File name:

i+k.zip

Full analysis: https://app.any.run/tasks/48412c56-4ad5-43ae-b5dd-170b9f42716f
Verdict: Malicious activity
Analysis date: December 18, 2023, 16:59:01
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

9EF55BA622F3B264B525AC6086834378

SHA1:

5B2D0DE764D7B65B46D4384C79A13553A47F6C3C

SHA256:

7414BD4CCB06D8FA8BCF1A2DE66D1A359963A2434960E8D17009355CC2465B4C

SSDEEP:

49152:MGoroVmtUkkwAtiMzgc2GI5b53eYZv/wH93LGTfFXqSyuS6YcEtkb0VmNaIlCMtv:MGorpSkvAMc2Z5dOsAd6TfFSuS6YcXbD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • iceix.exe (PID: 1496)
      • ice9.exe (PID: 3752)
      • WinMail.exe (PID: 1976)

    • Scans artifacts that could help determine the target

      • WinMail.exe (PID: 1976)

    • Runs injected code in another process

      • wiulrue.exe (PID: 3732)

    • Application was injected by another process

      • dwm.exe (PID: 612)

  • SUSPICIOUS

    • Application launched itself

      • iceix.exe (PID: 1236)

    • Reads the BIOS version

      • iceix.exe (PID: 1496)

    • Detected use of alternative data streams (AltDS)

      • iceix.exe (PID: 1496)
      • WinMail.exe (PID: 1976)

    • Executing commands from a ".bat" file

      • ice9.exe (PID: 3752)
      • iceix.exe (PID: 1496)

    • Starts CMD.EXE for commands execution

      • ice9.exe (PID: 3752)
      • iceix.exe (PID: 1496)

    • Drops a self-deleting batch file

      • ice9.exe (PID: 3752)
      • iceix.exe (PID: 1496)

    • Starts itself from another location

      • ice9.exe (PID: 3752)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • cmd.exe (PID: 3848)

    • Reads Internet Explorer settings

      • WinMail.exe (PID: 1976)

    • Reads the Internet Settings

      • iceix.exe (PID: 1496)
      • ice9.exe (PID: 3752)
      • dwm.exe (PID: 612)
      • keygen.exe (PID: 2268)
      • iceix.exe (PID: 1236)
      • cmd.exe (PID: 1748)
      • WinMail.exe (PID: 1976)

    • Reads security settings of Internet Explorer

      • WinMail.exe (PID: 1976)

    • Reads settings of System Certificates

      • WinMail.exe (PID: 1976)

    • Reads Microsoft Outlook installation path

      • WinMail.exe (PID: 1976)

    • Checks Windows Trust Settings

      • WinMail.exe (PID: 1976)

  • INFO

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 128)

    • Checks supported languages

      • keygen.exe (PID: 2268)
      • iceix.exe (PID: 1236)
      • iceix.exe (PID: 1496)
      • ice9.exe (PID: 3752)
      • wiulrue.exe (PID: 3732)
      • WinMail.exe (PID: 1976)

    • Reads the computer name

      • keygen.exe (PID: 2268)
      • iceix.exe (PID: 1496)
      • ice9.exe (PID: 3752)
      • wiulrue.exe (PID: 3732)
      • WinMail.exe (PID: 1976)
      • iceix.exe (PID: 1236)

    • Manual execution by a user

      • keygen.exe (PID: 2268)
      • iceix.exe (PID: 1236)
      • ice9.exe (PID: 3752)

    • Reads the machine GUID from the registry

      • iceix.exe (PID: 1496)
      • WinMail.exe (PID: 1976)

    • Creates files in the program directory

      • iceix.exe (PID: 1496)

    • Create files in a temporary directory

      • ice9.exe (PID: 3752)
      • iceix.exe (PID: 1496)
      • WinMail.exe (PID: 1976)

    • Creates files or folders in the user directory

      • WinMail.exe (PID: 1976)
      • ice9.exe (PID: 3752)

    • Checks proxy server information

      • WinMail.exe (PID: 1976)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2023:12:18 16:58:38
ZipCRC: 0x238e7af5
ZipCompressedSize: 971631
ZipUncompressedSize: 1159168
ZipFileName: iceix.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
56
Monitored processes
12
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start inject winrar.exe no specs keygen.exe no specs iceix.exe iceix.exe no specs ice9.exe cmd.exe no specs wiulrue.exe no specs netsh.exe no specs winmail.exe no specs dwm.exe cmd.exe no specs cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
128"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\i+k.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
612"C:\Windows\system32\Dwm.exe"C:\Windows\System32\dwm.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Desktop Window Manager
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dwm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\uxtheme.dll
1236"C:\Users\admin\Desktop\iceix.exe" C:\Users\admin\Desktop\iceix.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\iceix.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
1496"C:\Users\admin\Desktop\iceix.exe" C:\Users\admin\Desktop\iceix.exe—iceix.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\iceix.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
1748"C:\Windows\system32\cmd.exe" /c "C:\Users\admin\AppData\Local\Temp\tmp63c71a8b.bat"C:\Windows\System32\cmd.exe—ice9.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1976"C:\Program Files\Windows Mail\WinMail.exe" -EmbeddingC:\Program Files\Windows Mail\WinMail.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Mail
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows mail\winmail.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2228netsh advfirewall firewall add rule name="explore" dir=in action=allow program="C:\Users\admin\AppData\Roaming\Fabo\wiulrue.exe"C:\Windows\System32\netsh.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
2268"C:\Users\admin\Desktop\keygen.exe" C:\Users\admin\Desktop\keygen.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\keygen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
2636"C:\Windows\system32\cmd.exe" /c "C:\Users\admin\AppData\Local\Temp\tmp41069ff0.bat"C:\Windows\System32\cmd.exe—iceix.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3732"C:\Users\admin\AppData\Roaming\Fabo\wiulrue.exe"C:\Users\admin\AppData\Roaming\Fabo\wiulrue.exe—ice9.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\fabo\wiulrue.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
9 932
Read events
9 800
Write events
122
Delete events
10

Modification events

(PID) Process:(128) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1496) iceix.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:NodeSlots
Value:
020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202
Executable files
5
Suspicious files
19
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa128.23715\keygen.exeexecutable
MD5:218CE56C9E126939A950DAAA3DD27953
SHA256:639344D3D99225E59765E78354A2553EE20A6794D97AD3A43BD0155E6E0FD391
1496iceix.exeC:\Users\admin\Desktop\ice9.exeexecutable
MD5:A577DA8635D8B8EF440E533D9A2248C6
SHA256:73EA2A99E475DDC500495EA0C1E0F6E31DA9726FD02E33A84549E521F3DEB5C6
128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa128.23715\iceix.exeexecutable
MD5:CC474EE65CFB0A498ADD7863E9DF799B
SHA256:C8D4B53A2EB65A01875257E654B6C186801217AC678E778B00AC243411887B21
1976WinMail.exeC:\Users\admin\AppData\Local\Microsoft\Windows Mail\Local Folders\Deleted Items\winmail.folbinary
MD5:60A3B6592DE01A4CB2E07DA218C9F34B
SHA256:8AD29C309236F0210E3AE7AF8ADEDF1642A9E561498F9320B50CEC8938EE8B83
1976WinMail.exeC:\Users\admin\AppData\Local\Microsoft\Windows Mail\edbtmp.logbinary
MD5:FECA2A0EB68C40A8663874993ECF0404
SHA256:0836419C4E8C85F5D34805277E722920C3C2A9CD8161993EA944A0D948E6C458
1976WinMail.exeC:\Users\admin\AppData\Local\Microsoft\Windows Mail\Backup\temp\WindowsMail.MSMessageStorebinary
MD5:04980F3B678CF90FAF46B01259F34C33
SHA256:8952C3BF8B91AF49A8FAD3A44B4B59F93E946186C5EC0619E841FB5636D43547
1976WinMail.exeC:\Users\admin\AppData\Local\Microsoft\Windows Mail\edb.logbinary
MD5:09F9EC30C43F61C1B4E3CF574CEF1740
SHA256:3A2C8485989DE3437B107D5459308E6984CC2D0F029B25CA74DFA0BC4B754054
1976WinMail.exeC:\Users\admin\AppData\Local\Microsoft\Windows Mail\Local Folders\Sent Items\winmail.folbinary
MD5:1D1A60631EFCF505795FB06471CB6A48
SHA256:87EED194D869F1DEC6EBF639E985101ABAD37F6E5A347237A1B056B2DCBFC481
3752ice9.exeC:\Users\admin\AppData\Roaming\Fabo\wiulrue.exeexecutable
MD5:DD7F1DB15C2FD49CCAA0EBEC69995A48
SHA256:D1B5E888FFA2D4F9C19E2957282896DAF82D09194E7667CE0A50FC0273EA50FC
1976WinMail.exeC:\Users\admin\AppData\Local\Microsoft\Windows Mail\Backup\temp\edb00002.logbinary
MD5:F088EBBE29B4FC28125F08289550A985
SHA256:33F527459E8E9AFA733B37594F754E2488B5F8FB365CA84AE82E702B28EAAC8D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
15
DNS requests
1
Threats
10

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
276
taskhost.exe
POST
405
64.190.63.222:80
http://yourdomain.com/config/index.php
unknown
html
556 b
unknown
276
taskhost.exe
POST
405
64.190.63.222:80
http://yourdomain.com/config/index.php
unknown
html
556 b
unknown
276
taskhost.exe
POST
405
64.190.63.222:80
http://yourdomain.com/config/index.php
unknown
html
556 b
unknown
276
taskhost.exe
POST
405
64.190.63.222:80
http://yourdomain.com/config/index.php
unknown
html
556 b
unknown
276
taskhost.exe
POST
405
64.190.63.222:80
http://yourdomain.com/config/index.php
unknown
html
556 b
unknown
276
taskhost.exe
POST
405
64.190.63.222:80
http://yourdomain.com/config/index.php
unknown
html
556 b
unknown
276
taskhost.exe
POST
405
64.190.63.222:80
http://yourdomain.com/config/index.php
unknown
html
556 b
unknown
276
taskhost.exe
POST
405
64.190.63.222:80
http://yourdomain.com/config/index.php
unknown
html
556 b
unknown
276
taskhost.exe
POST
405
64.190.63.222:80
http://yourdomain.com/config/index.php
unknown
html
556 b
unknown
276
taskhost.exe
POST
405
64.190.63.222:80
http://yourdomain.com/config/index.php
unknown
html
556 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
276
taskhost.exe
64.190.63.222:80
yourdomain.com
SEDO GmbH
DE
unknown

DNS requests

Domain
IP
Reputation
yourdomain.com
  • 64.190.63.222
unknown

Threats

PID
Process
Class
Message
276
taskhost.exe
A Network Trojan was detected
ET MALWARE Generic - POST To .php w/Extended ASCII Characters
276
taskhost.exe
A Network Trojan was detected
ET MALWARE Generic - POST To .php w/Extended ASCII Characters
276
taskhost.exe
A Network Trojan was detected
ET MALWARE Generic - POST To .php w/Extended ASCII Characters
276
taskhost.exe
A Network Trojan was detected
ET MALWARE Generic - POST To .php w/Extended ASCII Characters
276
taskhost.exe
A Network Trojan was detected
ET MALWARE Generic - POST To .php w/Extended ASCII Characters
276
taskhost.exe
A Network Trojan was detected
ET MALWARE Generic - POST To .php w/Extended ASCII Characters
276
taskhost.exe
A Network Trojan was detected
ET MALWARE Generic - POST To .php w/Extended ASCII Characters
276
taskhost.exe
A Network Trojan was detected
ET MALWARE Generic - POST To .php w/Extended ASCII Characters
276
taskhost.exe
A Network Trojan was detected
ET MALWARE Generic - POST To .php w/Extended ASCII Characters
276
taskhost.exe
A Network Trojan was detected
ET MALWARE Generic - POST To .php w/Extended ASCII Characters
Process
Message
iceix.exe
%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s
iceix.exe
%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
i+k.zip