analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

7-Zip.7z

Full analysis: https://app.any.run/tasks/8824ff3d-2663-4c57-a811-41c1d3cb3bb6
Verdict: Malicious activity
Analysis date: July 18, 2019, 02:47:47
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

709AA1C065F623E89CC25A8D449D24A9

SHA1:

1E1E384DDD59AFA3BD3AACDC963B199BA3977AFF

SHA256:

A2202E06A1A2E3D5802E1D80CB7B32D82BC6EBB37D7C18309C76B5D3E80E7682

SSDEEP:

12288:oR/Ff0tkRPYUqqfdrn4T5ixBwR8PaWh9s4qR8ynEmrMG0:oR1RAUBn4TQxBVhqZ8A0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 292)
      • explorer.exe (PID: 284)
      • 7zFMmgr.exe (PID: 1708)
      • WinRAR.exe (PID: 2948)
      • DllHost.exe (PID: 3220)
      • 7zFM.exe (PID: 3416)
      • DllHost.exe (PID: 4044)
      • iexplore.exe (PID: 2988)
      • DllHost.exe (PID: 3032)
      • DllHost.exe (PID: 2624)
      • SearchProtocolHost.exe (PID: 3456)

    • Application was dropped or rewritten from another process

      • 7zFM.exe (PID: 3416)
      • 7zFMmgr.exe (PID: 1708)

    • Changes the login/logoff helper path in the registry

      • iexplore.exe (PID: 2988)

    • Writes to a start menu file

      • iexplore.exe (PID: 2988)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2948)
      • explorer.exe (PID: 284)
      • 7zFM.exe (PID: 3416)
      • 7zFMmgr.exe (PID: 1708)

    • Creates files in the user directory

      • explorer.exe (PID: 284)

    • Reads Internet Cache Settings

      • explorer.exe (PID: 284)

    • Starts Internet Explorer

      • 7zFMmgr.exe (PID: 1708)

    • Creates files in the program directory

      • iexplore.exe (PID: 2988)

  • INFO

    • Creates files in the user directory

      • iexplore.exe (PID: 2988)

    • Reads Microsoft Office registry keys

      • SearchProtocolHost.exe (PID: 3456)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
11
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winrar.exe searchprotocolhost.exe no specs explorer.exe 7zfm.exe 7zfmmgr.exe iexplore.exe Thumbnail Cache Out of Proc Server no specs Thumbnail Cache Out of Proc Server no specs Thumbnail Cache Out of Proc Server no specs Thumbnail Cache Out of Proc Server no specs searchprotocolhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2948"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\7-Zip.7z"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
292"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe6_ Global\UsGthrCtrlFltPipeMssGthrPipe6 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
284C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3416"C:\Users\admin\Desktop\7-Zip\7-Zip\7zFM.exe" C:\Users\admin\Desktop\7-Zip\7-Zip\7zFM.exe
explorer.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
MEDIUM
Description:
7-Zip File Manager
Version:
9.20
1708C:\Users\admin\Desktop\7-Zip\7-Zip\7zFMmgr.exeC:\Users\admin\Desktop\7-Zip\7-Zip\7zFMmgr.exe
7zFM.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2988"C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe
7zFMmgr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3220C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}C:\Windows\system32\DllHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
4044C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}C:\Windows\system32\DllHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3032C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}C:\Windows\system32\DllHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2624C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}C:\Windows\system32\DllHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
5 397
Read events
5 229
Write events
0
Delete events
0

Modification events

No data
Executable files
7
Suspicious files
1
Text files
0
Unknown types
25

Dropped files

PID
Process
Filename
Type
17087zFMmgr.exeC:\Users\admin\AppData\Local\Temp\~TM1605.tmp —
MD5:—
SHA256:—
2988iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\enbfqohg.exe —
MD5:—
SHA256:—
284explorer.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\7-Zip.7z.lnklnk
MD5:2C0AD72051ABD31F92B2A3638300140D
SHA256:7FDC5C30DA19601743ED58745463CDD10648F1227B80653C5ADA3D761177D5E1
284explorer.exeC:\$RECYCLE.BIN\S-1-5-21-1302019708-1500728564-335382590-1000\$IEBWMN3.dllbinary
MD5:D4209D7272CC626FF10E47DDDEFB6D33
SHA256:EBAC28E39C4088488CE592F3DB72F6BD661E7B30E56A6C9EB5E01C4DCA996B6C
2948WinRAR.exeC:\Users\admin\Desktop\7-Zip\7-Zip\7zFM.exeexecutable
MD5:E2B6C32D4ED3B253CA750B03B55ACAD1
SHA256:A0B92392ADE4AD7218239AC6A3E96EC6A626B71C187960CD077C92DC34D2330D
284explorer.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\290532160612e071.automaticDestinations-msautomaticdestinations-ms
MD5:7A660A59E27349C3A279CDD5490E0CF8
SHA256:98898C79F7AFE3ABCC193500483C6EBC3080704A4960614A70162D7CBBBC9D2D
2948WinRAR.exeC:\Users\admin\Desktop\7-Zip\7-Zip\7zG.exeexecutable
MD5:B833921B229ABD268C736F3265CFAFF8
SHA256:903CD6736EE2B1B838525D348BB2EF3132A4F227C70DCC0BFF0F5B597E587585
2988iexplore.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat Reader DC\Leame.htmhtml
MD5:BBBBB672554BED63CB0F9EA1E1750755
SHA256:972C32AF0EAAAC3A433CAFC71CF13B2BBA1B04624A7F6A9011BDEED491290398
284explorer.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012019071820190719\index.datdat
MD5:ABA585618BCCBB05CA815BA2BEDF17FA
SHA256:0352FCC7B2ED722C187ED9CB6C387F3441C1CBD138411AF25220F852F9EBAF62
34167zFM.exeC:\Users\admin\Desktop\7-Zip\7-Zip\7zFMmgr.exeexecutable
MD5:303F491B9FC879064B210CB0B865D178
SHA256:15F7FB2EDC9B34E0DA2FC658DF38D8AEA52664F6BE1510DBA4636DC13F466F86
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
12
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2988
iexplore.exe
172.217.22.14:80
google.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
stromoliks.com
  • —
malicious
google.com
  • 172.217.22.14
whitelisted
promoliks.com
  • —
malicious

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
7-Zip.7z