analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

MDE_File_Sample_eae059af0e740d032cb6db9ace3afc6d9ef1a412 (1).zip

Full analysis: https://app.any.run/tasks/a8e806a4-2358-4ecf-89ea-68d997da8b7e
Verdict: Malicious activity
Analysis date: December 05, 2022, 18:52:53
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

93AC479E900FECA0584646DB0C3ECD73

SHA1:

D6A4D047A592434198618E59C9DCD08262A03493

SHA256:

79DDA21CB0025B436808101D24748E45EF4C369DCBE6E2035A296B2F3FB198C3

SSDEEP:

98304:pHSoNFs5VXs5wf43ocQLp2/BbiqMiwAWP+4WWtShOzmpK3iqUu/NDt41AB:pyowVc5C4292/liUmtzSpsYwfB

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • setup_installer.exe (PID: 1000)
      • setup_installer.exe (PID: 3836)

  • SUSPICIOUS

    • Application launched itself

      • msiexec.exe (PID: 2880)

    • Executes as Windows Service

      • vssvc.exe (PID: 3476)

    • Executable content was dropped or overwritten

      • setup_installer.exe (PID: 3836)

    • Searches for installed software

      • msiexec.exe (PID: 2880)

  • INFO

    • Checks supported languages

      • setup_installer.exe (PID: 3836)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
7
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start drop and start start winrar.exe no specs setup_installer.exe no specs setup_installer.exe msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs vssvc.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1328"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\MDE_File_Sample_eae059af0e740d032cb6db9ace3afc6d9ef1a412 (1).zip"C:\Program Files\WinRAR\WinRAR.exe—Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
1000"C:\Users\admin\AppData\Local\Temp\Rar$EXb1328.37457\setup_installer.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb1328.37457\setup_installer.exe—WinRAR.exe
User:
admin
Company:
Lancet Technology, Inc.
Integrity Level:
MEDIUM
Description:
Setup Launcher
Exit code:
3221226540
Version:
1.00.0000
3836"C:\Users\admin\AppData\Local\Temp\Rar$EXb1328.37457\setup_installer.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb1328.37457\setup_installer.exe
WinRAR.exe
User:
admin
Company:
Lancet Technology, Inc.
Integrity Level:
HIGH
Description:
Setup Launcher
Version:
1.00.0000
2376MSIEXEC.EXE /i "C:\Windows\Downloaded Installations\{C42A6B48-7383-418F-A74C-6C8034C62518}\Lancet Installer.msi" SETUPEXEDIR="C:\Users\admin\AppData\Local\Temp\Rar$EXb1328.37457"C:\Windows\system32\MSIEXEC.EXE—setup_installer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
2880C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
2596C:\Windows\system32\MsiExec.exe -Embedding B2A7E18CFC430E3CDEE933380E22F4C1 CC:\Windows\system32\MsiExec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
3476C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
3 097
Read events
2 974
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
4
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
2880msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
3836setup_installer.exeC:\Users\admin\AppData\Local\Temp\_is30A6\Setup.INIbinary
MD5:55719D68E68319D2E7FA50808BF615D8
SHA256:DAADB060D7B3401F4DCC5087929E24ED0E5521A01CBE7244ECC6A760BB39DF64
3836setup_installer.exeC:\Users\admin\AppData\Local\Temp\~30A5.tmpbinary
MD5:55719D68E68319D2E7FA50808BF615D8
SHA256:DAADB060D7B3401F4DCC5087929E24ED0E5521A01CBE7244ECC6A760BB39DF64
3836setup_installer.exeC:\Users\admin\AppData\Local\Temp\_is30A6\_ISMSIDEL.INItext
MD5:49F150398006519F1B3182267B3C5934
SHA256:AB98960EE5FC7615FF952E2BB4FFC4F25EFCF40A97355232A577CFBA2EF7D714
3836setup_installer.exeC:\Windows\Downloaded Installations\{C42A6B48-7383-418F-A74C-6C8034C62518}\Lancet Installer.msiexecutable
MD5:38CCCCB350B1B58520C962F462266441
SHA256:29F91A3B686775600BE169939A231A89D34B1598D01E79E1A931ABBA20AF6C19
3836setup_installer.exeC:\Users\admin\AppData\Local\Temp\_is30A6\Lancet Installer.msibinary
MD5:DE198F27E03543367A83997F99734F40
SHA256:37031F5A0814260CAB81C261C513663C8C5DF1E7D9C51C54469D7AEB6670CF0C
1328WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb1328.37457\setup_installer.exeexecutable
MD5:01781EFC9D4EAD14CEDF30678B940BDB
SHA256:0D9DF105AFE1BBE361FBF1F126B3A5E6D01277B8C2CE7D939B8A448F7C1438D6
3836setup_installer.exeC:\Users\admin\AppData\Local\Temp\_is30A6\0x0409.inibinary
MD5:77F533C7496E780AABF541D08588415B
SHA256:4F4E9ECE644C5EA4C4CD81FBC0FCF716E6C8BFB9B833A4DAD6C0A502464FD739
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
MDE_File_Sample_eae059af0e740d032cb6db9ace3afc6d9ef1a412 (1).zip