analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| File name: | YouAreAnIdiot.zip |
| Full analysis: | https://app.any.run/tasks/bb749f5b-3da3-4e76-b0e8-44c3c0697632 |
| Verdict: | Malicious activity |
| Analysis date: | October 06, 2020 at 19:16:07 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v2.0 to extract |
| MD5: | A28A0F1B07E59F42417E04918AA51E19 |
| SHA1: | 0340B2A4E662357E392189A11C5501018CB5813C |
| SHA256: | 73A5E67A4517A92E8D8ACD435B29794785B9EEBB78142AF11BDABF0A5D108F74 |
| SSDEEP: | 196608:Hz+5f7qBUC0zVwC6TknqFkz+5f7qBUC0zVwC6TknIFd:HJgVwC+FkJgVwC0Fd |
MALICIOUS
Application was dropped or rewritten from another process
- YouAreAnIdiot.exe (PID: 1340)
- YouAreAnIdiot.exe (PID: 2772)
Loads the Task Scheduler COM API
- CCleaner.exe (PID: 1044)
Task Manager has been disabled (taskmgr)
- YouAreAnIdiot.exe (PID: 2772)
Actions looks like stealing of personal data
- CCleaner.exe (PID: 2144)
SUSPICIOUS
Low-level read access rights to disk partition
- CCleaner.exe (PID: 2144)
Executed via Task Scheduler
- CCleaner.exe (PID: 2144)
Reads Internet Cache Settings
- CCleaner.exe (PID: 2144)
Reads internet explorer settings
- CCleaner.exe (PID: 2144)
Executable content was dropped or overwritten
- WinRAR.exe (PID: 116)
Creates files in the user directory
- CCleaner.exe (PID: 2144)
INFO
Reads settings of System Certificates
- CCleaner.exe (PID: 2144)
Manual execution by user
- CCleaner.exe (PID: 1044)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .zip | | | ZIP compressed archive (100) |
|---|
EXIF
ZIP
| ZipFileName: | Cop.bat |
|---|---|
| ZipUncompressedSize: | 106 |
| ZipCompressedSize: | 78 |
| ZipCRC: | 0xc9650401 |
| ZipModifyDate: | 2020:09:22 19:53:16 |
| ZipCompression: | Deflated |
| ZipBitFlag: | - |
| ZipRequiredVersion: | 20 |
Total processes
45
Monitored processes
5
Malicious processes
2
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 116 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\YouAreAnIdiot.zip" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 Modules
| |||||||||||||||
| 1340 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa116.12497\YouAreAnIdiot.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa116.12497\YouAreAnIdiot.exe | — | WinRAR.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: YouAreAnIdiot Exit code: 3221226540 Version: 1.0.0.0 Modules
| |||||||||||||||
| 2772 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa116.12497\YouAreAnIdiot.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa116.12497\YouAreAnIdiot.exe | WinRAR.exe | ||||||||||||
User: admin Integrity Level: HIGH Description: YouAreAnIdiot Version: 1.0.0.0 Modules
| |||||||||||||||
| 1044 | "C:\Program Files\CCleaner\CCleaner.exe" | C:\Program Files\CCleaner\CCleaner.exe | — | explorer.exe | |||||||||||
User: admin Company: Piriform Ltd Integrity Level: MEDIUM Description: CCleaner Exit code: 0 Version: 5, 35, 0, 6210 Modules
| |||||||||||||||
| 2144 | "C:\Program Files\CCleaner\CCleaner.exe" /uac | C:\Program Files\CCleaner\CCleaner.exe | taskeng.exe | ||||||||||||
User: admin Company: Piriform Ltd Integrity Level: HIGH Description: CCleaner Version: 5, 35, 0, 6210 Modules
| |||||||||||||||
Total events
1 012
Read events
805
Write events
207
Delete events
0
Modification events
| (PID) Process: | (116) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (116) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (116) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\13B\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (116) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\YouAreAnIdiot.zip | |||
| (PID) Process: | (116) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (116) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (116) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (116) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (116) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\13B\52C64B7E |
| Operation: | write | Name: | @C:\Windows\System32\acppage.dll,-6002 |
Value: Windows Batch File | |||
| (PID) Process: | (116) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
Executable files
2
Suspicious files
3
Text files
6
Unknown types
2
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 116 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa116.12497\yaai.wav | — | |
MD5:— | SHA256:— | |||
| 116 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa116.12497\YouAreAnIdiot\yaai.wav | — | |
MD5:— | SHA256:— | |||
| 2144 | CCleaner.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\0NE4M2N8TGA0QNT6FN6P.temp | — | |
MD5:— | SHA256:— | |||
| 2144 | CCleaner.exe | C:\Users\admin\AppData\Local\Temp\CabF3FA.tmp | — | |
MD5:— | SHA256:— | |||
| 2144 | CCleaner.exe | C:\Users\admin\AppData\Local\Temp\TarF3FB.tmp | — | |
MD5:— | SHA256:— | |||
| 2144 | CCleaner.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\X3Q744N2BWTYWDWH7V33.temp | — | |
MD5:— | SHA256:— | |||
| 2144 | CCleaner.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\NPLCDJTYQKQLUD7AF56B.temp | — | |
MD5:— | SHA256:— | |||
| 116 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa116.12497\Cop.bat | text | |
MD5:93D1D5A174A8DBFC0087D3A859F3FBA3 | SHA256:E151DC2ED8583653C0DB85BB114196BCB34732EC87FA5F4FE91DEBED27CD7758 | |||
| 116 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa116.12497\YouAreAnIdiot.pdb | pdb | |
MD5:9EB163CF02147C80165185F21DA2523D | SHA256:B34E7C0A797D8D8BD2C14F14DE39D51D1618F9D53C478AE02787C7F2BE29ABAC | |||
| 116 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa116.12497\YouAreAnIdiot\YouAreAnIdiot.pdb | pdb | |
MD5:9EB163CF02147C80165185F21DA2523D | SHA256:B34E7C0A797D8D8BD2C14F14DE39D51D1618F9D53C478AE02787C7F2BE29ABAC | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
5
DNS requests
3
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2144 | CCleaner.exe | GET | 301 | 151.101.0.64:80 | http://www.piriform.com/auto?a=0&p=cc&v=5.35.6210&l=1033&lk=&mk=IJR6-W5SV-5KYR-QBZD-6BY4-RN5Z-WAV9-RVK2-HZ8S&o=6.1W3&au=1&mx=97B7721C4994E2556FF6A439510F665DB45337A341A47E15F4997584423BF714&gu=00000000-0000-4000-8000-d6f7f2be5127 | US | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 151.101.2.109:443 | license.piriform.com | Fastly | US | suspicious |
2144 | CCleaner.exe | 151.101.0.64:443 | www.piriform.com | Fastly | US | whitelisted |
2144 | CCleaner.exe | 151.101.2.202:443 | www.ccleaner.com | Fastly | US | suspicious |
2144 | CCleaner.exe | 151.101.0.64:80 | www.piriform.com | Fastly | US | whitelisted |
— | — | 151.101.2.202:443 | www.ccleaner.com | Fastly | US | suspicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
www.piriform.com |
| whitelisted |
www.ccleaner.com |
| whitelisted |
license.piriform.com |
| whitelisted |