analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| download: | Launcher_x64.zip |
| Full analysis: | https://app.any.run/tasks/9cc71283-63cf-4024-a023-c8c9f66b3cba |
| Verdict: | Malicious activity |
| Analysis date: | January 18, 2020, 10:52:08 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v1.0 to extract |
| MD5: | DCF05FD51D73E24501938EB0DB3DD1D2 |
| SHA1: | 8CE7A76C9CCDD4D4D2D8BF9EBDFC2719C09F122B |
| SHA256: | 89F169FB5B5C48B159267BAFCD99A305F1893D33E63E683BA5F7A3A38E14F0DF |
| SSDEEP: | 98304:vq72XgABrSzxYkvEFKOV/vgvpsQrEEY8mrYZLuaPwzN9WFSfwXM2NV8:vJXAzxFvrORmsCG8WyLuaPwzLfvUV8 |
MALICIOUS
Loads dropped or rewritten executable
- SearchProtocolHost.exe (PID: 3460)
Application was dropped or rewritten from another process
- Install.exe (PID: 4056)
- Install.exe (PID: 2932)
SUSPICIOUS
Creates files in the user directory
- Install.exe (PID: 4056)
INFO
Manual execution by user
- Install.exe (PID: 2932)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .xpi | | | Mozilla Firefox browser extension (66.6) |
|---|---|---|
| .zip | | | ZIP compressed archive (33.3) |
EXIF
ZIP
| ZipRequiredVersion: | 10 |
|---|---|
| ZipBitFlag: | - |
| ZipCompression: | None |
| ZipModifyDate: | 2019:11:09 21:47:21 |
| ZipCRC: | 0x00000000 |
| ZipCompressedSize: | - |
| ZipUncompressedSize: | - |
| ZipFileName: | en-US/ |
Total processes
37
Monitored processes
4
Malicious processes
0
Suspicious processes
3
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 836 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Launcher_x64.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 | ||||
| 3460 | "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" | C:\Windows\System32\SearchProtocolHost.exe | — | SearchIndexer.exe |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft Windows Search Protocol Host Version: 7.00.7600.16385 (win7_rtm.090713-1255) | ||||
| 2932 | "C:\Users\admin\Desktop\Install.exe" | C:\Users\admin\Desktop\Install.exe | — | explorer.exe |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
| 4056 | "C:\Users\admin\Desktop\Install.exe" | C:\Users\admin\Desktop\Install.exe | Install.exe | |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
Total events
740
Read events
688
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
0
Text files
1
Unknown types
1
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 836 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa836.26214\en-US\lan-eng.lg | — | |
MD5:— | SHA256:— | |||
| 836 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa836.26214\inc\bin.dll | — | |
MD5:— | SHA256:— | |||
| 836 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa836.26214\xperm.dll | — | |
MD5:— | SHA256:— | |||
| 836 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa836.26214\Install.exe | — | |
MD5:— | SHA256:— | |||
| 4056 | Install.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@mywps[1].txt | text | |
MD5:A87EE3A14B095114E9BA7F1A51D7C6FC | SHA256:31879835A871C29CAA6162CE8B87FF05FF27615C4A054526EEA999D5C215ABA8 | |||
| 4056 | Install.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat | dat | |
MD5:D7A950FEFD60DBAA01DF2D85FEFB3862 | SHA256:75D0B1743F61B76A35B1FEDD32378837805DE58D79FA950CB6E8164BFA72073A | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
1
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4056 | Install.exe | 104.18.56.40:443 | fiasyfssa.mywps.me | Cloudflare Inc | US | suspicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
fiasyfssa.mywps.me |
| suspicious |