Malware analysis ALL OF MY GIFT CARD GENERATORS.zip Malicious activity

Add for printing

File name:	ALL OF MY GIFT CARD GENERATORS.zip
Full analysis:	https://app.any.run/tasks/aceec0bb-3818-49ea-bae6-a1a196254041
Verdict:	Malicious activity
Analysis date:	January 22, 2019, 14:01:44
OS:	Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME:	application/zip
File info:	Zip archive data, at least v2.0 to extract
MD5:	0C6DD7610CB5A1433286609F5E55B670
SHA1:	FA031A7916DB7ED77A73A3D73C511A7C95EBBD8F
SHA256:	8E4051054C07798538756D899888C4D29092F4B3A6A606A95857527BAEB68E3C
SSDEEP:	6144:FCrwHo73t/psCs5XCVZWpujrrHQwOwqNP+x5C0Wqr5gTgUi0bMxRaX:AOa3pHsXb8jNJwm7C0Wqr5FH0bM/G

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 60 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: none
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 8.0.7601.17514 undefined
Adobe Acrobat Reader DC MUI (15.023.20070)
Adobe Flash Player 26 ActiveX (26.0.0.131)
Adobe Flash Player 26 NPAPI (26.0.0.131)
Adobe Flash Player 26 PPAPI (26.0.0.131)
Adobe Refresh Manager (1.8.0)
CCleaner (5.35)
FileZilla Client 3.36.0 (3.36.0)
Google Chrome (68.0.3440.106)
Google Update Helper (1.3.33.17)
Java 8 Update 92 (8.0.920.14)
Java Auto Updater (2.8.92.14)
Microsoft .NET Framework 4.6.1 (4.6.01055)
Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Professional 2010 (14.0.6029.1000)
Microsoft Office Proof (English) 2010 (14.0.6029.1000)
Microsoft Office Proof (French) 2010 (14.0.6029.1000)
Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Single Image 2010 (14.0.6029.1000)
Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2017 Redistributable (x86) - 14.15.26706 (14.15.26706.0)
Microsoft Visual C++ 2017 x86 Additional Runtime - 14.15.26706 (14.15.26706)
Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.15.26706 (14.15.26706)
Mozilla Firefox 61.0.2 (x86 en-US) (61.0.2)
Notepad++ (32-bit x86) (7.5.1)
Opera 12.15 (12.15.1748)
Skype version 8.29 (8.29)
VLC media player (2.2.6)
WinRAR 5.60 (32-bit) (5.60.0)

Hotfixes

Client LanguagePack Package
Client Refresh LanguagePack Package
CodecPack Basic Package
Foundation Package
IE Troubleshooters Package
InternetExplorer Optional Package
KB2534111
KB2999226
KB976902
LocalPack AU Package
LocalPack CA Package
LocalPack GB Package
LocalPack US Package
LocalPack ZA Package
ProfessionalEdition
UltimateEdition

Add for printing

MALICIOUS
- Application was dropped or rewritten from another process
  - Gamestop Gift Card Generator v0.1 by Her.exe (PID: 3956)
  - Gamestop Gift Card Generator v0.1 by Her.exe (PID: 3764)
  - CC Generator v0.1 by Her.exe (PID: 3740)
  - iTunes Gift Card Generator v0.1.exe (PID: 3408)
  - Nintendo eShop Gift Card Generator v1.0.exe (PID: 3264)
  - Amazon Gift Card Generator v0.4.exe (PID: 2128)
  - Roblox Robux Code Generator by Her.exe (PID: 3596)
SUSPICIOUS
- Starts CMD.EXE for commands execution
  - Gamestop Gift Card Generator v0.1 by Her.exe (PID: 3956)
  - CC Generator v0.1 by Her.exe (PID: 3740)
  - Gamestop Gift Card Generator v0.1 by Her.exe (PID: 3764)
  - iTunes Gift Card Generator v0.1.exe (PID: 3408)
  - Amazon Gift Card Generator v0.4.exe (PID: 2128)
  - Nintendo eShop Gift Card Generator v1.0.exe (PID: 3264)
- Executable content was dropped or overwritten
  - WinRAR.exe (PID: 2728)
INFO
No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.zip	\|	ZIP compressed archive (100)

EXIF

ZIP

ZipFileName:	Gamestop Gift Card Generator v0.1 by Her.exe
ZipUncompressedSize:	91136
ZipCompressedSize:	49997
ZipCRC:	0xec12953a
ZipModifyDate:	2018:09:13 16:31:05
ZipCompression:	Deflated
ZipBitFlag:	-
ZipRequiredVersion:	20

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

2728

"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\ALL OF MY GIFT CARD GENERATORS.zip"

C:\Program Files\WinRAR\WinRAR.exe

explorer.exe

User:

admin

Company:

Alexander Roshal

Integrity Level:

MEDIUM

Description:

WinRAR archiver

Version:

5.60.0

Modules

Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll

2128

"C:\Users\admin\AppData\Local\Temp\Rar$EXa2728.22426\Amazon Gift Card Generator v0.4.exe"

C:\Users\admin\AppData\Local\Temp\Rar$EXa2728.22426\Amazon Gift Card Generator v0.4.exe

—

WinRAR.exe

User:

admin

Integrity Level:

MEDIUM

Exit code:

Modules

Images
c:\users\admin\appdata\local\temp\rar$exa2728.22426\amazon gift card generator v0.4.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll

3420

"C:\Windows\system32\cmd" /c "C:\Users\admin\AppData\Local\Temp\7465.tmp\7466.tmp\7467.bat "C:\Users\admin\AppData\Local\Temp\Rar$EXa2728.22426\Amazon Gift Card Generator v0.4.exe""

C:\Windows\system32\cmd.exe

—

Amazon Gift Card Generator v0.4.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows Command Processor

Exit code:

4294967295

Version:

6.1.7601.17514 (win7sp1_rtm.101119-1850)

Modules

Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll

2660

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\Temp\Rar$DIa2728.24264\amazon_codes.txt

C:\Windows\system32\NOTEPAD.EXE

—

WinRAR.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Notepad

Exit code:

Version:

6.1.7600.16385 (win7_rtm.090713-1255)

Modules

Images
c:\windows\system32\notepad.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll

3740

"C:\Users\admin\AppData\Local\Temp\Rar$EXa2728.24618\CC Generator v0.1 by Her.exe"

C:\Users\admin\AppData\Local\Temp\Rar$EXa2728.24618\CC Generator v0.1 by Her.exe

—

WinRAR.exe

User:

admin

Integrity Level:

MEDIUM

Exit code:

Modules

Images
c:\users\admin\appdata\local\temp\rar$exa2728.24618\cc generator v0.1 by her.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll

2428

"C:\Windows\system32\cmd" /c "C:\Users\admin\AppData\Local\Temp\CA07.tmp\CA08.tmp\CA09.bat "C:\Users\admin\AppData\Local\Temp\Rar$EXa2728.24618\CC Generator v0.1 by Her.exe""

C:\Windows\system32\cmd.exe

—

CC Generator v0.1 by Her.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows Command Processor

Exit code:

3221225786

Version:

6.1.7601.17514 (win7sp1_rtm.101119-1850)

Modules

Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll

3956

"C:\Users\admin\AppData\Local\Temp\Rar$EXa2728.25734\Gamestop Gift Card Generator v0.1 by Her.exe"

C:\Users\admin\AppData\Local\Temp\Rar$EXa2728.25734\Gamestop Gift Card Generator v0.1 by Her.exe

—

WinRAR.exe

User:

admin

Integrity Level:

MEDIUM

Exit code:

Modules

Images
c:\users\admin\appdata\local\temp\rar$exa2728.25734\gamestop gift card generator v0.1 by her.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll

2736

"C:\Windows\system32\cmd" /c "C:\Users\admin\AppData\Local\Temp\F55D.tmp\F55E.tmp\F55F.bat "C:\Users\admin\AppData\Local\Temp\Rar$EXa2728.25734\Gamestop Gift Card Generator v0.1 by Her.exe""

C:\Windows\system32\cmd.exe

—

Gamestop Gift Card Generator v0.1 by Her.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows Command Processor

Exit code:

3221225786

Version:

6.1.7601.17514 (win7sp1_rtm.101119-1850)

Modules

Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll

3764

"C:\Users\admin\AppData\Local\Temp\Rar$EXa2728.26168\Gamestop Gift Card Generator v0.1 by Her.exe"

C:\Users\admin\AppData\Local\Temp\Rar$EXa2728.26168\Gamestop Gift Card Generator v0.1 by Her.exe

—

WinRAR.exe

User:

admin

Integrity Level:

MEDIUM

Exit code:

3221225786

Modules

Images
c:\users\admin\appdata\local\temp\rar$exa2728.26168\gamestop gift card generator v0.1 by her.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll

2528

"C:\Windows\system32\cmd" /c "C:\Users\admin\AppData\Local\Temp\655.tmp\656.tmp\657.bat "C:\Users\admin\AppData\Local\Temp\Rar$EXa2728.26168\Gamestop Gift Card Generator v0.1 by Her.exe""

C:\Windows\system32\cmd.exe

—

Gamestop Gift Card Generator v0.1 by Her.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows Command Processor

Exit code:

3221225786

Version:

6.1.7601.17514 (win7sp1_rtm.101119-1850)

Modules

Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll

Add for printing

Total events

561

Read events

537

Write events

Delete events

Modification events


(PID) Process:	(2728) WinRAR.exe	Key:	HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:	write	Name:	ShellExtBMP
Value:
(PID) Process:	(2728) WinRAR.exe	Key:	HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:	write	Name:	ShellExtIcon
Value:
(PID) Process:	(2728) WinRAR.exe	Key:	HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
Operation:	write	Name:	LanguageList
Value: en-US
(PID) Process:	(2728) WinRAR.exe	Key:	HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:	write	Name:	0
Value: C:\Users\admin\AppData\Local\Temp\ALL OF MY GIFT CARD GENERATORS.zip
(PID) Process:	(2728) WinRAR.exe	Key:	HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	name
Value: 120
(PID) Process:	(2728) WinRAR.exe	Key:	HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	size
Value: 80
(PID) Process:	(2728) WinRAR.exe	Key:	HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	type
Value: 120
(PID) Process:	(2728) WinRAR.exe	Key:	HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	mtime
Value: 100
(PID) Process:	(2728) WinRAR.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	UNCAsIntranet
Value: 0
(PID) Process:	(2728) WinRAR.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	AutoDetect
Value: 1

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
3420	cmd.exe	C:\Users\admin\AppData\Local\Temp\Rar$EXa2728.22426\amazon_codes.txt		text
		MD5:2B21148E7D6A7C95798C5BEEF9D83BA9	SHA256:3B523D53FED78BFB09546AD37EBBA8BB790F44475570DE099516A426247021B5
2728	WinRAR.exe	C:\Users\admin\AppData\Local\Temp\Rar$EXa2728.22426\iTunes Gift Card Generator v0.1.exe		executable
		MD5:8331AE18FDA9CD5CD12E8CC3C979CB13	SHA256:1D4394B67F1724802C2883A45D886A1D8807B01327C7756D51673F6D9285902C
2728	WinRAR.exe	C:\Users\admin\AppData\Local\Temp\Rar$EXa2728.22426\CC Generator v0.1 by Her.exe		executable
		MD5:E17F4B9342571FB2D77CB34F36BCE452	SHA256:754DEA92817B5EE622AB2EC9F839FB5845B74A737687AA52465BA785A6A92B1A
2728	WinRAR.exe	C:\Users\admin\AppData\Local\Temp\Rar$EXa2728.22426\Nintendo eShop Gift Card Generator v1.0.exe		executable
		MD5:98E4CC0729B3FC5B4AEBA4138ABE4CCD	SHA256:BB853A2CA6EB86A802E496BF03BCE5AE044ECF948F7CE3A81D1F1D3E69735A58
2728	WinRAR.exe	C:\Users\admin\AppData\Local\Temp\__rzi_2728.24103		—
		MD5:—	SHA256:—
2728	WinRAR.exe	C:\Users\admin\AppData\Local\Temp\Rar$EXa2728.22426\Gamestop Gift Card Generator v0.1 by Her.exe		executable
		MD5:F6A57131F8F943FB0712EA08EA729066	SHA256:8E2A4D49B201F992C46869E200BCD5D9E165C80A72CB6D8AD21F0FF863AD38FA
2128	Amazon Gift Card Generator v0.4.exe	C:\Users\admin\AppData\Local\Temp\7465.tmp\7466.tmp\7467.bat		text
		MD5:5EA459DBB4D690AFAAC71534AE05460A	SHA256:0C9260E618705D3F0212856E01A987492971B66F9A356A45F28A4413DA4BAEAC
2728	WinRAR.exe	C:\Users\admin\AppData\Local\Temp\Rar$EXa2728.22426\Amazon Gift Card Generator v0.4.exe		executable
		MD5:DA6506145B08374DAE0EA0403692B6AA	SHA256:D246CB1E465655621B293404E40A58D6332F6EA88C0B032BCF6294027520BA53
2728	WinRAR.exe	C:\Users\admin\AppData\Local\Temp\Rar$EXa2728.22426\Roblox Robux Code Generator by Her.exe		executable
		MD5:7F7F3C3F29BE1B77D8A11911A65037D0	SHA256:EE4B3E701080647C22CD5D1978C23202F0A06C50CC4276D889844C6EE4A8D10C
2728	WinRAR.exe	C:\Users\admin\AppData\Local\Temp\Rar$EXa2728.24618\Nintendo eShop Gift Card Generator v1.0.exe		executable
		MD5:98E4CC0729B3FC5B4AEBA4138ABE4CCD	SHA256:BB853A2CA6EB86A802E496BF03BCE5AE044ECF948F7CE3A81D1F1D3E69735A58

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

No HTTP requests

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected

Add for printing

No debug info

General Info

ALL OF MY GIFT CARD GENERATORS.zip

0C6DD7610CB5A1433286609F5E55B670

FA031A7916DB7ED77A73A3D73C511A7C95EBBD8F

8E4051054C07798538756D899888C4D29092F4B3A6A606A95857527BAEB68E3C

6144:FCrwHo73t/psCs5XCVZWpujrrHQwOwqNP+x5C0Wqr5gTgUi0bMxRaX:AOa3pHsXb8jNJwm7C0Wqr5FH0bM/G

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Application was dropped or rewritten from another process

SUSPICIOUS

Starts CMD.EXE for commands execution

Executable content was dropped or overwritten

INFO

Malware configuration

Static information

TRiD

EXIF

ZIP

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings