analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

7-Zip.7z

Full analysis: https://app.any.run/tasks/cc75af93-ce58-40d7-9958-ecfb31dcf6c2
Verdict: Malicious activity
Analysis date: July 17, 2019, 05:03:37
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

709AA1C065F623E89CC25A8D449D24A9

SHA1:

1E1E384DDD59AFA3BD3AACDC963B199BA3977AFF

SHA256:

A2202E06A1A2E3D5802E1D80CB7B32D82BC6EBB37D7C18309C76B5D3E80E7682

SSDEEP:

12288:oR/Ff0tkRPYUqqfdrn4T5ixBwR8PaWh9s4qR8ynEmrMG0:oR1RAUBn4TQxBVhqZ8A0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Loads dropped or rewritten executable

      • explorer.exe (PID: 124)
      • SearchProtocolHost.exe (PID: 840)
    • Writes to a start menu file

      • iexplore.exe (PID: 3684)
    • Application was dropped or rewritten from another process

      • 7z.exe (PID: 752)
      • 7zmgr.exe (PID: 3100)
    • Changes the login/logoff helper path in the registry

      • iexplore.exe (PID: 3684)
  • SUSPICIOUS

    • Creates files in the user directory

      • explorer.exe (PID: 124)
    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3136)
      • 7z.exe (PID: 752)
    • Reads Internet Cache Settings

      • explorer.exe (PID: 124)
    • Uses RUNDLL32.EXE to load library

      • explorer.exe (PID: 124)
    • Starts Internet Explorer

      • 7zmgr.exe (PID: 3100)
    • Creates files in the program directory

      • iexplore.exe (PID: 3684)
  • INFO

    • Manual execution by user

      • rundll32.exe (PID: 2960)
    • Creates files in the user directory

      • iexplore.exe (PID: 3684)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
7
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start winrar.exe searchprotocolhost.exe no specs explorer.exe no specs rundll32.exe no specs 7z.exe 7zmgr.exe no specs iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
3136"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\7-Zip.7z"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
840"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe8_ Global\UsGthrCtrlFltPipeMssGthrPipe8 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exeSearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
124C:\Windows\Explorer.EXEC:\Windows\explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2960"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\Desktop\7-Zip\7-Zip\7z.dllC:\Windows\system32\rundll32.exeexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
752"C:\Users\admin\Desktop\7-Zip\7-Zip\7z.exe" C:\Users\admin\Desktop\7-Zip\7-Zip\7z.exe
explorer.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
MEDIUM
Description:
7-Zip Console
Exit code:
0
Version:
9.20
3100C:\Users\admin\Desktop\7-Zip\7-Zip\7zmgr.exeC:\Users\admin\Desktop\7-Zip\7-Zip\7zmgr.exe7z.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3684"C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe
7zmgr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Total events
3 709
Read events
3 511
Write events
0
Delete events
0

Modification events

No data
Executable files
5
Suspicious files
0
Text files
0
Unknown types
25

Dropped files

PID
Process
Filename
Type
31007zmgr.exeC:\Users\admin\AppData\Local\Temp\~TM38ED.tmp
MD5:
SHA256:
31007zmgr.exeC:\Users\admin\AppData\Local\Temp\~TM390D.tmp
MD5:
SHA256:
3684iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\enbfqohg.exe
MD5:
SHA256:
124explorer.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\290532160612e071.automaticDestinations-msautomaticdestinations-ms
MD5:9E4BCF29DF72E292DEDB5942F880FB8F
SHA256:5C9984C8B5D90F617E907C80E68FC353F2F31471F25148930D40B15B53BFACE6
3684iexplore.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat Reader DC\Benioku.htmhtml
MD5:56E65F5DA74FDC93FBD1AB34877C2EDD
SHA256:3B8D45471509A1F24C0AD7052A56D12F9AC95E22632C4138115981F1AF67726B
7527z.exeC:\Users\admin\Desktop\7-Zip\7-Zip\7zmgr.exeexecutable
MD5:303F491B9FC879064B210CB0B865D178
SHA256:15F7FB2EDC9B34E0DA2FC658DF38D8AEA52664F6BE1510DBA4636DC13F466F86
124explorer.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\7-Zip.7z.lnklnk
MD5:2C4DDD9B3F88312CEC2EC988A20EDE38
SHA256:05130D6FB3E794B399CDE33B03E5E42C6E720F3D4EEBD539C1EE8DCD5E999B5C
3136WinRAR.exeC:\Users\admin\Desktop\7-Zip\7-Zip\7z.dllexecutable
MD5:2E8048095C77456188FB22C27A74F045
SHA256:75FFCF87077EDEB7197096B496721D7D42E762F1B99863998463FBC812DFAF15
3684iexplore.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat Reader DC\LeiaMe.htmhtml
MD5:D799D49A1F8389159C370EBA1A5A1968
SHA256:3C5839E2E3FD60EA0B114B8C1E9D3CA59CE935BF94CA6323681C3B23FFEFDD71
3136WinRAR.exeC:\Users\admin\Desktop\7-Zip\7-Zip\7zG.exeexecutable
MD5:B833921B229ABD268C736F3265CFAFF8
SHA256:903CD6736EE2B1B838525D348BB2EF3132A4F227C70DCC0BFF0F5B597E587585
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
9
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3684
iexplore.exe
172.217.22.110:80
google.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
stromoliks.com
malicious
google.com
  • 172.217.22.110
whitelisted
promoliks.com
malicious
pornoliks.com
malicious

Threats

No threats detected
No debug info