File name:

ssr-win.7z

Full analysis: https://app.any.run/tasks/7cf705f5-dfd4-4d44-b155-ea0a8c040099
Verdict: Malicious activity
Analysis date: May 01, 2019, 09:11:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

FFC4C293F7679D4EAE66E1A79BEB7BAF

SHA1:

3D676A8119C9A0576B0A44DEE5311AED457BE00D

SHA256:

7EBC565B6F0E13AE9FCC4A2DC88F4E58C88D42D63067EEB4E69F96846CAB58C9

SSDEEP:

24576:eZUvfkShaoIWHVJqwjRnBoDjsoBesg0Rbi+7HA:eOnk/eHVr1BmsoIb0dU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • ShadowsocksR.exe (PID: 300)
      • ShadowsocksR.exe (PID: 2688)

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 3180)
      • ShadowsocksR.exe (PID: 2688)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • ShadowsocksR.exe (PID: 300)

    • Uses RUNDLL32.EXE to load library

      • ShadowsocksR.exe (PID: 300)

    • Reads Environment values

      • ShadowsocksR.exe (PID: 300)

    • Creates files in the user directory

      • rundll32.exe (PID: 1372)

    • Reads Internet Cache Settings

      • rundll32.exe (PID: 1372)
      • rundll32.exe (PID: 3372)

  • INFO

    • Reads internet explorer settings

      • iexplore.exe (PID: 1656)

    • Creates files in the user directory

      • iexplore.exe (PID: 2824)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 1656)

    • Changes internet zones settings

      • iexplore.exe (PID: 2824)

    • Application launched itself

      • iexplore.exe (PID: 2824)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
9
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start winrar.exe no specs shadowsocksr.exe shadowsocksr.exe rundll32.exe no specs rundll32.exe no specs searchprotocolhost.exe no specs notepad.exe no specs iexplore.exe iexplore.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
300"C:\Users\admin\Desktop\ShadowsocksR.exe" C:\Users\admin\Desktop\ShadowsocksR.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
ShadowsocksR
Exit code:
0
Version:
5.1.5.0
Modules
Images
c:\users\admin\desktop\shadowsocksr.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1372"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\WININET.dll",DispatchAPICall 1 C:\Windows\system32\rundll32.exe—ShadowsocksR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
1656"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2824 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1784"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\temp\shadowsocks_2019-05.logC:\Windows\system32\NOTEPAD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2688"C:\Users\admin\Desktop\temp\ShadowsocksR.exe" "C:\Users\admin\Desktop\temp/privoxy.conf"C:\Users\admin\Desktop\temp\ShadowsocksR.exe
ShadowsocksR.exe
User:
admin
Company:
The Privoxy team - www.privoxy.org
Integrity Level:
MEDIUM
Description:
Privoxy
Exit code:
0
Version:
3.0.26
Modules
Images
c:\users\admin\desktop\temp\shadowsocksr.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\users\admin\desktop\temp\mgwz.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\shell32.dll
2824"C:\Program Files\Internet Explorer\iexplore.exe" C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3180"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe5_ Global\UsGthrCtrlFltPipeMssGthrPipe5 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3372"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\WININET.dll",DispatchAPICall 1 C:\Windows\system32\rundll32.exe—ShadowsocksR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
3844"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\ssr-win.7z"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
Total events
1 271
Read events
1 153
Write events
116
Delete events
2

Modification events

(PID) Process:(3844) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3844) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3844) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3844) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\ssr-win.7z
(PID) Process:(3844) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3844) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3844) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3844) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3844) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E
Operation:writeName:@C:\Windows\system32\notepad.exe,-469
Value:
Text Document
(PID) Process:(3180) SearchProtocolHost.exeKey:HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\62\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
2
Suspicious files
3
Text files
34
Unknown types
4

Dropped files

PID
Process
Filename
Type
3844WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3844.40020\ShadowsocksR.exe —
MD5:—
SHA256:—
3844WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3844.40020\templates\cgi-error-filetext
MD5:F9B572A4705DD539D182AD0C2C3D8A0B
SHA256:EBAD87C26638EA5223E9B730E8E22D274C6B1FD59588FF4605CDE88E4CF7B6D4
3844WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3844.40020\templates\cgi-error-disabledtext
MD5:5CA98CFB63DC760CD51C6DDF77C7A1C7
SHA256:2DF95BB3FD7747DD0DA8E3549484E27C6A92A0F332BC5CEB899CC83CDF5F5F94
300ShadowsocksR.exeC:\Users\admin\Desktop\temp\ShadowsocksR.exeexecutable
MD5:CEF4A8B646D1C1502C4B38E0D5769777
SHA256:290E0CBB6C8AF290DBDCDA5739F30E315B712E8CA3ACA260AC75A4CF7C8302C4
3844WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3844.40020\templates\mod-local-helphtml
MD5:4A4775A89089E7319A6B5165D460F522
SHA256:7BEA396084483D03B737F4B79133D669C88F6D8C435F95C9EA69EF509C48ACC5
3844WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3844.40020\templates\mod-unstable-warningtext
MD5:0583471F3B18873EE67651B89AF07067
SHA256:6DAE1DB3F49DF89229900908B6FC31D5897C7295BF79474DD7B37E9932190482
3844WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3844.40020\user.ruletext
MD5:84009DEF440D89D3965624D8386DD3DD
SHA256:1B8F0087C8243CABDFB08C2EE4D9FF7B528DAA156E8AF8827DCF70D79313854F
3844WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3844.40020\templates\url-info-osd.xmlxml
MD5:E8968718D299D7425690D9376479436E
SHA256:BAADC65EF0ED8B8D1F6204E73FD332730CA4BD2B875D4158DDB8AC21A17C8EFF
3844WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3844.40020\chn_ip.txttext
MD5:BE3DF2201406E988F960135DDD0773A7
SHA256:BB041B10A21756B980ABB69DD9FB0E850D6408C0D4E3B7272DF88CAFAEEB3686
3844WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3844.40020\LICENSEtext
MD5:AB2DED24BAB23BD5E8E9C3EDBBC3BF44
SHA256:B53E45FA09646E762CE929B756B323291551316BB06DFF2B67F3BF88B9EF0691
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
2
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

Domain
IP
Reputation
raw.githubusercontent.com
  • 151.101.0.133
  • 151.101.64.133
  • 151.101.128.133
  • 151.101.192.133
shared
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ssr-win.7z