File name:

_______139.zip.zip

Full analysis: https://app.any.run/tasks/f1b3a36c-29a5-4eba-a059-e83a77db8e97
Verdict: Malicious activity
Threats:

Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns.

Malware Trends Tracker     >>>
Analysis date: May 30, 2020, 14:08:11
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
maldoc-47
emotet-doc
emotet
encrypted
ta505
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

90FFEF827E4F16FD77605755956F6B8E

SHA1:

73C14AE34FFB758A40F0D0F5DEEED36EBCEE07B9

SHA256:

9D0E809B6887201F3E2B950772A36230B8EF79166B73A32E3CBC9557A5BA42EC

SSDEEP:

98304:Fy3bm+CRVuXXbmJiKmH5UU9X068FU/r9a/o/Ww6JAwVTFRpePlXl/YaDX6tvLIxl:FT9wKJiKm5UU506ap/o/J6JzBRpyz/b/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops known malicious document

      • WinRAR.exe (PID: 788)
      • WinRAR.exe (PID: 788)
      • WinRAR.exe (PID: 788)

    • Writes to a start menu file

      • WScript.exe (PID: 2340)
      • WScript.exe (PID: 2720)

    • Actions looks like stealing of personal data

      • WinRAR.exe (PID: 1476)

  • SUSPICIOUS

    • Application launched itself

      • WinRAR.exe (PID: 1476)

    • Creates files in the user directory

      • WScript.exe (PID: 2340)

    • Reads Internet Cache Settings

      • WScript.exe (PID: 2340)
      • WScript.exe (PID: 2720)

  • INFO

    • Manual execution by user

      • WScript.exe (PID: 2720)
      • WScript.exe (PID: 2340)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 788
ZipBitFlag: 0x0001
ZipCompression: None
ZipModifyDate: 2020:05:30 13:06:20
ZipCRC: 0xf72396d0
ZipCompressedSize: 5500966
ZipUncompressedSize: 5500966
ZipFileName: _______139.zip
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
4
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe winrar.exe no specs wscript.exe wscript.exe

Process information

PID
CMD
Path
Indicators
Parent process
788"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\Rar$DIb1476.5481\_______139.zipC:\Program Files\WinRAR\WinRAR.exe—WinRAR.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1476"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\_______139.zip.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2340"C:\Windows\System32\WScript.exe" "C:\Users\admin\Desktop\-·¦++»+e+-_139\7.js" C:\Windows\System32\WScript.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2720"C:\Windows\System32\WScript.exe" "C:\Users\admin\Desktop\-·¦++»+e+-_139\7.js" C:\Windows\System32\WScript.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
1 097
Read events
1 030
Write events
67
Delete events
0

Modification events

(PID) Process:(1476) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1476) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1476) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1476) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12F\52C64B7E
Operation:writeName:@C:\Windows\system32\NetworkExplorer.dll,-1
Value:
Network
(PID) Process:(1476) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\_______139.zip.zip
(PID) Process:(1476) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1476) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1476) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1476) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1476) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
Executable files
0
Suspicious files
15
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
788WinRAR.exeC:\Users\admin\Desktop\-·¦++»+e+-_139\13.js —
MD5:—
SHA256:—
788WinRAR.exeC:\Users\admin\Desktop\-·¦++»+e+-_139\15.docdocument
MD5:—
SHA256:—
788WinRAR.exeC:\Users\admin\Desktop\-·¦++»+e+-_139\14.xlsdocument
MD5:—
SHA256:—
788WinRAR.exeC:\Users\admin\Desktop\-·¦++»+e+-_139\10.xlscompressed
MD5:—
SHA256:—
788WinRAR.exeC:\Users\admin\Desktop\-·¦++»+e+-_139\1.xlsmdocument
MD5:—
SHA256:—
788WinRAR.exeC:\Users\admin\Desktop\-·¦++»+e+-_139\3.xlsdocument
MD5:—
SHA256:—
788WinRAR.exeC:\Users\admin\Desktop\-·¦++»+e+-_139\11.xlsdocument
MD5:—
SHA256:—
788WinRAR.exeC:\Users\admin\Desktop\-·¦++»+e+-_139\7.jstext
MD5:—
SHA256:—
788WinRAR.exeC:\Users\admin\Desktop\-·¦++»+e+-_139\4.xlsmdocument
MD5:—
SHA256:—
788WinRAR.exeC:\Users\admin\Desktop\-·¦++»+e+-_139\6.xlamdocument
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
10
DNS requests
1
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2340
WScript.exe
POST
—
192.169.69.25:7000
http://348.duckdns.org:7000/Vre
US
—
—
malicious
2720
WScript.exe
POST
—
192.169.69.25:7000
http://348.duckdns.org:7000/Vre
US
—
—
malicious
2340
WScript.exe
POST
—
192.169.69.25:7000
http://348.duckdns.org:7000/Vre
US
—
—
malicious
2720
WScript.exe
POST
—
192.169.69.25:7000
http://348.duckdns.org:7000/Vre
US
—
—
malicious
2720
WScript.exe
POST
—
192.169.69.25:7000
http://348.duckdns.org:7000/Vre
US
—
—
malicious
2340
WScript.exe
POST
—
192.169.69.25:7000
http://348.duckdns.org:7000/Vre
US
—
—
malicious
2720
WScript.exe
POST
—
192.169.69.25:7000
http://348.duckdns.org:7000/Vre
US
—
—
malicious
2340
WScript.exe
POST
—
192.169.69.25:7000
http://348.duckdns.org:7000/Vre
US
—
—
malicious
2340
WScript.exe
POST
—
192.169.69.25:7000
http://348.duckdns.org:7000/Vre
US
—
—
malicious
2340
WScript.exe
POST
—
192.169.69.25:7000
http://348.duckdns.org:7000/Vre
US
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2720
WScript.exe
192.169.69.25:7000
348.duckdns.org
Wowrack.com
US
malicious
2340
WScript.exe
192.169.69.25:7000
348.duckdns.org
Wowrack.com
US
malicious

DNS requests

Domain
IP
Reputation
348.duckdns.org
  • 192.169.69.25
malicious

Threats

PID
Process
Class
Message
1052
svchost.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
_______139.zip.zip