Malware analysis malware_090919.7z Malicious activity

Add for printing

File name:	malware_090919.7z
Full analysis:	https://app.any.run/tasks/b32ba279-60fe-42f5-8e68-2becff8f3309
Verdict:	Malicious activity
Analysis date:	September 11, 2019, 10:23:59
OS:	Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME:	application/x-7z-compressed
File info:	7-zip archive data, version 0.4
MD5:	2C4E45357A0077952937D500D1D88B21
SHA1:	19DA432E105737AEEF1754AE58BB7D2F94E95060
SHA256:	78E84C35936041CBDF5BFCA2F33F5B68A1760CFD2D5D6C827C73029D71D8E339
SSDEEP:	6144:gtYikzSZA9Vo8pXH21/OaiXPvSJvB/8vwKU1Jaq3EydNpy1:YYyZl8pXW1/Oa4iJvCvxU1JaZKM

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 60 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: none
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 8.0.7601.17514 undefined
Adobe Acrobat Reader DC MUI (15.023.20070)
Adobe Flash Player 26 ActiveX (26.0.0.131)
Adobe Flash Player 26 NPAPI (26.0.0.131)
Adobe Flash Player 26 PPAPI (26.0.0.131)
Adobe Refresh Manager (1.8.0)
CCleaner (5.35)
FileZilla Client 3.36.0 (3.36.0)
Google Chrome (75.0.3770.100)
Google Update Helper (1.3.34.7)
Java 8 Update 92 (8.0.920.14)
Java Auto Updater (2.8.92.14)
Microsoft .NET Framework 4.7.2 (4.7.03062)
Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Professional 2010 (14.0.6029.1000)
Microsoft Office Proof (English) 2010 (14.0.6029.1000)
Microsoft Office Proof (French) 2010 (14.0.6029.1000)
Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Single Image 2010 (14.0.6029.1000)
Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2019 Redistributable (x86) - 14.21.27702 (14.21.27702.2)
Microsoft Visual C++ 2019 X86 Additional Runtime - 14.21.27702 (14.21.27702)
Microsoft Visual C++ 2019 X86 Minimum Runtime - 14.21.27702 (14.21.27702)
Mozilla Firefox 68.0.1 (x86 en-US) (68.0.1)
Notepad++ (32-bit x86) (7.5.1)
Opera 12.15 (12.15.1748)
Skype version 8.29 (8.29)
Update for Microsoft .NET Framework 4.7.2 (KB4087364) (1)
VLC media player (2.2.6)
WinRAR 5.60 (32-bit) (5.60.0)

Hotfixes

Client LanguagePack Package
Client Refresh LanguagePack Package
CodecPack Basic Package
Foundation Package
IE Troubleshooters Package
InternetExplorer Optional Package
KB2534111
KB2999226
KB4019990
KB976902
LocalPack AU Package
LocalPack CA Package
LocalPack GB Package
LocalPack US Package
LocalPack ZA Package
ProfessionalEdition
UltimateEdition

Add for printing

MALICIOUS
- Application was dropped or rewritten from another process
  - Пакет документов 04.09.exe (PID: 924)
  - Пакет документов 04.09.exe (PID: 2432)
SUSPICIOUS
- Application launched itself
  - WinRAR.exe (PID: 2360)
  - WinRAR.exe (PID: 3528)
- Executable content was dropped or overwritten
  - WinRAR.exe (PID: 2912)
INFO
- Application was crashed
  - Пакет документов 04.09.exe (PID: 2432)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.7z	\|	7-Zip compressed archive (v0.4) (57.1)
.7z	\|	7-Zip compressed archive (gen) (42.8)

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

38

Monitored processes

5

Malicious processes

0

Suspicious processes

0

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
3528	"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\malware_090919.7z"	C:\Program Files\WinRAR\WinRAR.exe	—	explorer.exe
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0
2360	"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIb3528.47919\Пакет документов 04.09.rar"	C:\Program Files\WinRAR\WinRAR.exe	—	WinRAR.exe
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0
2912	"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIb2360.258\Пакет документов 04.09.001"	C:\Program Files\WinRAR\WinRAR.exe		WinRAR.exe
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0
2432	"C:\Users\admin\AppData\Local\Temp\Rar$EXa2912.1009\Пакет документов 04.09.exe"	C:\Users\admin\AppData\Local\Temp\Rar$EXa2912.1009\Пакет документов 04.09.exe		WinRAR.exe
User: admin Integrity Level: MEDIUM Exit code: 3221225477
924	"C:\Users\admin\AppData\Local\Temp\Rar$EXa2912.1009\Пакет документов 04.09.exe" dfsr	C:\Users\admin\AppData\Local\Temp\Rar$EXa2912.1009\Пакет документов 04.09.exe		Пакет документов 04.09.exe
User: admin Integrity Level: MEDIUM

Add for printing

Total events

1 378

Read events

1 308

Write events

0

Delete events

0

Modification events

No data

Add for printing

Executable files

1

Suspicious files

2

Text files

0

Unknown types

0

Dropped files

PID	Process	Filename		Type
3528	WinRAR.exe	C:\Users\admin\AppData\Local\Temp\Rar$DIb3528.47919\Пакет документов 04.09.rar		compressed
		MD5:1FE344E8360375393DBD7A62296A8678	SHA256:67F3BDF62FEB5F82F9F5CFA83AFD4BE972CC95F96B223334078F0F6C9EC6B641
2360	WinRAR.exe	C:\Users\admin\AppData\Local\Temp\Rar$DIb2360.258\Пакет документов 04.09.001		compressed
		MD5:8AFD7294090526C641E2CDBCCA17C643	SHA256:FA09820D3B635751124CC8D986563BD15C1C162DD9B790D7C2A3174875A9728F
2912	WinRAR.exe	C:\Users\admin\AppData\Local\Temp\Rar$EXa2912.1009\Пакет документов 04.09.exe		executable
		MD5:16E627C2696B20810201EDD95175C15E	SHA256:7FAA42F5017E61E354ADB737A0EC82D4DC0AE52B2F87B8A36105416A99AEF89B

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

0

TCP/UDP connections

5

DNS requests

2

Threats

0

HTTP requests

No HTTP requests

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
924	Пакет документов 04.09.exe	104.16.55.3:443	blockchain.info	Cloudflare Inc	US	shared
—	—	104.16.55.3:443	blockchain.info	Cloudflare Inc	US	shared
924	Пакет документов 04.09.exe	54.209.25.54:443	api.blockcypher.com	Amazon.com, Inc.	US	malicious

DNS requests

Domain	IP	Reputation
blockchain.info	104.16.55.3 104.16.54.3	shared
api.blockcypher.com	54.209.25.54 52.86.198.63	whitelisted

Threats

No threats detected

Add for printing

No debug info

General Info

malware_090919.7z

2C4E45357A0077952937D500D1D88B21

19DA432E105737AEEF1754AE58BB7D2F94E95060

78E84C35936041CBDF5BFCA2F33F5B68A1760CFD2D5D6C827C73029D71D8E339

6144:gtYikzSZA9Vo8pXH21/OaiXPvSJvB/8vwKU1Jaq3EydNpy1:YYyZl8pXW1/Oa4iJvCvxU1JaZKM

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Application was dropped or rewritten from another process

SUSPICIOUS

Application launched itself

Executable content was dropped or overwritten

INFO

Application was crashed

Malware configuration

Static information

TRiD

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings