download:

Dism++10.1.1000.62_5d35def1c0b5a229d59e80b03b3353e693b0c8ae.zip

Full analysis: https://app.any.run/tasks/08f91807-1402-43e7-9b49-96329827e81b
Verdict: Malicious activity
Analysis date: March 18, 2018, 16:06:34
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

C80E5927B92CBB250BDDF59561F954E5

SHA1:

5D35DEF1C0B5A229D59E80B03B3353E693B0C8AE

SHA256:

92376874A5C1AD6F97E4828E65F497E541D99B3E2DB409DE7606B1816694572E

SSDEEP:

49152:3KtXTQzT6J6H4lc8gDnkguofPPN7o6LrlAMpiPOqV+NWmN1d+bvqF7zc1YGxodUY:3KtQSETJnkgdriQTe+NbNGSNzc1YSoKO

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application loaded dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 2008)
      • rundll32.exe (PID: 2368)
      • Dism++x86.exe (PID: 3792)

    • Application was dropped or rewritten from another process

      • Dism++x86.exe (PID: 3720)
      • Dism++x86.exe (PID: 3792)

    • Loads the Task Scheduler COM API

      • explorer.exe (PID: 3060)
      • explorer.exe (PID: 1884)

  • SUSPICIOUS

    • Creates files in the user directory

      • Dism++x86.exe (PID: 3792)

    • Creates files in the Windows directory

      • TrustedInstaller.exe (PID: 3108)
      • Dism++x86.exe (PID: 3792)

    • Modifies files in the system directory

      • TrustedInstaller.exe (PID: 3108)
      • vssvc.exe (PID: 3008)

    • Low-level read access rights to disk partition

      • vssvc.exe (PID: 3008)

    • Creates or modifies windows services

      • DllHost.exe (PID: 2680)
      • Dism++x86.exe (PID: 3792)
      • DllHost.exe (PID: 2600)
      • vssvc.exe (PID: 3008)

    • Writes to a desktop.ini file (may be used to cloak folders)

      • explorer.exe (PID: 3060)
      • explorer.exe (PID: 1884)

    • Removes files from Windows directory

      • Dism++x86.exe (PID: 3792)
      • rundll32.exe (PID: 2368)

  • INFO

    • Dropped object may contain URL's

      • 7zFM.exe (PID: 3000)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2018:03:17 14:31:10
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: Config/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
54
Monitored processes
11
Malicious processes
7
Suspicious processes
2

Behavior graph

Click at the process to see the details
start 7zfm.exe searchprotocolhost.exe no specs dism++x86.exe no specs dism++x86.exe rundll32.exe no specs trustedinstaller.exe no specs vssvc.exe no specs SPPSurrogate no specs explorer.exe explorer.exe SPPSurrogate no specs

Process information

PID
CMD
Path
Indicators
Parent process
1884"C:\Windows\explorer.exe"C:\Windows\explorer.exe
Dism++x86.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2008"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe6_ Global\UsGthrCtrlFltPipeMssGthrPipe6 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2368rundll32 "C:\Users\admin\Desktop\Config\x86\CBSHost.dll",RunCbsHost {d46a92b7-0cd2-4077-86a0-e017ef5e23fb} "C:" "\\?\C:\Windows\Temp\\" 000000A8 4C:\Windows\System32\rundll32.exe—Dism++x86.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
2600C:\Windows\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801}C:\Windows\system32\DllHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2680C:\Windows\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801}C:\Windows\system32\DllHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3000"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\admin\AppData\Local\Temp\Dism++10.1.1000.62_5d35def1c0b5a229d59e80b03b3353e693b0c8ae.zip"C:\Program Files\7-Zip\7zFM.exe
explorer.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
MEDIUM
Description:
7-Zip File Manager
Exit code:
0
Version:
16.04
Modules
Images
c:\program files\7-zip\7zfm.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3008C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3060"C:\Windows\explorer.exe"C:\Windows\explorer.exe
Dism++x86.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3108C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Modules Installer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\servicing\trustedinstaller.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
3720"C:\Users\admin\Desktop\Dism++x86.exe" C:\Users\admin\Desktop\Dism++x86.exe—explorer.exe
User:
admin
Company:
Chuyu Team
Integrity Level:
MEDIUM
Description:
Dism++主程序
Exit code:
3221226540
Version:
10.1.1000.62
Modules
Images
c:\users\admin\desktop\dism++x86.exe
c:\systemroot\system32\ntdll.dll
Total events
9 608
Read events
8 826
Write events
775
Delete events
7

Modification events

(PID) Process:(2008) SearchProtocolHost.exeKey:HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\8F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2008) SearchProtocolHost.exeKey:HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\8F\52C64B7E
Operation:writeName:@C:\Windows\system32\notepad.exe,-469
Value:
Text Document
(PID) Process:(3000) 7zFM.exeKey:HKEY_CURRENT_USER\Software\7-Zip\FM
Operation:writeName:FolderShortcuts
Value:
(PID) Process:(3000) 7zFM.exeKey:HKEY_CURRENT_USER\Software\7-Zip\FM
Operation:writeName:FolderHistory
Value:
43003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C004C006F00630061006C005C00540065006D0070005C004400690073006D002B002B00310030002E0031002E0031003000300030002E00360032005F0035006400330035006400650066003100630030006200350061003200320039006400350039006500380030006200300033006200330033003500330065003600390033006200300063003800610065002E007A00690070005C000000
(PID) Process:(3000) 7zFM.exeKey:HKEY_CURRENT_USER\Software\7-Zip\FM
Operation:writeName:PanelPath0
Value:
C:\Users\admin\AppData\Local\Temp\
(PID) Process:(3000) 7zFM.exeKey:HKEY_CURRENT_USER\Software\7-Zip\FM
Operation:writeName:FlatViewArc0
Value:
0
(PID) Process:(3000) 7zFM.exeKey:HKEY_CURRENT_USER\Software\7-Zip\FM
Operation:writeName:PanelPath1
Value:
(PID) Process:(3000) 7zFM.exeKey:HKEY_CURRENT_USER\Software\7-Zip\FM
Operation:writeName:FlatViewArc1
Value:
0
(PID) Process:(3000) 7zFM.exeKey:HKEY_CURRENT_USER\Software\7-Zip\FM
Operation:writeName:ListMode
Value:
771
(PID) Process:(3000) 7zFM.exeKey:HKEY_CURRENT_USER\Software\7-Zip\FM
Operation:writeName:Position
Value:
1B010000B6000000DB040000AB02000001000000
Executable files
7
Suspicious files
30
Text files
40
Unknown types
3

Dropped files

PID
Process
Filename
Type
30007zFM.exeC:\Users\admin\AppData\Local\Temp\7zE8BBF62E2\Config\amd64\CBSHost.dllexecutable
MD5:—
SHA256:—
30007zFM.exeC:\Users\admin\AppData\Local\Temp\7zE8BBF62E2\Config\Languages\cs.zipcompressed
MD5:—
SHA256:—
30007zFM.exeC:\Users\admin\AppData\Local\Temp\7zE8BBF62E2\Config\Languages\es.zipcompressed
MD5:—
SHA256:—
30007zFM.exeC:\Users\admin\AppData\Local\Temp\7zE8BBF62E2\Config\amd64\NCleaner.dllexecutable
MD5:—
SHA256:—
30007zFM.exeC:\Users\admin\AppData\Local\Temp\7zE8BBF62E2\Config\Plugins\FrogPlugins_Pcn7FMvReAsVWfCQBfRJCw\PluginRes.dll —
MD5:—
SHA256:—
30007zFM.exeC:\Users\admin\AppData\Local\Temp\7zE8BBF62E2\Config\UpdateInfo.zip —
MD5:—
SHA256:—
30007zFM.exeC:\Users\admin\AppData\Local\Temp\7zE8BBF62E2\Config\x86\bcdboot.exe —
MD5:—
SHA256:—
30007zFM.exeC:\Users\admin\AppData\Local\Temp\7zE8BBF62E2\Config\x86\CBSHost.dll —
MD5:—
SHA256:—
30007zFM.exeC:\Users\admin\AppData\Local\Temp\7zE8BBF62E2\Config\x86\NCleaner.dll —
MD5:—
SHA256:—
30007zFM.exeC:\Users\admin\AppData\Local\Temp\7zE8BBF62E2\Config\x86\wimgapi.dll —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
POST
200
111.206.47.207:80
http://web1612151818153.bj01.bdysite.com/chuyu-analysis/client_update.php
CN
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
111.206.47.207:80
web1612151818153.bj01.bdysite.com
China Unicom Beijing Province Network
CN
unknown

DNS requests

Domain
IP
Reputation
web1612151818153.bj01.bdysite.com
  • 111.206.47.207
  • 111.206.38.21
  • 119.188.131.130
malicious

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Dism++10.1.1000.62_5d35def1c0b5a229d59e80b03b3353e693b0c8ae.zip