File name:

z08050095140162100000682.zip

Full analysis: https://app.any.run/tasks/7b5f117d-3627-47bd-bdab-bbae04499fb2
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Malware Trends Tracker     >>>
Analysis date: April 25, 2021, 14:38:37
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

0C8D9A3410A6FD76379417F7C469F8BC

SHA1:

482A2EEAAE616557EAB2CA8A62295E2076B28BE8

SHA256:

9238C34148B95C4346F5EC9A609C70EBEE17209202D75B07B7DE7A0560F4D605

SSDEEP:

768:XNMnBWi8+mHiHl86h8h1nNfJgt/UXX4yxBVl0ujxrDxPwSD1mn4Amy+w+1:WBG+Wia6hmnNBe/UXIEX0aFDV71ppJ1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • winzip25-downwz.exe (PID: 688)
      • winzip25-downwz.exe (PID: 1464)
      • winzip25-downwz.exe (PID: 3592)
      • CloseFAH.exe (PID: 3044)
      • WzCABCacheSyncHelper32.exe (PID: 2504)
      • WzPreviewer32.exe (PID: 2092)
      • adxregistrator.exe (PID: 3748)
      • WzPreloader.exe (PID: 3708)
      • FAHConsole.exe (PID: 2904)
      • FAHWindow32.exe (PID: 1616)
      • adxregistrator.exe (PID: 2256)
      • WZUpdateNotifier.exe (PID: 2560)
      • WzBGTools32.exe (PID: 2420)
      • WzBGTComServer32.exe (PID: 1816)
      • WzCABCacheSyncHelper32.exe (PID: 3100)
      • FAH.exe (PID: 1568)
      • WzCABCacheSyncHelper32.exe (PID: 3848)

    • Drops executable file immediately after starts

      • winzip25-downwz.exe (PID: 688)
      • msiexec.exe (PID: 3372)

    • Connects to CnC server

      • winzip25-downwz.exe (PID: 3592)

    • Changes settings of System certificates

      • winzip25-downwz.exe (PID: 3592)
      • MsiExec.exe (PID: 920)

    • Loads dropped or rewritten executable

      • WzCABCacheSyncHelper32.exe (PID: 2504)
      • winzip32.exe (PID: 2404)
      • svchost.exe (PID: 872)
      • csrss.exe (PID: 392)
      • adxregistrator.exe (PID: 3748)
      • FAHWindow32.exe (PID: 1616)
      • adxregistrator.exe (PID: 2256)
      • explorer.exe (PID: 568)
      • winzip32.exe (PID: 2432)
      • WzBGTools32.exe (PID: 2420)
      • WzCABCacheSyncHelper32.exe (PID: 3100)
      • WzCABCacheSyncHelper32.exe (PID: 3848)
      • FAH.exe (PID: 1568)
      • winzip32.exe (PID: 3700)
      • winzip32.exe (PID: 1524)

    • Writes to a start menu file

      • msiexec.exe (PID: 3372)

    • Runs injected code in another process

      • FAHWindow32.exe (PID: 1616)

    • Application was injected by another process

      • explorer.exe (PID: 568)

    • Loads the Task Scheduler COM API

      • winzip32.exe (PID: 2432)

  • SUSPICIOUS

    • Uses RUNDLL32.EXE to load library

      • explorer.exe (PID: 568)
      • FAH.exe (PID: 1568)

    • Starts Internet Explorer

      • explorer.exe (PID: 568)

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 2580)
      • iexplore.exe (PID: 3500)
      • winzip25-downwz.exe (PID: 688)
      • msiexec.exe (PID: 3372)
      • winzip32.exe (PID: 2432)

    • Starts itself from another location

      • winzip25-downwz.exe (PID: 688)

    • Reads internet explorer settings

      • winzip25-downwz.exe (PID: 3592)
      • MsiExec.exe (PID: 920)
      • winzip32.exe (PID: 2432)
      • winzip32.exe (PID: 3700)

    • Creates files in the program directory

      • winzip25-downwz.exe (PID: 3592)
      • winzip32.exe (PID: 2404)
      • winzip32.exe (PID: 2432)

    • Adds / modifies Windows certificates

      • winzip25-downwz.exe (PID: 3592)
      • MsiExec.exe (PID: 920)

    • Drops a file with a compile date too recent

      • msiexec.exe (PID: 3372)

    • Drops a file with too old compile date

      • msiexec.exe (PID: 3372)

    • Creates a directory in Program Files

      • msiexec.exe (PID: 3372)

    • Changes the autorun value in the registry

      • msiexec.exe (PID: 3372)

    • Changes IE settings (feature browser emulation)

      • MsiExec.exe (PID: 920)
      • msiexec.exe (PID: 3372)

    • Drops a file that was compiled in debug mode

      • msiexec.exe (PID: 3372)
      • winzip32.exe (PID: 2432)

    • Creates a software uninstall entry

      • winzip32.exe (PID: 2404)

    • Creates files in the user directory

      • winzip32.exe (PID: 2404)
      • winzip32.exe (PID: 2432)
      • explorer.exe (PID: 568)
      • winzip32.exe (PID: 3700)

    • Changes default file association

      • winzip32.exe (PID: 2404)
      • msiexec.exe (PID: 3372)
      • rundll32.exe (PID: 692)

    • Creates files in the Windows directory

      • MsiExec.exe (PID: 920)
      • winzip32.exe (PID: 2404)
      • svchost.exe (PID: 872)

    • Creates/Modifies COM task schedule object

      • winzip32.exe (PID: 2404)
      • adxregistrator.exe (PID: 3748)
      • adxregistrator.exe (PID: 2256)
      • MsiExec.exe (PID: 920)

    • Loads DLL from Mozilla Firefox

      • csrss.exe (PID: 392)

    • Reads Environment values

      • winzip32.exe (PID: 2432)
      • winzip32.exe (PID: 3700)

  • INFO

    • Manual execution by user

      • iexplore.exe (PID: 3500)

    • Changes internet zones settings

      • iexplore.exe (PID: 3500)

    • Application launched itself

      • iexplore.exe (PID: 3500)

    • Reads internet explorer settings

      • iexplore.exe (PID: 1440)
      • iexplore.exe (PID: 2580)
      • iexplore.exe (PID: 3492)
      • iexplore.exe (PID: 1724)

    • Creates files in the user directory

      • iexplore.exe (PID: 1440)
      • iexplore.exe (PID: 2580)
      • iexplore.exe (PID: 3500)
      • iexplore.exe (PID: 3492)
      • iexplore.exe (PID: 1724)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 1440)
      • iexplore.exe (PID: 2580)
      • iexplore.exe (PID: 3500)
      • winzip25-downwz.exe (PID: 3592)
      • msiexec.exe (PID: 3372)
      • winzip32.exe (PID: 2404)
      • iexplore.exe (PID: 3492)
      • winzip32.exe (PID: 2432)
      • iexplore.exe (PID: 1724)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3500)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 3500)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3500)

    • Searches for installed software

      • msiexec.exe (PID: 3372)

    • Dropped object may contain Bitcoin addresses

      • msiexec.exe (PID: 3372)
      • winzip25-downwz.exe (PID: 3592)
      • winzip32.exe (PID: 2432)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 3372)

    • Creates files in the program directory

      • msiexec.exe (PID: 3372)
      • MsiExec.exe (PID: 920)

    • Loads dropped or rewritten executable

      • MsiExec.exe (PID: 920)
      • msiexec.exe (PID: 3372)

    • Reads Microsoft Office registry keys

      • adxregistrator.exe (PID: 3748)
      • adxregistrator.exe (PID: 2256)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.ubox | Universe Sandbox simulation (75)
.zip | ZIP compressed archive (24.9)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2021:04:23 19:28:04
ZipCRC: 0xc0cbcfff
ZipCompressedSize: 10757
ZipUncompressedSize: 41253
ZipFileName: ad08050095140162100000682.xml
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
86
Monitored processes
34
Malicious processes
21
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start inject rundll32.exe no specs iexplore.exe iexplore.exe iexplore.exe winzip25-downwz.exe no specs winzip25-downwz.exe winzip25-downwz.exe closefah.exe no specs wzpreviewer32.exe no specs wzpreloader.exe no specs wzcabcachesynchelper32.exe winzip32.exe msiexec.exe svchost.exe msiexec.exe csrss.exe no specs fahconsole.exe no specs fahwindow32.exe no specs adxregistrator.exe no specs adxregistrator.exe no specs explorer.exe wzbgtcomserver32.exe no specs wzupdatenotifier.exe no specs wzbgtools32.exe no specs iexplore.exe winzip32.exe wzcabcachesynchelper32.exe no specs iexplore.exe fah.exe no specs rundll32.exe no specs winzip32.exe no specs wzcabcachesynchelper32.exe no specs winzip32.exe no specs winzip32.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
392%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16C:\Windows\System32\csrss.exe——
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Client Server Runtime Process
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\csrss.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\csrsrv.dll
c:\windows\system32\basesrv.dll
c:\windows\system32\winsrv.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\lpk.dll
568C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\winanr.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\wshtcpip.dll
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
688"C:\Users\admin\Downloads\winzip25-downwz.exe" C:\Users\admin\Downloads\winzip25-downwz.exe
iexplore.exe
User:
admin
Company:
WinZip Computing
Integrity Level:
HIGH
Description:
WinZipStub Installer
Exit code:
0
Version:
25.0.14273.0
Modules
Images
c:\users\admin\downloads\winzip25-downwz.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\lpk.dll
692"C:\Windows\system32\rundll32.exe" shell32.dll,OpenAs_RunDLL C:\Users\admin\Desktop\z08050095140162100000682.zip.uboxC:\Windows\system32\rundll32.exe—FAH.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
872C:\Windows\system32\svchost.exe -k netsvcsC:\Windows\System32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\host.exe
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
920C:\Windows\system32\MsiExec.exe -Embedding DD0E8515765FC417D981894EDB5E20A4 M Global\MSI0000C:\Windows\system32\MsiExec.exe
msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1440"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3500 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
1464"C:\Users\admin\Downloads\winzip25-downwz.exe" C:\Users\admin\Downloads\winzip25-downwz.exe—iexplore.exe
User:
admin
Company:
WinZip Computing
Integrity Level:
MEDIUM
Description:
WinZipStub Installer
Exit code:
3221226540
Version:
25.0.14273.0
Modules
Images
c:\users\admin\downloads\winzip25-downwz.exe
c:\systemroot\system32\ntdll.dll
1524"C:\Program Files\WinZip\winzip32.exe" "C:\Users\admin\Desktop\z08050095140162100000682.zip.ubox"C:\Program Files\WinZip\winzip32.exe—explorer.exe
User:
admin
Company:
WinZip Computing
Integrity Level:
MEDIUM
Description:
WinZip
Exit code:
0
Version:
50.250.14273 (32-bit)
Modules
Images
c:\program files\winzip\winzip32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wininet.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
1568"C:\Program Files\WinZip\FAH.exe" "C:\Users\admin\Desktop\z08050095140162100000682.zip.ubox"C:\Program Files\WinZip\FAH.exe—explorer.exe
User:
admin
Company:
WinZip Computing, S.L.
Integrity Level:
MEDIUM
Description:
File Association Helper
Exit code:
1
Version:
3.0.0.11
Modules
Images
c:\program files\winzip\fah.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
13 207
Read events
10 214
Write events
2 959
Delete events
34

Modification events

(PID) Process:(872) svchost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum
Operation:writeName:F1
Value:
F100000000000000
(PID) Process:(872) svchost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\CoDeviceInstallers
Operation:writeName:AeFileID
Value:
300030003000300037003900370065006500350033006600340039003700330062003400330035003900330032006300350037003300660030003400310033006100660064003500390037003700620061006600300065000000
(PID) Process:(872) svchost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\CoDeviceInstallers
Operation:writeName:AeProgramID
Value:
300030003000300064006100330039006100330065006500350065003600620034006200300064003300320035003500620066006500660039003500360030003100380039003000610066006400380030003700300039000000
(PID) Process:(568) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
01000000D08C9DDF0115D1118C7A00C04FC297EB01000000DAC8F9CEC0FCD648B813F1CAF1E3886600000000020000000000106600000001000020000000407FCFF4B0B6816FAD7E65E23EB9B8C1D2842E9CC6F0118E6F37BD151A5566DB000000000E80000000020000200000003250AA04646FA70FFC0A5FA1AC6F096258BC47098456D35D246B24588FBB04E1300000004D9A2FE5195F3DB9C002D2C4AED7643437271A601BE7E92323F3C6CF3E2C4E27BD6F9304943B52585D26AE7E6B7D09DF400000003233C1A6D03AF5A55F9FFEF481231D988CB5AF323B0372EFB609CF8F32F0C438E201E83C919B91CF3BD3D48070B164393EB43051AB13C1A987E9381919EE103F
(PID) Process:(568) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(568) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:@"%windir%\System32\ie4uinit.exe",-732
Value:
Finds and displays information and Web sites on the Internet.
(PID) Process:(568) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count
Operation:writeName:Zvpebfbsg.VagreargRkcybere.Qrsnhyg
Value:
000000000400000001000000D7250000000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BFFFFFFFFFF0BFE5BCE039D70100000000
(PID) Process:(568) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count
Operation:writeName:HRZR_PGYFRFFVBA
Value:
000000006B0000009D000000CE7946001000000034000000869716007B00460033003800420046003400300034002D0031004400340033002D0034003200460032002D0039003300300035002D003600370044004500300042003200380046004300320033007D005C006500780070006C006F007200650072002E0065007800650000001CE5A3009B62D0760B7C6697FEFFFFFFFA53CB76F5F3C774E6F4C774245C13E1A8E5A300C110000000000000C00001000000000000000000A8E5A30024E5A3003851CB76C0000100820200000100000000000000000000006CE5A300D150CB76C00001008202000001000000E850CB7667CD0EE182020000E8A21C000000000000000000000000003CE5A300D0E5A300A8E7A3009B62D076FB786697FEFFFFFFE850CB762A00C874C000010082020000010000000000000000000000E8A21C0054FFC774C000010001000000FFFFFFFFFFFFFFFF90C5CB7641C6CB764E00000000000000000000000000000074E5A30011000000483D1700403D170003EE66971CA31C00FEC5CB7640E6000007C90EE1F4E5A3008291167740E6A300944C00002BC90EE108E6A300B69C1677984CCE024C06000020E6A3000848CE022CE6A30011000000483D1700403D170020E6A3002848CE0290E60000F3CA0EE140E6A3008291167790E6A30044E6A3002795167700000000944CCE026CE6A300CD941677944CCE0218E7A3000848CE02E1941677000000000848CE0218E7A30074E6A3001000000034000000869716007B00460033003800420046003400300034002D0031004400340033002D0034003200460032002D0039003300300035002D003600370044004500300042003200380046004300320033007D005C006500780070006C006F007200650072002E0065007800650000001CE5A3009B62D0760B7C6697FEFFFFFFFA53CB76F5F3C774E6F4C774245C13E1A8E5A300C110000000000000C00001000000000000000000A8E5A30024E5A3003851CB76C0000100820200000100000000000000000000006CE5A300D150CB76C00001008202000001000000E850CB7667CD0EE182020000E8A21C000000000000000000000000003CE5A300D0E5A300A8E7A3009B62D076FB786697FEFFFFFFE850CB762A00C874C000010082020000010000000000000000000000E8A21C0054FFC774C000010001000000FFFFFFFFFFFFFFFF90C5CB7641C6CB764E00000000000000000000000000000074E5A30011000000483D1700403D170003EE66971CA31C00FEC5CB7640E6000007C90EE1F4E5A3008291167740E6A300944C00002BC90EE108E6A300B69C1677984CCE024C06000020E6A3000848CE022CE6A30011000000483D1700403D170020E6A3002848CE0290E60000F3CA0EE140E6A3008291167790E6A30044E6A3002795167700000000944CCE026CE6A300CD941677944CCE0218E7A3000848CE02E1941677000000000848CE0218E7A30074E6A3001000000034000000869716007B00460033003800420046003400300034002D0031004400340033002D0034003200460032002D0039003300300035002D003600370044004500300042003200380046004300320033007D005C006500780070006C006F007200650072002E0065007800650000001CE5A3009B62D0760B7C6697FEFFFFFFFA53CB76F5F3C774E6F4C774245C13E1A8E5A300C110000000000000C00001000000000000000000A8E5A30024E5A3003851CB76C0000100820200000100000000000000000000006CE5A300D150CB76C00001008202000001000000E850CB7667CD0EE182020000E8A21C000000000000000000000000003CE5A300D0E5A300A8E7A3009B62D076FB786697FEFFFFFFE850CB762A00C874C000010082020000010000000000000000000000E8A21C0054FFC774C000010001000000FFFFFFFFFFFFFFFF90C5CB7641C6CB764E00000000000000000000000000000074E5A30011000000483D1700403D170003EE66971CA31C00FEC5CB7640E6000007C90EE1F4E5A3008291167740E6A300944C00002BC90EE108E6A300B69C1677984CCE024C06000020E6A3000848CE022CE6A30011000000483D1700403D170020E6A3002848CE0290E60000F3CA0EE140E6A3008291167790E6A30044E6A3002795167700000000944CCE026CE6A300CD941677944CCE0218E7A3000848CE02E1941677000000000848CE0218E7A30074E6A300
(PID) Process:(568) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count
Operation:writeName:{9R3995NO-1S9P-4S13-O827-48O24O6P7174}\GnfxOne\Vagrearg Rkcybere.yax
Value:
00000000040000000000000003000000000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BFFFFFFFFFF0BFE5BCE039D70100000000
(PID) Process:(568) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count
Operation:writeName:HRZR_PGYFRFFVBA
Value:
000000003300000000000000320000001000000000000000100000007B00390045003300390039003500410042002D0031004600390043002D0034004600310033002D0042003800320037002D003400380042003200340042003600430037003100370034007D005C005400610073006B004200610072005C00570069006E0064006F007700730020004500780070006C006F007200650072002E006C006E006B0000006C006E006B00000000000000C4D4B4030BA03476E01F3A0310612C03800200000D0000002F000000AF020000E01F3A03E4D4B40343194F768F223A03D8002B035E000000E01F3A0310612C03AF020000B8F94E7690EB330690EB3306F4D4B40364194F7610612C03D8002B038CD9B403BF434F7610612C030000000000000000FFFFFFFF000000000000000000000000D8002B03F0002B03D8002B031A012B0300000000000000000000000000004F76F024280688062B03D8D9B403BF434F76F02428060000000000000000FFFFFFFF00000000000000000000000088062B03A0062B0388062B03CA062B03A6000000A8138C0198D5B40333AB7577A8C744040C0C0000102700001B000000DB560200CCD5B403F8AA7577DB560200A8138C01ECD5B403400F23026CD6B40300000000A40100002CD60000153E7714DCD5B40382914F762CD6B403E0D5B40327954F7600000000CC13230208D6B403CD944F76CC132302B4D6B403400F2302E1944F7600000000400F2302B4D6B40310D6B4031000000000000000100000007B00390045003300390039003500410042002D0031004600390043002D0034004600310033002D0042003800320037002D003400380042003200340042003600430037003100370034007D005C005400610073006B004200610072005C00570069006E0064006F007700730020004500780070006C006F007200650072002E006C006E006B0000006C006E006B00000000000000C4D4B4030BA03476E01F3A0310612C03800200000D0000002F000000AF020000E01F3A03E4D4B40343194F768F223A03D8002B035E000000E01F3A0310612C03AF020000B8F94E7690EB330690EB3306F4D4B40364194F7610612C03D8002B038CD9B403BF434F7610612C030000000000000000FFFFFFFF000000000000000000000000D8002B03F0002B03D8002B031A012B0300000000000000000000000000004F76F024280688062B03D8D9B403BF434F76F02428060000000000000000FFFFFFFF00000000000000000000000088062B03A0062B0388062B03CA062B03A6000000A8138C0198D5B40333AB7577A8C744040C0C0000102700001B000000DB560200CCD5B403F8AA7577DB560200A8138C01ECD5B403400F23026CD6B40300000000A40100002CD60000153E7714DCD5B40382914F762CD6B403E0D5B40327954F7600000000CC13230208D6B403CD944F76CC132302B4D6B403400F2302E1944F7600000000400F2302B4D6B40310D6B4031000000000000000100000007B00390045003300390039003500410042002D0031004600390043002D0034004600310033002D0042003800320037002D003400380042003200340042003600430037003100370034007D005C005400610073006B004200610072005C00570069006E0064006F007700730020004500780070006C006F007200650072002E006C006E006B0000006C006E006B00000000000000C4D4B4030BA03476E01F3A0310612C03800200000D0000002F000000AF020000E01F3A03E4D4B40343194F768F223A03D8002B035E000000E01F3A0310612C03AF020000B8F94E7690EB330690EB3306F4D4B40364194F7610612C03D8002B038CD9B403BF434F7610612C030000000000000000FFFFFFFF000000000000000000000000D8002B03F0002B03D8002B031A012B0300000000000000000000000000004F76F024280688062B03D8D9B403BF434F76F02428060000000000000000FFFFFFFF00000000000000000000000088062B03A0062B0388062B03CA062B03A6000000A8138C0198D5B40333AB7577A8C744040C0C0000102700001B000000DB560200CCD5B403F8AA7577DB560200A8138C01ECD5B403400F23026CD6B40300000000A40100002CD60000153E7714DCD5B40382914F762CD6B403E0D5B40327954F7600000000CC13230208D6B403CD944F76CC132302B4D6B403400F2302E1944F7600000000400F2302B4D6B40310D6B403
Executable files
224
Suspicious files
189
Text files
410
Unknown types
103

Dropped files

PID
Process
Filename
Type
1440iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\K0KKA7XI.txt —
MD5:—
SHA256:—
1440iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\YSAEIA7S.txt —
MD5:—
SHA256:—
1440iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\86KF1QT9.txt —
MD5:—
SHA256:—
1440iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\V2OLO9NP.txt —
MD5:—
SHA256:—
1440iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\qsml[1].htm —
MD5:—
SHA256:—
1440iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\qsml[1].xmlxml
MD5:23AD656E399A477C95429D105F5EF159
SHA256:FDD2A1E2A78241FD945F085B661A2819F10707D60AC4157DC325B6ECC2E9FFD9
1440iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\GWVUGO18.txttext
MD5:7B185BC3AA6A401BB5CE377A4C9FE50E
SHA256:054276F1C12A2058AC085C6653191C1086BC654C1ABE61E87B146FB75EE76FAC
872svchost.exeC:\Windows\appcompat\programs\RecentFileCache.bcftxt
MD5:6534F5B88C7C04BDAF5C8EA10E166F82
SHA256:4F771DBD2CAD230E51CDAFC9AEC8909916160651EC8176C5AA8E19F1EDD28685
1440iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar3226.tmp —
MD5:—
SHA256:—
1440iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\qsml[3].xmlxml
MD5:601EE723CA5C864A3E1DCC938094B2C5
SHA256:6B1253A42FEC0EDF26334FAD40F640584F9794D9B6D806487E98314DDE0985DB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
221
TCP/UDP connections
280
DNS requests
94
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1440
iexplore.exe
GET
200
13.107.5.80:80
http://api.bing.com/qsml.aspx?query=d&maxwidth=32765&rowheight=20&sectionHeight=160&FORM=IE11SS&market=en-US
US
xml
246 b
whitelisted
3500
iexplore.exe
GET
200
13.107.21.200:80
http://www.bing.com/favicon.ico
US
image
4.19 Kb
whitelisted
1440
iexplore.exe
GET
200
13.107.5.80:80
http://api.bing.com/qsml.aspx?query=de&maxwidth=32765&rowheight=20&sectionHeight=160&FORM=IE11SS&market=en-US
US
xml
242 b
whitelisted
1440
iexplore.exe
GET
200
13.107.5.80:80
http://api.bing.com/qsml.aspx?query=descargar&maxwidth=398&rowheight=20&sectionHeight=160&FORM=IE11SS&market=en-US
US
xml
244 b
whitelisted
1440
iexplore.exe
GET
—
13.107.5.80:80
http://api.bing.com/qsml.aspx?query=descar&maxwidth=398&rowheight=20&sectionHeight=160&FORM=IE11SS&market=en-US
US
—
—
whitelisted
1440
iexplore.exe
GET
200
13.107.5.80:80
http://api.bing.com/qsml.aspx?query=descargar+z&maxwidth=398&rowheight=20&sectionHeight=160&FORM=IE11SS&market=en-US
US
xml
262 b
whitelisted
1440
iexplore.exe
GET
200
13.107.5.80:80
http://api.bing.com/qsml.aspx?query=descarga&maxwidth=398&rowheight=20&sectionHeight=160&FORM=IE11SS&market=en-US
US
xml
243 b
whitelisted
1440
iexplore.exe
GET
200
13.107.21.200:80
http://www.bing.com/search?q=descargar+zip&src=IE-TopResult&FORM=IE11TR&conversationid=
US
html
74.7 Kb
whitelisted
1440
iexplore.exe
GET
200
13.107.5.80:80
http://api.bing.com/qsml.aspx?query=descargar+zip&maxwidth=398&rowheight=20&sectionHeight=160&FORM=IE11SS&market=en-US
US
xml
240 b
whitelisted
1440
iexplore.exe
GET
200
13.107.5.80:80
http://api.bing.com/qsml.aspx?query=descargar+z&maxwidth=398&rowheight=20&sectionHeight=160&FORM=IE11SS&market=en-US
US
xml
262 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1440
iexplore.exe
13.107.5.80:80
api.bing.com
Microsoft Corporation
US
whitelisted
3500
iexplore.exe
13.107.21.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
1440
iexplore.exe
13.107.21.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
—
—
13.107.5.80:80
api.bing.com
Microsoft Corporation
US
whitelisted
1440
iexplore.exe
13.107.21.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
1440
iexplore.exe
20.190.160.129:443
login.microsoftonline.com
Microsoft Corporation
US
suspicious
1440
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
1440
iexplore.exe
40.126.31.135:443
login.live.com
Microsoft Corporation
US
suspicious
1440
iexplore.exe
23.213.161.74:80
a4.bing.com
Akamai Technologies, Inc.
US
suspicious
1440
iexplore.exe
52.231.32.10:80
c095ad79c4f78ef26ad8ae122b76dd5e.clo.footprintdns.com
Microsoft Corporation
KR
whitelisted

DNS requests

Domain
IP
Reputation
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 13.107.21.200
  • 204.79.197.200
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
login.microsoftonline.com
  • 20.190.160.129
  • 20.190.160.136
  • 20.190.160.4
  • 20.190.160.6
  • 20.190.160.75
  • 20.190.160.2
  • 20.190.160.71
  • 20.190.160.8
whitelisted
a4.bing.com
  • 23.213.161.74
  • 23.213.161.78
whitelisted
login.live.com
  • 40.126.31.135
  • 40.126.31.137
  • 40.126.31.6
  • 40.126.31.1
  • 20.190.159.132
  • 20.190.159.136
  • 40.126.31.8
  • 40.126.31.4
whitelisted
c095ad79c4f78ef26ad8ae122b76dd5e.clo.footprintdns.com
  • 52.231.32.10
unknown
www2.bing.com
  • 13.107.21.200
  • 204.79.197.200
whitelisted
33323879a9e06378c7f687bdad231d9f.clo.footprintdns.com
  • 52.231.32.10
unknown
45bd1b3ca292121191cca9a624e9fa8d.clo.footprintdns.com
  • 13.107.19.254
unknown

Threats

PID
Process
Class
Message
3592
winzip25-downwz.exe
A Network Trojan was detected
AV TROJAN InstallPortal Glority Adware CnC Request
3592
winzip25-downwz.exe
A Network Trojan was detected
AV TROJAN InstallPortal Glority Adware CnC Request
4 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
z08050095140162100000682.zip