analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

PC Defender v2.zip

Full analysis: https://app.any.run/tasks/5b088981-aca3-40b3-8098-c5e6f6f00a3f
Verdict: Malicious activity
Analysis date: July 12, 2020, 11:47:56
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

CAD618323B07C0F4F6273AE08DF1779E

SHA1:

E67715F81F83CE7CDA32F12A116CC950B6FD0DAC

SHA256:

854113F2737EE276BA34FAC399E8A615E4DE4C712DD7A761AB0E198FA09D87FC

SSDEEP:

24576:btiUqYRf3p96/VG8K8LtegdCDUcbdbbUJ9rV:btipYF3JategwDU029rV

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • rundelay.exe (PID: 3412)
      • rundelay.exe (PID: 3336)
      • pcdef.exe (PID: 2240)
      • prockill32.exe (PID: 2724)
      • prockill32.exe (PID: 604)
      • proccheck.exe (PID: 2816)

    • Changes the login/logoff helper path in the registry

      • MsiExec.exe (PID: 1500)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1856)
      • msiexec.exe (PID: 1852)

    • Executed as Windows Service

      • vssvc.exe (PID: 4004)

    • Changes the autorun value in the registry

      • MsiExec.exe (PID: 1500)

    • Starts CMD.EXE for commands execution

      • MsiExec.exe (PID: 1500)

    • Uses REG.EXE to modify Windows registry

      • MsiExec.exe (PID: 1500)

    • Application launched itself

      • rundelay.exe (PID: 3412)
      • prockill32.exe (PID: 2724)

    • Reads Internet Cache Settings

      • pcdef.exe (PID: 2240)

    • Reads internet explorer settings

      • pcdef.exe (PID: 2240)

  • INFO

    • Manual execution by user

      • msiexec.exe (PID: 3600)
      • pcdef.exe (PID: 2240)

    • Low-level read access rights to disk partition

      • vssvc.exe (PID: 4004)

    • Creates files in the program directory

      • msiexec.exe (PID: 1852)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 1852)

    • Application launched itself

      • msiexec.exe (PID: 1852)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0001
ZipCompression: Deflated
ZipModifyDate: 2010:09:07 16:00:01
ZipCRC: 0x5d6881a2
ZipCompressedSize: 808136
ZipUncompressedSize: 881152
ZipFileName: [email protected]
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
63
Monitored processes
16
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe msiexec.exe no specs msiexec.exe vssvc.exe no specs msiexec.exe reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs cmd.exe no specs rundelay.exe no specs rundelay.exe no specs pcdef.exe no specs prockill32.exe no specs prockill32.exe no specs proccheck.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1856"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\PC Defender v2.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
3600"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\Desktop\[email protected]" C:\Windows\System32\msiexec.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
1852C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
4004C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1500C:\Windows\system32\MsiExec.exe -Embedding DDA754D08C51D42742C0158485030E34 M Global\MSI0000C:\Windows\system32\MsiExec.exe
msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
2788"C:\Windows\System32\reg.exe" COPY HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\21B3A6546EF8EA14E9C5E5550F17C290 HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\21B3A6546EF8EA14E9C5E5550F17C290_ /s /fC:\Windows\System32\reg.exe—MsiExec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1156"C:\Windows\System32\reg.exe" COPY HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\21B3A6546EF8EA14E9C5E5550F17C290 HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\21B3A6546EF8EA14E9C5E5550F17C290_ /s /fC:\Windows\System32\reg.exe—MsiExec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3940"C:\Windows\System32\reg.exe" COPY HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\21B3A6546EF8EA14E9C5E5550F17C290 HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\21B3A6546EF8EA14E9C5E5550F17C290_ /s /fC:\Windows\System32\reg.exe—MsiExec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2124"C:\Windows\System32\reg.exe" DELETE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\21B3A6546EF8EA14E9C5E5550F17C290 /fC:\Windows\System32\reg.exe—MsiExec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2568"C:\Windows\System32\cmd.exe" /C "DEL /F /Q C:\Windows\Prefetch\pcdef*"C:\Windows\System32\cmd.exe—MsiExec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Total events
1 503
Read events
1 168
Write events
0
Delete events
0

Modification events

No data
Executable files
8
Suspicious files
5
Text files
41
Unknown types
2

Dropped files

PID
Process
Filename
Type
1852msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
1852msiexec.exeC:\Users\admin\AppData\Local\Temp\~DF8DCF8AB04C89F279.TMP —
MD5:—
SHA256:—
4004vssvc.exeC: —
MD5:—
SHA256:—
1852msiexec.exeC:\Users\admin\AppData\Local\Temp\~DF60C2431451524816.TMP —
MD5:—
SHA256:—
1852msiexec.exeC:\Windows\Installer\1262fa.ipibinary
MD5:30F1621CD62277371E8CB41C65965747
SHA256:34A48E43F32C3B70720BC99977DC52672430F84DE2174F6BADCA8B6AD8164B2F
1852msiexec.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:B2FF44E0AC384283C7A234158D45214F
SHA256:BEA4E76FDC7A90D2F2A46898FF6E587718FC4692DDF00A8E271CCF666CE85AA7
1852msiexec.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Defender\PC Defender.lnklnk
MD5:334E11B5565E7F0DA658FAA79822E433
SHA256:1D33DE3C666D4E409FA8B762911905E54D9142F3EFA2D5A097312DAD5E5A25C5
1852msiexec.exeC:\Windows\Installer\MSI69DE.tmpbinary
MD5:D25585372C60085A75E6F51CAD731816
SHA256:141CC795D5E4C0C5B1CDCCC62FC3FE668892EBDC75CF3FE3340CA8D7795F674E
1852msiexec.exeC:\System Volume Information\SPP\OnlineMetadataCache\{0b3c80c1-9d23-4c29-96ce-ac073ea5fdd3}_OnDiskSnapshotPropbinary
MD5:B2FF44E0AC384283C7A234158D45214F
SHA256:BEA4E76FDC7A90D2F2A46898FF6E587718FC4692DDF00A8E271CCF666CE85AA7
1852msiexec.exeC:\Config.Msi\1262fb.rbsbinary
MD5:3727FBF1B36FF42562CAE6B09D4016D4
SHA256:57384718B7ED2CCEBA12324013D8CDB3EADE0AD05A4CD8FC1DB4C6190670B19B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

Domain
IP
Reputation
pc-defender.org
  • —
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
PC Defender v2.zip