analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

sample_118.zip

Full analysis: https://app.any.run/tasks/4f921121-72fd-4b29-8ad6-b91e377bee2e
Verdict: Malicious activity
Analysis date: June 12, 2019, 11:10:31
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

23299E0AA5C7B502653DFF133E8B46FB

SHA1:

650DFCFFA19293122F5BAC882B9D630ED5E6D120

SHA256:

7F57599B935863F9E69A505FACB7CE24E0233EBB79B15892C871B9976E235FAA

SSDEEP:

1536:ZSnoSwzim1p2wSg4x0WGCG/xKeVROqy+ZH6EVes2W8H3r5jwPj3pdc:RV72wS/hFSxT4EVehHXljN

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • sample_118.exe (PID: 3156)
    • Loads dropped or rewritten executable

      • sample_118.exe (PID: 3156)
      • explorer.exe (PID: 2044)
      • windanr.exe (PID: 680)
      • dwm.exe (PID: 1980)
      • WinRAR.exe (PID: 3556)
      • ctfmon.exe (PID: 3780)
      • taskeng.exe (PID: 3756)
    • Changes the autorun value in the registry

      • sample_118.exe (PID: 3156)
    • Runs injected code in another process

      • sample_118.exe (PID: 3156)
    • Application was injected by another process

      • explorer.exe (PID: 2044)
      • taskeng.exe (PID: 3756)
      • ctfmon.exe (PID: 3780)
      • dwm.exe (PID: 1980)
      • windanr.exe (PID: 680)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • sample_118.exe (PID: 3156)
  • INFO

    • Manual execution by user

      • sample_118.exe (PID: 3156)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: sample_118/
ZipUncompressedSize: -
ZipCompressedSize: -
ZipCRC: 0x00000000
ZipModifyDate: 2018:05:01 18:48:22
ZipCompression: None
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
7
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details
start inject inject inject inject winrar.exe no specs sample_118.exe dwm.exe explorer.exe taskeng.exe ctfmon.exe windanr.exe

Process information

PID
CMD
Path
Indicators
Parent process
3556"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\sample_118.zip"C:\Program Files\WinRAR\WinRAR.exeexplorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3156"C:\Users\admin\Desktop\sample_118\sample_118.exe" C:\Users\admin\Desktop\sample_118\sample_118.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
1980"C:\Windows\system32\Dwm.exe"C:\Windows\System32\dwm.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Desktop Window Manager
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2044C:\Windows\Explorer.EXEC:\Windows\explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3756taskeng.exe {7E1E8C9A-BE84-4A45-8FE2-CD8D351321B8}C:\Windows\System32\taskeng.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Engine
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3780C:\Windows\System32\ctfmon.exe C:\Windows\System32\ctfmon.exe
taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
CTF Loader
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
680"windanr.exe"C:\Windows\system32\windanr.exe
qemu-ga.exe
User:
admin
Integrity Level:
MEDIUM
Total events
2 427
Read events
2 352
Write events
0
Delete events
0

Modification events

No data
Executable files
3
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
3556WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3556.35498\sample_118\sample_118
MD5:
SHA256:
2044explorer.exeC:\Users\admin\Desktop\sample_118
MD5:
SHA256:
2044explorer.exeC:\Users\admin\Desktop\sample_118\sample_118.exeexecutable
MD5:D08F50BC74193ECA4A985090404C7ED4
SHA256:708E6CEFE635204F3903D61DD0BCAEFD4E919A8675E600652B3C8697EA0AA42D
3156sample_118.exeC:\Users\admin\AppData\Local\Temp\s9185.tmpexecutable
MD5:D85D0E0ABCB5299EB7658706BE7B9127
SHA256:F819536DD8E925F4DF662E437A3DAD5F3850C0019B3429A0F35FDC969946EFBF
3156sample_118.exeC:\Users\admin\ae4ilad8.ocxexecutable
MD5:D85D0E0ABCB5299EB7658706BE7B9127
SHA256:F819536DD8E925F4DF662E437A3DAD5F3850C0019B3429A0F35FDC969946EFBF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info