analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

1.zip

Full analysis: https://app.any.run/tasks/b25b233d-1028-4fa3-b38b-4a81746eefb7
Verdict: Malicious activity
Analysis date: January 18, 2019, 08:23:17
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

2DBB5BF064F50628640A35CF6E9C5403

SHA1:

32EDBEF4EE21861360CCD525887CF6756ED966A1

SHA256:

A0D7217133CF60DF5D74EEAA6AA4D4A77E0445DC12BE078BD3FBAFAB50BF792E

SSDEEP:

98304:Q/yrlyYaoP4rM4ctXwL7ED6K5GI0nEPAl+L0HEnimPuupMknA5ZUA6lv0hP:QqrlyYhP4c67Et5QnE6zEim/OT56Ak0p

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 284)
      • Proxifier.exe (PID: 3076)
      • explorer.exe (PID: 2028)
      • DllHost.exe (PID: 2556)
      • opera.exe (PID: 960)

    • Application was dropped or rewritten from another process

      • ProxifierSetup.exe (PID: 3296)
      • ProxifierSetup.exe (PID: 3632)
      • ProxyChecker.exe (PID: 4008)
      • Proxifier.exe (PID: 3076)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • explorer.exe (PID: 2028)
      • ProxifierSetup.exe (PID: 3296)
      • WinRAR.exe (PID: 3128)
      • ProxifierSetup.exe (PID: 3632)

    • Reads Windows owner or organization settings

      • ProxifierSetup.tmp (PID: 2240)

    • Reads the Windows organization settings

      • ProxifierSetup.tmp (PID: 2240)

  • INFO

    • Application was dropped or rewritten from another process

      • ProxifierSetup.tmp (PID: 2240)
      • ProxifierSetup.tmp (PID: 2208)

    • Creates files in the user directory

      • opera.exe (PID: 960)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: keys.txt
ZipUncompressedSize: 422
ZipCompressedSize: 312
ZipCRC: 0x6444261a
ZipModifyDate: 2019:01:16 12:37:16
ZipCompression: Deflated
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
11
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start winrar.exe proxifiersetup.exe searchprotocolhost.exe no specs proxifiersetup.tmp no specs proxifiersetup.exe proxifiersetup.tmp no specs proxifier.exe proxychecker.exe no specs explorer.exe Thumbnail Cache Out of Proc Server no specs opera.exe

Process information

PID
CMD
Path
Indicators
Parent process
3128"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\1.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
3296"C:\Users\admin\Desktop\ProxifierSetup.exe" C:\Users\admin\Desktop\ProxifierSetup.exe
explorer.exe
User:
admin
Company:
Initex
Integrity Level:
MEDIUM
Description:
Proxifier Setup
Exit code:
2
Version:
3.42.0.1
284"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe6_ Global\UsGthrCtrlFltPipeMssGthrPipe6 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
2208"C:\Users\admin\AppData\Local\Temp\is-2M5E3.tmp\ProxifierSetup.tmp" /SL5="$4015A,3835417,121344,C:\Users\admin\Desktop\ProxifierSetup.exe" C:\Users\admin\AppData\Local\Temp\is-2M5E3.tmp\ProxifierSetup.tmp—ProxifierSetup.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
2
Version:
51.1052.0.0
3632"C:\Users\admin\Desktop\ProxifierSetup.exe" /SPAWNWND=$30162 /NOTIFYWND=$4015A C:\Users\admin\Desktop\ProxifierSetup.exe
ProxifierSetup.tmp
User:
admin
Company:
Initex
Integrity Level:
HIGH
Description:
Proxifier Setup
Exit code:
2
Version:
3.42.0.1
2240"C:\Users\admin\AppData\Local\Temp\is-I6GJG.tmp\ProxifierSetup.tmp" /SL5="$40164,3835417,121344,C:\Users\admin\Desktop\ProxifierSetup.exe" /SPAWNWND=$30162 /NOTIFYWND=$4015A C:\Users\admin\AppData\Local\Temp\is-I6GJG.tmp\ProxifierSetup.tmp—ProxifierSetup.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
2
Version:
51.1052.0.0
3076"C:\Users\admin\Desktop\Proxifier PE\Proxifier.exe" C:\Users\admin\Desktop\Proxifier PE\Proxifier.exe
explorer.exe
User:
admin
Company:
Initex
Integrity Level:
MEDIUM
Description:
Proxifier Portable Edition v3.42
Version:
3.42.0.1
4008"C:\Users\admin\Desktop\Proxifier PE\ProxyChecker.exe" C:\Users\admin\Desktop\Proxifier PE\ProxyChecker.exe—explorer.exe
User:
admin
Company:
Initex
Integrity Level:
MEDIUM
Description:
Proxy Checker
Exit code:
2
Version:
1.53.0.1
2028C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2556C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}C:\Windows\system32\DllHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
4 163
Read events
3 881
Write events
0
Delete events
0

Modification events

No data
Executable files
9
Suspicious files
48
Text files
86
Unknown types
1

Dropped files

PID
Process
Filename
Type
2028explorer.exeC:\Users\admin\Desktop\Proxifier PE —
MD5:—
SHA256:—
3128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3128.34669\keys.txttext
MD5:54564825E6C50F6D7631B9B13D0BD88D
SHA256:0516EEA05611B1C710DE6E53C069DCDFDC75A33B10CE7E5CBC8117151A728A4E
3128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3128.34669\Proxifier PE\ProxyChecker.exeexecutable
MD5:A65C412E1A5D1C12EE64C8230362A726
SHA256:CE157EB1C87F0EB592309612C8983BBA3BFFB9412E6EBD4198F1ABCAAD45D2D4
2028explorer.exeC:\Users\admin\Desktop\keys.txttext
MD5:54564825E6C50F6D7631B9B13D0BD88D
SHA256:0516EEA05611B1C710DE6E53C069DCDFDC75A33B10CE7E5CBC8117151A728A4E
3128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3128.34669\ProxifierSetup.exeexecutable
MD5:E0D1E9678938ED5B4FD464B655C3261D
SHA256:8FF0B7DCCE41E45455AD0251F328DE813E4CD43B9E76CB8E5DB338EA3A193EB7
2028explorer.exeC:\Users\admin\Desktop\ProxifierSetup.exeexecutable
MD5:E0D1E9678938ED5B4FD464B655C3261D
SHA256:8FF0B7DCCE41E45455AD0251F328DE813E4CD43B9E76CB8E5DB338EA3A193EB7
3296ProxifierSetup.exeC:\Users\admin\AppData\Local\Temp\is-2M5E3.tmp\ProxifierSetup.tmpexecutable
MD5:83340072139BCDEEF610DA3D9CF0EB28
SHA256:FE1E871194FD56A723F1A916F362445432DD4C3CA8C27053C28FA072739818FB
960opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\opr6AEB.tmp —
MD5:—
SHA256:—
3128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3128.34669\Proxifier PE\Proxifier.exeexecutable
MD5:687396EECA12F12FEB9A7AA6601168E9
SHA256:BAB2311A5B7A26471CCD841A72418F8B9036F3AE96625DB8717ADBF33883B92A
960opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\opr6B3A.tmp —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
5
DNS requests
5
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3076
Proxifier.exe
GET
200
172.104.17.238:80
http://www.proxifier.com/distr/last_versions/ProxifierPortable/?nocache=730939C9730939C99C
US
text
47 b
suspicious
960
opera.exe
GET
200
66.225.197.197:80
http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl
US
der
543 b
whitelisted
960
opera.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAOXQPQlVpLtFek%2BmcpabOk%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
960
opera.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
960
opera.exe
82.145.215.40:443
certs.opera.com
Opera Software AS
—
whitelisted
960
opera.exe
66.225.197.197:80
crl4.digicert.com
CacheNetworks, Inc.
US
whitelisted
3076
Proxifier.exe
172.104.17.238:80
www.proxifier.com
Linode, LLC
US
suspicious

DNS requests

Domain
IP
Reputation
www.google.com
  • 172.217.18.100
whitelisted
www.proxifier.com
  • 172.104.17.238
suspicious
certs.opera.com
  • 82.145.215.40
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
crl4.digicert.com
  • 66.225.197.197
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
1.zip