File name:

Worm.Win32.Autorun.pi.zip

Full analysis: https://app.any.run/tasks/d8b51d8d-8ace-4664-80d9-5647a9d2d5ed
Verdict: Malicious activity
Analysis date: December 04, 2023, 17:55:21
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

9A283DE90515D78F5523372412E0228E

SHA1:

2EC1F4F55CB9D89EC3251F9636700056E27AED8A

SHA256:

71FAA19A0FA3035460BD56AE7BE9F46C765A433F9666A8249CC6AD4712369942

SSDEEP:

24576:H9qVXua9jlQVTqLDvoCb0Em/xZRVTtkiVULnCh3Mh42Tymle7Bgn6A2HG2:HAVXua9jlQVTqLDoCQEmJZRVTtkiVULw

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Worm.Win32.Autorun.pi.exe (PID: 1936)
      • wisvf.exe (PID: 1608)
      • adwya.exe (PID: 3112)

    • Creates a writable file in the system directory

      • Worm.Win32.Autorun.pi.exe (PID: 1936)
      • adwya.exe (PID: 3112)

    • Changes firewall settings

      • Worm.Win32.Autorun.pi.exe (PID: 1936)
      • wisvf.exe (PID: 1608)
      • wlnoy.exe (PID: 3344)
      • adwya.exe (PID: 3112)
      • xczbz.exe (PID: 240)
      • rkyjj.exe (PID: 1844)
      • fzxxh.exe (PID: 2996)

    • Changes the autorun value in the registry

      • wisvf.exe (PID: 1608)
      • rkyjj.exe (PID: 1844)
      • adwya.exe (PID: 3112)
      • fzxxh.exe (PID: 2996)
      • xczbz.exe (PID: 240)
      • wlnoy.exe (PID: 3344)
      • xczbz.exe (PID: 2128)
      • fzxxh.exe (PID: 2076)
      • wlnoy.exe (PID: 2084)
      • rkyjj.exe (PID: 2100)
      • wisvf.exe (PID: 2064)
      • adwya.exe (PID: 2120)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 2412)
      • Worm.Win32.Autorun.pi.exe (PID: 1936)
      • wisvf.exe (PID: 1608)
      • adwya.exe (PID: 3112)

    • Starts itself from another location

      • Worm.Win32.Autorun.pi.exe (PID: 1936)
      • wisvf.exe (PID: 1608)
      • adwya.exe (PID: 3112)

    • Reads the Internet Settings

      • sipnotify.exe (PID: 1704)

    • The process executes via Task Scheduler

      • sipnotify.exe (PID: 1704)
      • ctfmon.exe (PID: 1612)

    • Reads settings of System Certificates

      • sipnotify.exe (PID: 1704)

  • INFO

    • Reads Microsoft Office registry keys

      • Worm.Win32.Autorun.pi.exe (PID: 1936)
      • wisvf.exe (PID: 1608)
      • adwya.exe (PID: 3112)
      • rkyjj.exe (PID: 1844)
      • fzxxh.exe (PID: 2996)
      • xczbz.exe (PID: 240)
      • wlnoy.exe (PID: 3344)
      • fzxxh.exe (PID: 2076)
      • wlnoy.exe (PID: 2084)
      • wisvf.exe (PID: 2064)
      • xczbz.exe (PID: 2128)
      • rkyjj.exe (PID: 2100)
      • adwya.exe (PID: 2120)

    • Manual execution by a user

      • Worm.Win32.Autorun.pi.exe (PID: 1936)
      • IMEKLMG.EXE (PID: 2040)
      • IMEKLMG.EXE (PID: 1068)
      • wisvf.exe (PID: 2064)
      • wlnoy.exe (PID: 2084)
      • rkyjj.exe (PID: 2100)
      • fzxxh.exe (PID: 2076)
      • adwya.exe (PID: 2120)
      • xczbz.exe (PID: 2128)
      • wmpnscfg.exe (PID: 2364)
      • wmpnscfg.exe (PID: 2408)

    • Create files in a temporary directory

      • Worm.Win32.Autorun.pi.exe (PID: 1936)
      • wisvf.exe (PID: 1608)
      • adwya.exe (PID: 3112)
      • wlnoy.exe (PID: 3344)
      • rkyjj.exe (PID: 1844)
      • xczbz.exe (PID: 240)
      • wisvf.exe (PID: 2064)
      • fzxxh.exe (PID: 2076)
      • wlnoy.exe (PID: 2084)
      • rkyjj.exe (PID: 2100)
      • adwya.exe (PID: 2120)
      • fzxxh.exe (PID: 2996)
      • xczbz.exe (PID: 2128)

    • Checks supported languages

      • Worm.Win32.Autorun.pi.exe (PID: 1936)
      • wisvf.exe (PID: 1608)
      • adwya.exe (PID: 3112)
      • wlnoy.exe (PID: 3344)
      • rkyjj.exe (PID: 1844)
      • fzxxh.exe (PID: 2996)
      • xczbz.exe (PID: 240)
      • IMEKLMG.EXE (PID: 2040)
      • IMEKLMG.EXE (PID: 1068)
      • wisvf.exe (PID: 2064)
      • wlnoy.exe (PID: 2084)
      • fzxxh.exe (PID: 2076)
      • xczbz.exe (PID: 2128)
      • rkyjj.exe (PID: 2100)
      • adwya.exe (PID: 2120)
      • wmpnscfg.exe (PID: 2364)
      • wmpnscfg.exe (PID: 2408)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 2412)

    • Reads the machine GUID from the registry

      • Worm.Win32.Autorun.pi.exe (PID: 1936)
      • wisvf.exe (PID: 1608)
      • adwya.exe (PID: 3112)
      • rkyjj.exe (PID: 1844)
      • wlnoy.exe (PID: 3344)
      • fzxxh.exe (PID: 2996)
      • xczbz.exe (PID: 240)
      • fzxxh.exe (PID: 2076)
      • wisvf.exe (PID: 2064)
      • wlnoy.exe (PID: 2084)
      • rkyjj.exe (PID: 2100)
      • xczbz.exe (PID: 2128)
      • adwya.exe (PID: 2120)

    • Reads mouse settings

      • Worm.Win32.Autorun.pi.exe (PID: 1936)
      • wisvf.exe (PID: 1608)
      • adwya.exe (PID: 3112)
      • fzxxh.exe (PID: 2996)
      • rkyjj.exe (PID: 1844)
      • wlnoy.exe (PID: 3344)
      • xczbz.exe (PID: 2128)
      • adwya.exe (PID: 2120)
      • rkyjj.exe (PID: 2100)
      • wlnoy.exe (PID: 2084)
      • fzxxh.exe (PID: 2076)
      • wisvf.exe (PID: 2064)
      • xczbz.exe (PID: 240)

    • Creates files in the program directory

      • Worm.Win32.Autorun.pi.exe (PID: 1936)

    • Reads the computer name

      • wisvf.exe (PID: 1608)
      • IMEKLMG.EXE (PID: 2040)
      • IMEKLMG.EXE (PID: 1068)
      • wisvf.exe (PID: 2064)
      • wmpnscfg.exe (PID: 2408)
      • wmpnscfg.exe (PID: 2364)

    • Process checks are UAC notifies on

      • IMEKLMG.EXE (PID: 2040)
      • IMEKLMG.EXE (PID: 1068)

    • Reads security settings of Internet Explorer

      • sipnotify.exe (PID: 1704)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2023:02:06 01:02:44
ZipCRC: 0xb97fd45e
ZipCompressedSize: 473521
ZipUncompressedSize: 1070232
ZipFileName: MSCOMCTL.OCX
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
102
Monitored processes
20
Malicious processes
14
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs worm.win32.autorun.pi.exe wisvf.exe adwya.exe wlnoy.exe rkyjj.exe fzxxh.exe xczbz.exe ctfmon.exe no specs sipnotify.exe imeklmg.exe no specs imeklmg.exe no specs wisvf.exe fzxxh.exe wlnoy.exe rkyjj.exe adwya.exe xczbz.exe wmpnscfg.exe no specs wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
240c:\windows\system32\xczbz.exeC:\Windows\System32\xczbz.exe
adwya.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
5.2.3790.0 (srv03_rtm.030324-2048)
Exit code:
1073807364
Version:
1.00.0019
Modules
Images
c:\windows\system32\xczbz.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1068"C:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE" /SetPreload /KOR /LogC:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office IME 2010
Exit code:
1
Version:
14.0.4734.1000
Modules
Images
c:\program files\common files\microsoft shared\ime14\shared\imeklmg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\userenv.dll
1608c:\windows\system32\wisvf.exeC:\Windows\System32\wisvf.exe
Worm.Win32.Autorun.pi.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
5.2.3790.0 (srv03_rtm.030324-2048)
Exit code:
1073807364
Version:
1.00.0019
Modules
Images
c:\windows\system32\wisvf.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1612C:\Windows\System32\ctfmon.exe C:\Windows\System32\ctfmon.exe—taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
CTF Loader
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ctfmon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msctfmonitor.dll
c:\windows\system32\msctf.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
1704C:\Windows\system32\sipnotify.exe -LogonOrUnlockC:\Windows\System32\sipnotify.exe
taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
sipnotify
Exit code:
0
Version:
6.1.7602.20480 (win7sp1_ldr_escrow.191010-1716)
Modules
Images
c:\windows\system32\sipnotify.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1844"c:\program files\common files\rkyjj.exe"C:\Program Files\common files\rkyjj.exe
Worm.Win32.Autorun.pi.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
5.2.3790.0 (srv03_rtm.030324-2048)
Exit code:
1073807364
Version:
1.00.0019
Modules
Images
c:\program files\common files\rkyjj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1936"C:\Users\admin\Desktop\Worm.Win32.Autorun.pi.exe" C:\Users\admin\Desktop\Worm.Win32.Autorun.pi.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
5.2.3790.0 (srv03_rtm.030324-2048)
Exit code:
0
Version:
1.00.0019
Modules
Images
c:\users\admin\desktop\worm.win32.autorun.pi.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2040"C:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE" /SetPreload /JPN /LogC:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office IME 2010
Exit code:
1
Version:
14.0.4734.1000
Modules
Images
c:\program files\common files\microsoft shared\ime14\shared\imeklmg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\userenv.dll
2064"C:\Windows\System32\wisvf.exe" C:\Windows\System32\wisvf.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
5.2.3790.0 (srv03_rtm.030324-2048)
Exit code:
0
Version:
1.00.0019
Modules
Images
c:\windows\system32\wisvf.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2076"C:\Windows\system\fzxxh.exe" C:\Windows\system\fzxxh.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
5.2.3790.0 (srv03_rtm.030324-2048)
Exit code:
0
Version:
1.00.0019
Modules
Images
c:\windows\system\fzxxh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
Total events
20 787
Read events
20 663
Write events
124
Delete events
0

Modification events

(PID) Process:(2412) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2412) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2412) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2412) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(2412) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2412) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2412) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2412) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2412) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
(PID) Process:(2412) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\General
Operation:writeName:LastFolder
Value:
C:\Users\admin\Desktop
Executable files
8
Suspicious files
8
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
1608wisvf.exeC:\windows\system\fzxxh.exeexecutable
MD5:BEE2D7595B1A0E7F6B03585226B37AE7
SHA256:A1B86391CFA945BB5BBFD0C8A3EA8B66CFD78194A5DA175B86CF6827534DA915
1936Worm.Win32.Autorun.pi.exeC:\windows\inf\adwya.exeexecutable
MD5:BEE2D7595B1A0E7F6B03585226B37AE7
SHA256:A1B86391CFA945BB5BBFD0C8A3EA8B66CFD78194A5DA175B86CF6827534DA915
2412WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2412.2282\Worm.Win32.Autorun.pi.exeexecutable
MD5:BEE2D7595B1A0E7F6B03585226B37AE7
SHA256:A1B86391CFA945BB5BBFD0C8A3EA8B66CFD78194A5DA175B86CF6827534DA915
1936Worm.Win32.Autorun.pi.exeC:\Users\admin\AppData\Local\Temp\~DF142A8D242BBCA6B6.TMPbinary
MD5:2161A3FFBEBB81CFF21DA7A7E5CBB945
SHA256:6F1FF0A6A3136AC836A583810DE4F731D6468AE9AACF8B1B393740733915A0DD
1844rkyjj.exeC:\Users\admin\AppData\Local\Temp\~DF8C115B6D45078621.TMPbinary
MD5:DD87748AD723F4AA899EC6C375855A6C
SHA256:1E2054F6F258B804A93D934D8AC4BC178D01680DC3D5D341F5AB8A51648B6332
1936Worm.Win32.Autorun.pi.exeC:\windows\system32\wisvf.exeexecutable
MD5:BEE2D7595B1A0E7F6B03585226B37AE7
SHA256:A1B86391CFA945BB5BBFD0C8A3EA8B66CFD78194A5DA175B86CF6827534DA915
1704sipnotify.exeC:\Users\admin\AppData\Local\microsoft\windows\SipNotify\eoscontent\microsoft-logo.pngimage
MD5:B7C73A0CFBA68CC70C35EF9C63703CE4
SHA256:1D8B27A0266FF526CF95447F3701592A908848467D37C09A00A2516C1F29A013
1608wisvf.exeC:\windows\system32\Restore\04122023.kp_text
MD5:C77067E60345FF6383002AF85704816D
SHA256:251FB8F223A39EFF61094F69BB94E8A06A1756551EA051185135C3A1DF3DF4FF
1608wisvf.exeC:\windows\wlnoy.exeexecutable
MD5:BEE2D7595B1A0E7F6B03585226B37AE7
SHA256:A1B86391CFA945BB5BBFD0C8A3EA8B66CFD78194A5DA175B86CF6827534DA915
2412WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2412.2282\MSCOMCTL.OCXexecutable
MD5:273676426739B02A45A0FC9349500B65
SHA256:152121A5D1AC8F12002C18AFC294BB1EBCECC1D61DEEC6211DF586C11ACDE9B6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
8
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1704
sipnotify.exe
HEAD
200
104.102.39.173:80
http://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2JgkA?v=133461862032650000
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1704
sipnotify.exe
104.102.39.173:80
query.prod.cms.rt.microsoft.com
AKAMAI-AS
DE
unknown
1116
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

Domain
IP
Reputation
query.prod.cms.rt.microsoft.com
  • 104.102.39.173
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Worm.Win32.Autorun.pi.zip