analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Illegal_Services-main.zip

Full analysis: https://app.any.run/tasks/0e16b94f-60f5-402b-a6dc-8118674a5e45
Verdict: Malicious activity
Analysis date: August 12, 2022, 14:36:12
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

06F7BF547914ED645C007627D82789A7

SHA1:

06D8260039B241A55E05520C341D35633FA2107E

SHA256:

A18B78BD9BAD355929B666C5A2224EC74718BF4B3A897AF173B358A9028D1B97

SSDEEP:

393216:tQaT7uZztcOKKMg+oSFkQRPtOHMmFqpA//3yUxMSLWO3qEv6eWxhl:L7W5cVKP+XFkQRPt8f/iUB6Ev6eWx/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • WinRAR.exe (PID: 3024)

    • Application was dropped or rewritten from another process

      • Illegal_Services.exe (PID: 3492)
      • Illegal_Services.exe (PID: 2888)
      • Illegal_Services.exe (PID: 964)
      • Illegal_Services.exe (PID: 284)

  • SUSPICIOUS

    • Checks supported languages

      • WinRAR.exe (PID: 3024)
      • cmd.exe (PID: 1976)
      • Illegal_Services.exe (PID: 2888)
      • chcp.com (PID: 2308)
      • cmd.exe (PID: 2408)
      • cmd.exe (PID: 3828)
      • cmd.exe (PID: 4024)
      • cmd.exe (PID: 2028)
      • chcp.com (PID: 2660)
      • cmd.exe (PID: 1076)
      • powershell.exe (PID: 2776)
      • cmd.exe (PID: 2236)
      • cmd.exe (PID: 2220)
      • chcp.com (PID: 1984)
      • cmd.exe (PID: 3084)
      • WMIC.exe (PID: 3252)
      • cscript.exe (PID: 4040)
      • Illegal_Services.exe (PID: 284)
      • cmd.exe (PID: 3036)
      • chcp.com (PID: 3972)
      • cmd.exe (PID: 4020)
      • cmd.exe (PID: 344)
      • cmd.exe (PID: 1788)
      • chcp.com (PID: 1008)
      • cmd.exe (PID: 2184)
      • cmd.exe (PID: 2968)
      • cscript.exe (PID: 3328)
      • powershell.exe (PID: 2468)
      • WMIC.exe (PID: 3940)
      • cmd.exe (PID: 2892)
      • chcp.com (PID: 2792)

    • Reads the computer name

      • WinRAR.exe (PID: 3024)
      • powershell.exe (PID: 2776)
      • WMIC.exe (PID: 3252)
      • cscript.exe (PID: 4040)
      • powershell.exe (PID: 2468)
      • cscript.exe (PID: 3328)
      • WMIC.exe (PID: 3940)

    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 3024)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3024)

    • Application launched itself

      • cmd.exe (PID: 1976)
      • cmd.exe (PID: 3036)

    • Starts application with an unusual extension

      • cmd.exe (PID: 1976)
      • cmd.exe (PID: 3036)

    • Checks Windows language

      • reg.exe (PID: 3208)

  • INFO

    • Checks supported languages

      • findstr.exe (PID: 3324)
      • attrib.exe (PID: 2824)
      • attrib.exe (PID: 3088)
      • findstr.exe (PID: 3444)
      • cmd.exe (PID: 3808)
      • forfiles.exe (PID: 3660)
      • reg.exe (PID: 312)
      • reg.exe (PID: 3984)
      • reg.exe (PID: 2252)
      • reg.exe (PID: 3208)
      • reg.exe (PID: 1180)
      • reg.exe (PID: 2548)
      • attrib.exe (PID: 2288)
      • attrib.exe (PID: 1304)
      • forfiles.exe (PID: 3996)
      • findstr.exe (PID: 3856)
      • reg.exe (PID: 3208)
      • findstr.exe (PID: 3720)
      • cmd.exe (PID: 2164)
      • reg.exe (PID: 332)

    • Dropped object may contain TOR URL's

      • Illegal_Services.exe (PID: 2888)
      • Illegal_Services.exe (PID: 284)

    • Checks Windows Trust Settings

      • powershell.exe (PID: 2776)
      • cscript.exe (PID: 4040)
      • powershell.exe (PID: 2468)
      • cscript.exe (PID: 3328)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2022:07:14 15:02:25
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: Illegal_Services-main/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
95
Monitored processes
53
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start drop and start drop and start drop and start start winrar.exe illegal_services.exe no specs illegal_services.exe cmd.exe no specs attrib.exe no specs attrib.exe no specs findstr.exe no specs findstr.exe no specs chcp.com no specs cmd.exe no specs forfiles.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs reg.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs chcp.com no specs powershell.exe no specs chcp.com no specs cmd.exe no specs cmd.exe no specs wmic.exe no specs cscript.exe no specs illegal_services.exe no specs illegal_services.exe cmd.exe no specs attrib.exe no specs attrib.exe no specs findstr.exe no specs findstr.exe no specs chcp.com no specs cmd.exe no specs forfiles.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs chcp.com no specs powershell.exe no specs chcp.com no specs cmd.exe no specs cmd.exe no specs wmic.exe no specs cscript.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3024"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Illegal_Services-main.zip"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\winrar\winrar.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\comdlg32.dll
3492"C:\Users\admin\AppData\Local\Temp\Rar$EXa3024.15063\Illegal_Services-main\Illegal_Services.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3024.15063\Illegal_Services-main\Illegal_Services.exe—WinRAR.exe
User:
admin
Company:
IB_U_Z_Z_A_R_Dl
Integrity Level:
MEDIUM
Description:
Illegal Services
Exit code:
3221226540
Version:
6. 1. 7. 5
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3024.15063\illegal_services-main\illegal_services.exe
c:\windows\system32\ntdll.dll
2888"C:\Users\admin\AppData\Local\Temp\Rar$EXa3024.15063\Illegal_Services-main\Illegal_Services.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3024.15063\Illegal_Services-main\Illegal_Services.exe
WinRAR.exe
User:
admin
Company:
IB_U_Z_Z_A_R_Dl
Integrity Level:
HIGH
Description:
Illegal Services
Exit code:
0
Version:
6. 1. 7. 5
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3024.15063\illegal_services-main\illegal_services.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1976cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\8OJSXJTU.bat" "C:\Users\admin\AppData\Local\Temp\Rar$EXa3024.15063\Illegal_Services-main\Illegal_Services.exe" "C:\Windows\system32\cmd.exe—Illegal_Services.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2824attrib -s -h "C:\Users\admin\AppData\Local\Temp\8OJSXJTU.bat"C:\Windows\system32\attrib.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Attribute Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\attrib.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ulib.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3088attrib +s +h +i "C:\Users\admin\AppData\Local\Temp\8OJSXJTU.bat"C:\Windows\system32\attrib.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Attribute Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\attrib.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ulib.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3324findstr /v "f7f81a39-5f63-5b42-9efd-1f13b5431005quot; "C:\Users\admin\AppData\Local\Temp\8OJSXJTU.bat" C:\Windows\system32\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
3444findstr /v "f7f81a39-5f63-5b42-9efd-1f13b5431005quot; "C:\Users\admin\AppData\Local\Temp\8OJSXJTU.bat" C:\Windows\system32\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
2308chcp 65001C:\Windows\system32\chcp.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Change CodePage Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\chcp.com
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2408C:\Windows\system32\cmd.exe /c forfiles /m "Illegal_Services.exe" /c "cmd /c echo 0x1B"C:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
2 058
Read events
2 036
Write events
22
Delete events
0

Modification events

(PID) Process:(3024) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3024) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3024) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3024) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3024) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3024) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Illegal_Services-main.zip
(PID) Process:(3024) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3024) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3024) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3024) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
38
Suspicious files
0
Text files
44
Unknown types
1

Dropped files

PID
Process
Filename
Type
3024WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3024.15063\Illegal_Services-main\README.mdtext
MD5:E515D27D5FCB15E78570A8AF4723F3D3
SHA256:96FAA32058D5B9A97928964BA078DD3B6D205DEDA5D147BC980227FA067001A3
3024WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3024.15063\Illegal_Services-main\Illegal_Services.exeexecutable
MD5:66D0EA0833AB7B06621BD871CD68BD09
SHA256:C1374A0F81E3B8C05CB8E47AA1241D09E9B840E2844366027DD9F6F686A3D56A
3024WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3024.15063\Illegal_Services-main\ChangeLog.txttext
MD5:07D01D1E0B9ABF35FE03D07BD05C742F
SHA256:32643AE7BA508193FB24BC11447F7AE2EDAB3B6D46EF60CFC6CE610C13494E19
3024WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3024.15063\Illegal_Services-main\EULA.rtftext
MD5:D637221F9CF08906BFBFBDFB5077AD8C
SHA256:196FA5F8A3072D18CA9497BCBCA24F89F2B7C63C1B3D6E9B39C0F529443ED273
3024WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3024.15063\Illegal_Services-main\lib\backgrounds\background-11.jpgimage
MD5:E5A334E8FE228678044EDC42639F02AF
SHA256:450EEB7971F122C5FBB13C2B0B04C75BAC926896C107CE72510F5F0BB200C1FA
3024WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3024.15063\Illegal_Services-main\lib\backgrounds\background-1.jpgimage
MD5:D156D6EAF931D4F2C8A93DAD8072BA88
SHA256:7A87FE781EBB56EACAA7440AA97E070B4A7503360A0487AF6B3A0D549F6C0AE3
3024WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3024.15063\Illegal_Services-main\lib\7za\x86\7za.dllexecutable
MD5:3107CAECF7EC7A7CE12D05F9C3AB078F
SHA256:BD377BA96FF8D3CBAEA98190C8A60F32DC9D64DD44EED9AADE05D3A74D935701
3024WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3024.15063\Illegal_Services-main\lib\7za\x64\7za.dllexecutable
MD5:5E79330DFA8F102DA34A4AE39B181DA1
SHA256:F306D5766040C252E312893B232CD985B5BF8C7BB1856DB78CCE9FB2D4A4FF58
3024WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3024.15063\Illegal_Services-main\lib\OpenFileBox.exeexecutable
MD5:867FF8BE4D59E321F40A5ADF1EBAFC87
SHA256:E30EACC0079EEA5F32174FC258A717F5BD6671CA7D44911B7F06361590338793
3024WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3024.15063\Illegal_Services-main\lib\7za\x64\7zxa.dllexecutable
MD5:275114D5C4EE6285991160671424E162
SHA256:FC831C36755602B29B042E7E8079CEA4639489BD72FBACA0835CDE93AFF7885E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Illegal_Services-main.zip