File name:

dControl.zip

Full analysis: https://app.any.run/tasks/42477246-a092-41f8-b68e-cf8362dfc1c6
Verdict: Malicious activity
Analysis date: May 14, 2024, 23:10:58
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

B5EFFFA70593F266A19762292160A9A5

SHA1:

7B494F7AD517ADF6AB2E5204FCEC65A9719866A1

SHA256:

959327D037F4402440854882E8C02ABBA0AA9F0A6494D079DA6D7D03E7E41E37

SSDEEP:

24576:AG4o5PnbV5ssrMGcJnPJYAOF6gDYwFGy8Tq3aLTMJC:n4o5PnbV5trMGcJnPJaF6gDYwFGy8Tqy

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3976)

    • Creates or modifies Windows services

      • dControl.exe (PID: 1944)

  • SUSPICIOUS

    • Application launched itself

      • dControl.exe (PID: 1660)
      • dControl.exe (PID: 1704)
      • dControl.exe (PID: 1944)

    • Explorer used for Indirect Command Execution

      • explorer.exe (PID: 1936)

    • Reads the Internet Settings

      • MSASCui.exe (PID: 2464)

    • Reads settings of System Certificates

      • MSASCui.exe (PID: 2464)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3976)

    • Create files in a temporary directory

      • dControl.exe (PID: 1660)
      • MSASCui.exe (PID: 2464)

    • Manual execution by a user

      • dControl.exe (PID: 1660)
      • dControl.exe (PID: 820)
      • wmpnscfg.exe (PID: 2076)

    • Reads the computer name

      • dControl.exe (PID: 1660)
      • dControl.exe (PID: 1704)
      • dControl.exe (PID: 1944)
      • dControl.exe (PID: 2336)
      • MSASCui.exe (PID: 2464)
      • wmpnscfg.exe (PID: 2076)

    • Reads mouse settings

      • dControl.exe (PID: 1660)
      • dControl.exe (PID: 1704)
      • dControl.exe (PID: 1944)
      • dControl.exe (PID: 2336)

    • Checks supported languages

      • dControl.exe (PID: 1660)
      • dControl.exe (PID: 1704)
      • dControl.exe (PID: 1944)
      • dControl.exe (PID: 2336)
      • MSASCui.exe (PID: 2464)
      • wmpnscfg.exe (PID: 2076)

    • Reads the Internet Settings

      • explorer.exe (PID: 2520)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 2520)

    • Reads the machine GUID from the registry

      • MSASCui.exe (PID: 2464)

    • Reads the software policy settings

      • MSASCui.exe (PID: 2464)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2022:03:01 07:30:28
ZipCRC: 0x303ac5f8
ZipCompressedSize: 437203
ZipUncompressedSize: 457984
ZipFileName: dControl.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
53
Monitored processes
10
Malicious processes
2
Suspicious processes
3

Behavior graph

Click at the process to see the details
start winrar.exe dcontrol.exe no specs dcontrol.exe dcontrol.exe dcontrol.exe no specs explorer.exe no specs dcontrol.exe no specs explorer.exe no specs msascui.exe wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
820"C:\Users\admin\Desktop\dControl.exe" C:\Users\admin\Desktop\dControl.exe—explorer.exe
User:
admin
Company:
www.sordum.org
Integrity Level:
MEDIUM
Description:
dControl v2.1
Exit code:
3221226540
Version:
2.1.0.0
Modules
Images
c:\users\admin\desktop\dcontrol.exe
c:\windows\system32\ntdll.dll
1660"C:\Users\admin\Desktop\dControl.exe" C:\Users\admin\Desktop\dControl.exe
explorer.exe
User:
admin
Company:
www.sordum.org
Integrity Level:
HIGH
Description:
dControl v2.1
Exit code:
0
Version:
2.1.0.0
Modules
Images
c:\users\admin\desktop\dcontrol.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
1704C:\Users\admin\Desktop\dControl.exeC:\Users\admin\Desktop\dControl.exe
dControl.exe
User:
SYSTEM
Company:
www.sordum.org
Integrity Level:
SYSTEM
Description:
dControl v2.1
Exit code:
0
Version:
2.1.0.0
Modules
Images
c:\users\admin\desktop\dcontrol.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
1936"C:\Windows\Explorer.exe" C:\Program Files\Windows Defender\MSASCui.exeC:\Windows\explorer.exe—dControl.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1944"C:\Users\admin\Desktop\dControl.exe" /TI C:\Users\admin\Desktop\dControl.exe—dControl.exe
User:
SYSTEM
Company:
www.sordum.org
Integrity Level:
SYSTEM
Description:
dControl v2.1
Version:
2.1.0.0
Modules
Images
c:\users\admin\desktop\dcontrol.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
2076"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2336"C:\Users\admin\Desktop\dControl.exe" /EXP |1180|C:\Users\admin\Desktop\dControl.exe—dControl.exe
User:
SYSTEM
Company:
www.sordum.org
Integrity Level:
SYSTEM
Description:
dControl v2.1
Exit code:
0
Version:
2.1.0.0
Modules
Images
c:\users\admin\desktop\dcontrol.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
2464"C:\Program Files\Windows Defender\MSASCui.exe" C:\Program Files\Windows Defender\MSASCui.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Defender User Interface
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows defender\msascui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\program files\windows defender\mpclient.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
2520C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -EmbeddingC:\Windows\explorer.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3976"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\dControl.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
Total events
7 407
Read events
7 344
Write events
53
Delete events
10

Modification events

(PID) Process:(3976) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3976) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3976) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3976) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3976) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3976) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(3976) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\dControl.zip
(PID) Process:(3976) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3976) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3976) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
1
Suspicious files
13
Text files
8
Unknown types
0

Dropped files

PID
Process
Filename
Type
3976WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3976.8558\dControl.initext
MD5:05450FF06366AE22654B63A6E27D1624
SHA256:8E9A84DA243905685CA77B6EF71841E610B88B7963D4DE59F6DCBDD1621ECACD
1660dControl.exeC:\Users\admin\AppData\Local\Temp\aut8B4B.tmpbinary
MD5:EFE44D9F6E4426A05E39F99AD407D3E7
SHA256:5EA3B26C6B1B71EDAEF17CE365D50BE963AE9F4CB79B39EC723FE6E9E4054366
3976WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3976.8558\Defender_Settings.vbstext
MD5:B0BF0A477BCCA312021177572311E666
SHA256:AF42A17D428C8E9D6F4A6D3393EC268F4D12BBFD01A897D87275482A45C847E9
2464MSASCui.exeC:\Users\admin\AppData\Local\Temp\mpam-3824cc73.exe —
MD5:—
SHA256:—
1704dControl.exeC:\Windows\TEMP\1g7v0f4p.tmptext
MD5:E00DCC76E4DCD90994587375125DE04B
SHA256:C8709F5A8B971D136E2273D66E65449791CA8EBA1F47DD767733EA52EE635447
1660dControl.exeC:\Users\admin\AppData\Local\Temp\aut8B2B.tmpbinary
MD5:9D5A0EF18CC4BB492930582064C5330F
SHA256:8F5BBCC572BC62FEB13A669F856D21886A61888FD6288AFD066272A27EA79BB3
1704dControl.exeC:\Windows\TEMP\aut8D40.tmpbinary
MD5:ECFFD3E81C5F2E3C62BCDC122442B5F2
SHA256:9874AB363B07DCC7E9CD6022A380A64102C1814343642295239A9F120CB941C5
1704dControl.exeC:\Windows\TEMP\aut8D1F.tmpbinary
MD5:9D5A0EF18CC4BB492930582064C5330F
SHA256:8F5BBCC572BC62FEB13A669F856D21886A61888FD6288AFD066272A27EA79BB3
3976WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3976.8558\dControl.exeexecutable
MD5:58008524A6473BDF86C1040A9A9E39C3
SHA256:1EF6C1A4DFDC39B63BFE650CA81AB89510DE6C0D3D7C608AC5BE80033E559326
1660dControl.exeC:\Users\admin\AppData\Local\Temp\1f6k6m0j.tmptext
MD5:E00DCC76E4DCD90994587375125DE04B
SHA256:C8709F5A8B971D136E2273D66E65449791CA8EBA1F47DD767733EA52EE635447
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
7
DNS requests
5
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2464
MSASCui.exe
GET
302
23.38.86.151:80
http://go.microsoft.com/fwlink/?LinkID=121721&clcid=0x409&arch=x86&eng=0.0.0.0&asdelta=0.0.0.0&prod=925A3ACA-C353-458A-AC8D-A7E5EB378092
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1088
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2464
MSASCui.exe
23.38.86.151:80
go.microsoft.com
AKAMAI-AS
US
unknown
2464
MSASCui.exe
23.203.17.160:443
www.microsoft.com
AKAMAI-AS
US
unknown
2464
MSASCui.exe
23.206.124.214:443
definitionupdates.microsoft.com
AKAMAI-AS
US
unknown

DNS requests

Domain
IP
Reputation
watson.microsoft.com
  • 104.208.16.93
whitelisted
go.microsoft.com
  • 23.38.86.151
whitelisted
www.microsoft.com
  • 23.203.17.160
whitelisted
definitionupdates.microsoft.com
  • 23.206.124.214
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
dControl.zip