analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

7-Zip.7z

Full analysis: https://app.any.run/tasks/a791461a-34f7-40ca-9fc4-97d730aef0bb
Verdict: Malicious activity
Analysis date: July 18, 2019, 02:38:31
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

709AA1C065F623E89CC25A8D449D24A9

SHA1:

1E1E384DDD59AFA3BD3AACDC963B199BA3977AFF

SHA256:

A2202E06A1A2E3D5802E1D80CB7B32D82BC6EBB37D7C18309C76B5D3E80E7682

SSDEEP:

12288:oR/Ff0tkRPYUqqfdrn4T5ixBwR8PaWh9s4qR8ynEmrMG0:oR1RAUBn4TQxBVhqZ8A0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 7zFM.exe (PID: 3576)
      • 7zFMmgr.exe (PID: 2240)
      • 7zG.exe (PID: 2840)
      • 7z.exe (PID: 2368)

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 236)

    • Writes to a start menu file

      • iexplore.exe (PID: 3128)

    • Changes the login/logoff helper path in the registry

      • iexplore.exe (PID: 3128)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2844)
      • 7zFM.exe (PID: 3576)

    • Starts Internet Explorer

      • 7zFMmgr.exe (PID: 2240)

    • Creates files in the program directory

      • iexplore.exe (PID: 3128)

  • INFO

    • Manual execution by user

      • 7zFM.exe (PID: 3576)
      • WinRAR.exe (PID: 2844)
      • 7zG.exe (PID: 2840)
      • 7z.exe (PID: 2368)

    • Creates files in the user directory

      • iexplore.exe (PID: 3128)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
8
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winrar.exe no specs winrar.exe searchprotocolhost.exe no specs 7zfm.exe 7zfmmgr.exe no specs iexplore.exe 7zg.exe no specs 7z.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2948"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\7-Zip.7z"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
2844"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\7-Zip.7z"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
236"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe6_ Global\UsGthrCtrlFltPipeMssGthrPipe6 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
3576"C:\Users\admin\Desktop\7-Zip\7-Zip\7zFM.exe" C:\Users\admin\Desktop\7-Zip\7-Zip\7zFM.exe
explorer.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
MEDIUM
Description:
7-Zip File Manager
Version:
9.20
2240C:\Users\admin\Desktop\7-Zip\7-Zip\7zFMmgr.exeC:\Users\admin\Desktop\7-Zip\7-Zip\7zFMmgr.exe—7zFM.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3128"C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe
7zFMmgr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2840"C:\Users\admin\Desktop\7-Zip\7-Zip\7zG.exe" C:\Users\admin\Desktop\7-Zip\7-Zip\7zG.exe—explorer.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
MEDIUM
Description:
7-Zip GUI
Version:
9.20
2368"C:\Users\admin\Desktop\7-Zip\7-Zip\7z.exe" C:\Users\admin\Desktop\7-Zip\7-Zip\7z.exe—explorer.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
MEDIUM
Description:
7-Zip Console
Exit code:
0
Version:
9.20
Total events
1 053
Read events
985
Write events
0
Delete events
0

Modification events

No data
Executable files
5
Suspicious files
0
Text files
0
Unknown types
21

Dropped files

PID
Process
Filename
Type
22407zFMmgr.exeC:\Users\admin\AppData\Local\Temp\~TM2DF1.tmp —
MD5:—
SHA256:—
22407zFMmgr.exeC:\Users\admin\AppData\Local\Temp\~TM2E30.tmp —
MD5:—
SHA256:—
3128iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\enbfqohg.exe —
MD5:—
SHA256:—
3128iexplore.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat Reader DC\Berime.htmhtml
MD5:81CB6BA95B1399C8D519AE9CD79E1F28
SHA256:CDC86610B73C3880E378BA21153676D7F6185BDB45EF1221911FD419B6B809A7
2844WinRAR.exeC:\Users\admin\Desktop\7-Zip\7-Zip\7zFM.exeexecutable
MD5:E2B6C32D4ED3B253CA750B03B55ACAD1
SHA256:A0B92392ADE4AD7218239AC6A3E96EC6A626B71C187960CD077C92DC34D2330D
3128iexplore.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat Reader DC\IrakHau.htmhtml
MD5:207669D05090E0B671ADCB991EC79338
SHA256:3294D2A786DB1918062448F33399E674D65074E49EAFDA143A19A9AD669596C0
35767zFM.exeC:\Users\admin\Desktop\7-Zip\7-Zip\7zFMmgr.exeexecutable
MD5:303F491B9FC879064B210CB0B865D178
SHA256:15F7FB2EDC9B34E0DA2FC658DF38D8AEA52664F6BE1510DBA4636DC13F466F86
3128iexplore.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat Reader DC\Leame.htmhtml
MD5:CB478DFED185CBC0C41B004EAC2DF3D7
SHA256:8B84B3D1284045219943EBDFB52A0A8778620A0C922755FC3E38C572517C9BB9
2844WinRAR.exeC:\Users\admin\Desktop\7-Zip\7-Zip\7z.dllexecutable
MD5:2E8048095C77456188FB22C27A74F045
SHA256:75FFCF87077EDEB7197096B496721D7D42E762F1B99863998463FBC812DFAF15
3128iexplore.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat Reader DC\Llegiu-me.htmhtml
MD5:993119D1BAC05815A616A9FCA26833E2
SHA256:A8AA0D4D428B4795A1272B392B8BA655EF39D27B2E9A7CEAB073C6A65D0ACBD8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
9
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3128
iexplore.exe
172.217.21.238:80
google.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.21.238
whitelisted
stromoliks.com
  • —
malicious
promoliks.com
  • —
malicious

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
7-Zip.7z