File name:

AutoLOG v1 - Cracked by Kaligo.zip

Full analysis: https://app.any.run/tasks/b2f85acd-5a0e-465d-a8f1-7e1da959952d
Verdict: Malicious activity
Analysis date: October 08, 2019, 10:45:37
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

D836800BC74EC2701840877A581564A6

SHA1:

4D2F7F02C4DC898CCC92FE4871EA976AFD777759

SHA256:

A1188F358961352E5844489778C645FBC0C9F4A893BE943C05786CBF66BCA8FF

SSDEEP:

49152:bimOf6df+qnKvAMs8ThOy9p7weAHGR52vAwMhLP3oWE0oxYoAZHv//I0gv83fcV4:bim0mfgoMXjke4GR+SP6yZHv/2kkVFVY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Obfuscator.exe (PID: 1512)
      • Aut2Exe.exe (PID: 2156)
      • Obfuscator.exe (PID: 3156)
      • Aut2Exe.exe (PID: 2856)
      • Aut2Exe.exe (PID: 1956)
      • AU3Stripper.exe (PID: 2608)
      • Aut2Exe.exe (PID: 3880)
      • upx.exe (PID: 3412)
      • Obfuscator.exe (PID: 3532)
      • Aut2Exe.exe (PID: 3832)
      • upx.exe (PID: 2184)
      • upx.exe (PID: 2948)
      • Emai.exe (PID: 1640)
      • upx.exe (PID: 2836)
      • Emai.exe (PID: 2840)
      • AU3Stripper.exe (PID: 3952)
      • upx.exe (PID: 2828)
      • Scre.exe (PID: 3920)
      • Scre.exe (PID: 3844)
      • AutoUpdate.exe (PID: 328)
      • AutoUpdate.exe (PID: 972)
      • scre.exe (PID: 4004)
      • Emai.exe (PID: 680)
      • AutoLOG v1 - Cracked by Kaligo.exe (PID: 2800)

    • Changes the autorun value in the registry

      • AutoUpdate.exe (PID: 328)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Aut2Exe.exe (PID: 2156)
      • Aut2Exe.exe (PID: 2856)
      • Aut2Exe.exe (PID: 3880)
      • Aut2Exe.exe (PID: 3832)
      • Aut2Exe.exe (PID: 1956)

    • Starts CMD.EXE for commands execution

      • Emai.exe (PID: 2840)
      • Scre.exe (PID: 3920)
      • scre.exe (PID: 4004)
      • Emai.exe (PID: 680)

    • Creates files in the user directory

      • notepad++.exe (PID: 3904)

    • Creates files in the Windows directory

      • AutoUpdate.exe (PID: 328)

    • Writes files like Keylogger logs

      • AutoUpdate.exe (PID: 328)

  • INFO

    • Manual execution by user

      • Obfuscator.exe (PID: 1512)
      • notepad++.exe (PID: 3904)
      • notepad++.exe (PID: 1056)
      • Scre.exe (PID: 3920)
      • AutoUpdate.exe (PID: 972)
      • AutoUpdate.exe (PID: 328)
      • Scre.exe (PID: 3844)
      • notepad++.exe (PID: 1704)
      • AutoLOG v1 - Cracked by Kaligo.exe (PID: 2800)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2015:11:04 11:29:25
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: Include/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
96
Monitored processes
37
Malicious processes
3
Suspicious processes
5

Behavior graph

Click at the process to see the details
start winrar.exe no specs obfuscator.exe no specs autolog v1 - cracked by kaligo.exe no specs aut2exe.exe upx.exe no specs emai.exe no specs emai.exe cmd.exe no specs hostname.exe no specs obfuscator.exe no specs aut2exe.exe upx.exe no specs au3stripper.exe no specs aut2exe.exe upx.exe no specs au3stripper.exe no specs aut2exe.exe upx.exe no specs obfuscator.exe no specs aut2exe.exe upx.exe no specs notepad++.exe gup.exe notepad++.exe scre.exe no specs scre.exe cmd.exe no specs hostname.exe no specs autoupdate.exe no specs autoupdate.exe notepad++.exe emai.exe no specs cmd.exe no specs hostname.exe no specs scre.exe no specs cmd.exe no specs hostname.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
328"C:\Users\admin\Desktop\AutoUpdate.exe" C:\Users\admin\Desktop\AutoUpdate.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\autoupdate.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\gdi32.dll
616C:\Windows\system32\cmd.exe /k HOSTNAMEC:\Windows\system32\cmd.exe—scre.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
680Emai.exeC:\Users\admin\Desktop\Emai.exe—AutoUpdate.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\users\admin\desktop\emai.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\gdi32.dll
732HOSTNAMEC:\Windows\system32\HOSTNAME.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Hostname APP
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\hostname.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ws2_32.dll
972"C:\Users\admin\Desktop\AutoUpdate.exe" C:\Users\admin\Desktop\AutoUpdate.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\autoupdate.exe
c:\systemroot\system32\ntdll.dll
1056"C:\Program Files\Notepad++\notepad++.exe" "C:\Users\admin\Desktop\stub_Obfuscated.au3"C:\Program Files\Notepad++\notepad++.exe
explorer.exe
User:
admin
Company:
Don HO don.h@free.fr
Integrity Level:
MEDIUM
Description:
Notepad++ : a free (GNU) source code editor
Exit code:
0
Version:
7.51
Modules
Images
c:\program files\notepad++\notepad++.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1512"C:\Users\admin\Desktop\Obfuscator.exe" C:\Users\admin\Desktop\Obfuscator.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Strip and/or Obfuscate your AutoIt3 scripts.
Exit code:
0
Version:
0.0.1.0
Modules
Images
c:\users\admin\desktop\obfuscator.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\shlwapi.dll
1524HOSTNAMEC:\Windows\system32\HOSTNAME.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Hostname APP
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\hostname.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ws2_32.dll
1640"C:\Users\admin\Desktop\Emai.exe" C:\Users\admin\Desktop\Emai.exe—AutoLOG v1 - Cracked by Kaligo.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\emai.exe
c:\systemroot\system32\ntdll.dll
1704"C:\Program Files\Notepad++\notepad++.exe" "C:\Users\admin\Desktop\stub.au3"C:\Program Files\Notepad++\notepad++.exe
explorer.exe
User:
admin
Company:
Don HO don.h@free.fr
Integrity Level:
MEDIUM
Description:
Notepad++ : a free (GNU) source code editor
Exit code:
0
Version:
7.51
Modules
Images
c:\program files\notepad++\notepad++.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
1 151
Read events
1 044
Write events
106
Delete events
1

Modification events

(PID) Process:(3284) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3284) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3284) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\72\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3284) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\AutoLOG v1 - Cracked by Kaligo.zip
(PID) Process:(3284) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3284) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3284) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3284) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3284) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(3284) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
Executable files
13
Suspicious files
5
Text files
66
Unknown types
5

Dropped files

PID
Process
Filename
Type
3284WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3284.6813\Include\APIResConstants.au3text
MD5:F09ABD09B55E490D94FE25843B528EE3
SHA256:7B60C876C58D0FB466DD445ADC7FE29DF849BE43D9532F25D6C426003CD895D4
3284WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3284.6813\Include\APIDiagConstants.au3text
MD5:8A83B5A26A16EDB3E2261CEBCF7C3EF0
SHA256:145E47BA1978BD38D330D60D3F108D8E5A747B19C9599413F3F50026CC159ACC
3284WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3284.6813\Include\APIGdiConstants.au3text
MD5:16D2D5B4776A3A56285F1749FB659127
SHA256:6D5E9D96308966CE679F8F629E7D4BCE7AC27E84855ED8BE0069398F337A80F2
3284WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3284.6813\Include\APIConstants.au3text
MD5:B1CF64F0577B4B439F6038983C6368C8
SHA256:0DC1A94CFEAC1743F427219AEBFBD0DE7C5D3CDD81A39F840AF667D9A0DAD363
3284WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3284.6813\Include\APIErrorsConstants.au3text
MD5:00FD741A56987480935B0514952B8892
SHA256:0E0B502348B27E3CDC535A7C2A45E242F6F2A646EEA6316B94F121BF1E1EDA6C
3284WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3284.6813\Include\APILocaleConstants.au3text
MD5:222F04E6D5BECE2C36E3A508DE23A4B4
SHA256:A9880E149B4A9ED54E66B41DC5300D964A285089DD87F74B22FDD64DFDD3A5CC
3284WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3284.6813\Include\APIDlgConstants.au3text
MD5:AF946FA3F316BDA0FD9F5A2DC604B3BA
SHA256:14FC0D6272A7CBA3C392721913E71DDAE1B15C435F4248DBCFF6D8E15C0C837E
3284WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3284.6813\Include\APIFilesConstants.au3text
MD5:CF2A8F1DFD047CA4C4CD6ABACEAF1747
SHA256:C08F0FE3AA7B5AF6327BBF871AD3CD22126D24C0721DEBFCA5A613286CC37C73
3284WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3284.6813\Include\APIMiscConstants.au3text
MD5:0A1EA53242CE1F93588ADD247904BB46
SHA256:8EE3B52FD42DF6425BA8B721444DC7054A74E230164AC662FE71377E752CEA9A
3284WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3284.6813\Include\APIProcConstants.au3text
MD5:4F109D7BB091FB216FDA59634D22321B
SHA256:9EED72E56BF4240CC6FA73AF47F84A6C364C6D0F17AFC25CF778BBE7ECE6A4A3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
4
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.21.242.197:80
http://isrg.trustid.ocsp.identrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D
NL
der
1.37 Kb
whitelisted
—
—
GET
200
2.21.242.245:80
http://ocsp.int-x3.letsencrypt.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBR%2B5mrncpqz%2FPiiIGRsFqEtYHEIXQQUqEpqYwR93brm0Tm3pkVl7%2FOo7KECEgMpeSsuddjFyk25ZqSQ83ahjg%3D%3D
NL
der
527 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2840
Emai.exe
74.125.71.108:465
smtp.gmail.com
Google Inc.
US
whitelisted
2888
gup.exe
2.57.89.199:443
notepad-plus-plus.org
—
—
suspicious
—
—
2.21.242.197:80
isrg.trustid.ocsp.identrust.com
Akamai International B.V.
NL
whitelisted
—
—
2.21.242.245:80
ocsp.int-x3.letsencrypt.org
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
smtp.gmail.com
  • 74.125.71.108
malicious
notepad-plus-plus.org
  • 2.57.89.199
whitelisted
isrg.trustid.ocsp.identrust.com
  • 2.21.242.197
  • 2.21.242.187
whitelisted
ocsp.int-x3.letsencrypt.org
  • 2.21.242.245
  • 2.21.242.204
whitelisted

Threats

No threats detected
Process
Message
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
42C4C5846BB675C74E2B2C90C69AB44366401093
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
42C4C5846BB675C74E2B2C90C69AB44366401093
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
42C4C5846BB675C74E2B2C90C69AB44366401093
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
AutoLOG v1 - Cracked by Kaligo.zip