
½øÈëDLLMain
svchost.exe
½øÈëDLLMain
svchost.exe
½øÈëDLLMain
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
CXSplay.7z