analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

EX-7_Revamped_V.10B.rar

Full analysis: https://app.any.run/tasks/2eb09333-6278-4dca-9084-ee3dc021b4ec
Verdict: Malicious activity
Analysis date: April 25, 2019, 17:43:37
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

97FF096FF3732AFF6247E488DFE17744

SHA1:

F21DBC79FC57D2CAA6A9AB09BE0C12233952425F

SHA256:

7DF10299B4F2AA0765FBCEF4BB90CC85BF9175C574F16039A128756C2111076F

SSDEEP:

49152:4KWf1F7JP5dPkhdQyw2tq66rD/JbM3lmqmok+Tf630:4K+1nMhdFrJ6rD/WmG/rQ0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • EX-7 V.10B.exe (PID: 3588)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2840)
      • msdt.exe (PID: 3164)

    • Starts Internet Explorer

      • EX-7 V.10B.exe (PID: 3588)

    • Uses IPCONFIG.EXE to discover IP address

      • sdiagnhost.exe (PID: 3388)

  • INFO

    • Changes internet zones settings

      • iexplore.exe (PID: 3016)

    • Reads internet explorer settings

      • iexplore.exe (PID: 992)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 992)

    • Creates files in the user directory

      • iexplore.exe (PID: 992)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
12
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe verclsid.exe no specs ex-7 v.10b.exe no specs iexplore.exe iexplore.exe msdt.exe sdiagnhost.exe no specs ipconfig.exe no specs route.exe no specs makecab.exe no specs control.exe no specs rundll32.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2840"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\EX-7_Revamped_V.10B.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3200"C:\Windows\system32\verclsid.exe" /S /C {0B2C9183-C9FA-4C53-AE21-C900B0C39965} /I {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} /X 0x401C:\Windows\system32\verclsid.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Extension CLSID Verification Host
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3588"C:\Users\admin\AppData\Local\Temp\EX-7_Revamped_V.10B\EX-7 V.10B.exe" C:\Users\admin\AppData\Local\Temp\EX-7_Revamped_V.10B\EX-7 V.10B.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
EX-7 V.10B
Exit code:
2148734720
Version:
1.0.0.0
3016"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
EX-7 V.10B.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
992"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3016 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3164 -modal 131544 -skip TRUE -path C:\Windows\diagnostics\system\networking -af C:\Users\admin\AppData\Local\Temp\NDFC2B7.tmp -ep NetworkDiagnosticsWebC:\Windows\system32\msdt.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Diagnostics Troubleshooting Wizard
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3388C:\Windows\System32\sdiagnhost.exe -EmbeddingC:\Windows\System32\sdiagnhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Scripted Diagnostics Native Host
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2904"C:\Windows\system32\ipconfig.exe" /allC:\Windows\system32\ipconfig.exe—sdiagnhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
IP Configuration Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
4068"C:\Windows\system32\ROUTE.EXE" printC:\Windows\system32\ROUTE.EXE—sdiagnhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Route Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2836"C:\Windows\system32\makecab.exe" /f NetworkConfiguration.ddfC:\Windows\system32\makecab.exe—sdiagnhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Cabinet Maker
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
1 103
Read events
1 020
Write events
0
Delete events
0

Modification events

No data
Executable files
6
Suspicious files
9
Text files
58
Unknown types
7

Dropped files

PID
Process
Filename
Type
3016iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\favicon[1].ico —
MD5:—
SHA256:—
3016iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
2840WinRAR.exeC:\Users\admin\AppData\Local\Temp\EX-7_Revamped_V.10B\EX-7.dllexecutable
MD5:B720D6EF3B6A922624781905805524EF
SHA256:3CAA1C1DF838A5516775E45029136D9568060850ACB07542F63715A09AAA6EDA
992iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.datdat
MD5:18D7A0D7EEDCF755D93A28CD7F2B76E3
SHA256:B943E25FFB3E83F1B078C108ADBE2A45F7EB5E9862AFBFDF27588A01DE0625E6
992iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.datdat
MD5:698E198B56274C2C3A6A65C495CF3FA4
SHA256:52C8571FC176EA661FC701E140AA279E9998C93626D442F3F43C4B3D0EBD039F
2840WinRAR.exeC:\Users\admin\AppData\Local\Temp\EX-7_Revamped_V.10B\Issues.txttext
MD5:DA4A71D5FFB546F932B427C4D37D6C61
SHA256:8AD7AFC1F50948E636A4413A9205E46DF970015673999F41A318AAD8695D47B6
2840WinRAR.exeC:\Users\admin\AppData\Local\Temp\EX-7_Revamped_V.10B\EX-7 V.10B.exeexecutable
MD5:906F4DF1D980CFB7663C8F36C911C1CC
SHA256:C765DE880C1A10865109ADE8341C9F7AC1730A1C9D5C613A57341FD3A4E490C4
2840WinRAR.exeC:\Users\admin\AppData\Local\Temp\EX-7_Revamped_V.10B\VMProtectSDK32.dllexecutable
MD5:855884D77A59218F44843F65727770DF
SHA256:AE84E5ED207D68BE35CDA379F1D3E285E30FC1DD1F767DA14F67492A06824237
2840WinRAR.exeC:\Users\admin\AppData\Local\Temp\EX-7_Revamped_V.10B\EX-7 V.10B.pdbpdb
MD5:EA78FFF435247298BEEB9762F9AF867F
SHA256:ED3AF021046898E6E5D629069D94129782242223CEA9852A2011F153D575D290
992iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\31SCICNS\desktop.iniini
MD5:4A3DEB274BB5F0212C2419D3D8D08612
SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
13
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
976
svchost.exe
GET
302
104.109.80.115:80
http://go.microsoft.com/
NL
—
—
whitelisted
992
iexplore.exe
GET
302
104.109.80.115:80
http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch&plcid=0x409&o1=.NETFramework,Version=v4.7.2&processName=EX-7%20V.10B.exe&platform=0000&osver=5&isServer=0&shimver=4.0.30319.0
NL
—
—
whitelisted
992
iexplore.exe
GET
302
104.109.80.115:80
http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch&plcid=0x409&o1=.NETFramework,Version=v4.7.2&processName=EX-7%20V.10B.exe&platform=0000&osver=5&isServer=0&shimver=4.0.30319.0
NL
—
—
whitelisted
976
svchost.exe
GET
200
2.23.106.83:80
http://www.microsoft.com/
unknown
html
1020 b
whitelisted
3016
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3016
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
976
svchost.exe
104.109.80.115:80
go.microsoft.com
Akamai International B.V.
NL
whitelisted
992
iexplore.exe
104.109.80.115:80
go.microsoft.com
Akamai International B.V.
NL
whitelisted
992
iexplore.exe
23.96.207.177:443
dotnetdownloadservice.azurewebsites.net
Microsoft Corporation
US
whitelisted
976
svchost.exe
2.23.106.83:80
www.microsoft.com
Akamai International B.V.
—
whitelisted
992
iexplore.exe
104.109.80.115:443
go.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
23.96.207.177:443
dotnetdownloadservice.azurewebsites.net
Microsoft Corporation
US
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
go.microsoft.com
  • 104.109.80.115
whitelisted
dotnetdownloadservice.azurewebsites.net
  • 23.96.207.177
unknown
www.microsoft.com
  • 2.23.106.83
whitelisted

Threats

PID
Process
Class
Message
976
svchost.exe
A Network Trojan was detected
ET POLICY Microsoft user-agent automated process response to automated request
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
EX-7_Revamped_V.10B.rar