analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| download: | optiver.zip |
| Full analysis: | https://app.any.run/tasks/a87df32f-3962-4048-9f5d-5d3052f03e05 |
| Verdict: | Malicious activity |
| Analysis date: | June 27, 2022, 13:26:06 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v2.0 to extract |
| MD5: | C1B12817CC4B9B7A39283C633C8B2260 |
| SHA1: | 31C7C375368EEBE093259B9AD70B7D7F0535FA56 |
| SHA256: | 811933E8D44DFB8288249343F892BF4477017AFCE4B36ABB276A65CDAC49FCC0 |
| SSDEEP: | 384:wMLPr+oIU6PIRnKD7cWR2jVKI7Hx986CCSBzzCEgmFdWeI6cZpR0wL9Md:wMLPicMIWsjVKWHD86CCSBzeE1dWeI5O |
MALICIOUS
Drops executable file immediately after starts
- WinRAR.exe (PID: 2568)
Application was dropped or rewritten from another process
- optiver.exe (PID: 3844)
SUSPICIOUS
Checks supported languages
- WinRAR.exe (PID: 2568)
- optiver.exe (PID: 3844)
Reads the computer name
- WinRAR.exe (PID: 2568)
- optiver.exe (PID: 3844)
Executable content was dropped or overwritten
- WinRAR.exe (PID: 2568)
Drops a file with a compile date too recent
- WinRAR.exe (PID: 2568)
Reads Environment values
- optiver.exe (PID: 3844)
Reads Microsoft Outlook installation path
- optiver.exe (PID: 3844)
Checks for external IP
- optiver.exe (PID: 3844)
INFO
Manual execution by user
- optiver.exe (PID: 3844)
Checks Windows Trust Settings
- optiver.exe (PID: 3844)
Reads settings of System Certificates
- optiver.exe (PID: 3844)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .zip | | | ZIP compressed archive (100) |
|---|
EXIF
ZIP
| ZipFileName: | optiver.exe |
|---|---|
| ZipUncompressedSize: | 58880 |
| ZipCompressedSize: | 20051 |
| ZipCRC: | 0x3d1fb25a |
| ZipModifyDate: | 2022:06:03 14:26:21 |
| ZipCompression: | Deflated |
| ZipBitFlag: | - |
| ZipRequiredVersion: | 20 |
Total processes
36
Monitored processes
2
Malicious processes
1
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 2568 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\optiver.zip" | C:\Program Files\WinRAR\WinRAR.exe | Explorer.EXE | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 | ||||
| 3844 | "C:\Users\admin\Desktop\optiver.exe" | C:\Users\admin\Desktop\optiver.exe | Explorer.EXE | |
User: admin Integrity Level: MEDIUM Description: Exit code: 0 Version: 1.0 | ||||
Total events
4 905
Read events
4 850
Write events
0
Delete events
0
Modification events
Executable files
1
Suspicious files
2
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3844 | optiver.exe | C:\Users\admin\AppData\Local\Temp\z2w3xsju.13p.psm1 | binary | |
MD5:C4CA4238A0B923820DCC509A6F75849B | SHA256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B | |||
| 3844 | optiver.exe | C:\Users\admin\AppData\Local\Temp\qnw2zrgr.4rm.ps1 | binary | |
MD5:C4CA4238A0B923820DCC509A6F75849B | SHA256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B | |||
| 2568 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2568.3466\optiver.exe | executable | |
MD5:325E44006268845412D2C2F44F743132 | SHA256:8EE0EC83AF08A6A096CBC6452ECE8B066695142B6BE3242A10D161CF53EFAC50 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
2
DNS requests
1
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3844 | optiver.exe | GET | 200 | 34.117.59.81:80 | http://ifconfig.me/ip | US | text | 13 b | shared |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3844 | optiver.exe | 34.117.59.81:80 | ifconfig.me | — | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
ifconfig.me |
| shared |
Threats
PID | Process | Class | Message |
|---|---|---|---|
3844 | optiver.exe | Potential Corporate Privacy Violation | ET POLICY External IP Lookup Domain (ifconfig .me) |
3844 | optiver.exe | Potential Corporate Privacy Violation | AV POLICY Internal Host Retrieving External IP Address (ifconfig. me) |
3844 | optiver.exe | Not Suspicious Traffic | ET INFO Windows Powershell User-Agent Usage |