analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

DoIT Zipped.zip

Full analysis: https://app.any.run/tasks/47e37278-b9b5-4e47-941e-2f489c7cd5b5
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: June 27, 2022, 07:32:43
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

63D30CF6DA5CB8BD51108B6BB2045A58

SHA1:

C3907C47CF78138218EFBABEDE367D1F5CA49411

SHA256:

A532DCCBC9829D6167645FAB46D44D11E310813150E7A5D57EAAF608BC277E76

SSDEEP:

384:UVxlBwmdjn04sWgS+XWnPja0Rp9ZqBVwKBUHwQHiqai0wpbi:Awsgl/SBjRfZqBVXywQCqiui

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • EXCEL.EXE (PID: 2252)

    • Executable content was dropped or overwritten

      • EXCEL.EXE (PID: 2252)

    • Registers / Runs the DLL via REGSVR32.EXE

      • EXCEL.EXE (PID: 2252)

    • Unusual execution from Microsoft Office

      • EXCEL.EXE (PID: 2252)

  • SUSPICIOUS

    • Checks supported languages

      • WinRAR.exe (PID: 2940)
      • WinRAR.exe (PID: 1808)

    • Reads the computer name

      • WinRAR.exe (PID: 1808)
      • WinRAR.exe (PID: 2940)

    • Application launched itself

      • WinRAR.exe (PID: 2940)

    • Starts Microsoft Office Application

      • WinRAR.exe (PID: 1808)

    • Reads default file associations for system extensions

      • WinRAR.exe (PID: 1808)

    • Drops a file with a compile date too recent

      • EXCEL.EXE (PID: 2252)

  • INFO

    • Reads the computer name

      • EXCEL.EXE (PID: 2252)

    • Checks supported languages

      • EXCEL.EXE (PID: 2252)
      • regsvr32.exe (PID: 3800)
      • regsvr32.exe (PID: 3676)
      • regsvr32.exe (PID: 936)
      • regsvr32.exe (PID: 2328)

    • Reads Microsoft Office registry keys

      • WinRAR.exe (PID: 1808)
      • EXCEL.EXE (PID: 2252)

    • Creates files in the user directory

      • EXCEL.EXE (PID: 2252)

    • Checks Windows Trust Settings

      • EXCEL.EXE (PID: 2252)

    • Reads settings of System Certificates

      • EXCEL.EXE (PID: 2252)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: W-9 form.zip
ZipUncompressedSize: 18728
ZipCompressedSize: 18728
ZipCRC: 0xb7868204
ZipModifyDate: 2022:06:27 03:31:19
ZipCompression: None
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
7
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs winrar.exe no specs excel.exe regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2940"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\DoIT Zipped.zip"C:\Program Files\WinRAR\WinRAR.exe—Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
1808"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIa2940.39088\W-9 form.zip"C:\Program Files\WinRAR\WinRAR.exe—WinRAR.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
2252"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /ddeC:\Program Files\Microsoft Office\Office14\EXCEL.EXE
WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Version:
14.0.6024.1000
3800C:\Windows\System32\regsvr32.exe /S ..\peg1.ocxC:\Windows\System32\regsvr32.exe—EXCEL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft(C) Register Server
Exit code:
3
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3676C:\Windows\System32\regsvr32.exe /S ..\peg2.ocxC:\Windows\System32\regsvr32.exe—EXCEL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft(C) Register Server
Exit code:
3
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2328C:\Windows\System32\regsvr32.exe /S ..\peg3.ocxC:\Windows\System32\regsvr32.exe—EXCEL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft(C) Register Server
Exit code:
3
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
936C:\Windows\System32\regsvr32.exe /S ..\peg4.ocxC:\Windows\System32\regsvr32.exe—EXCEL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft(C) Register Server
Exit code:
3
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
7 940
Read events
7 821
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
6
Text files
1
Unknown types
2

Dropped files

PID
Process
Filename
Type
2252EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVR83D3.tmp.cvr —
MD5:—
SHA256:—
2252EXCEL.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F8B7C3256F5D1243492F6BA96F024FA4der
MD5:DFB97CE42C51D9577C51952074F98ACE
SHA256:275CDC9078983DFA7BFE78C09839BE9C86A51C25C064A7C07CFD6D7A04EF958B
1808WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIb1808.39274\W-9 form.xlsdocument
MD5:B4AA7A6790D8D0A4484FEE5C9D3EDD91
SHA256:A0DE1F3AF78BEF68DDFCABF4B7CEDFA0E466AC65648A5E81E591702B463C96B1
2252EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\5eArcW7P[1].dllexecutable
MD5:400ACF98C6709C5789F5AE59287C8E8E
SHA256:3A845CF36F9A04EB6FA48E329316966BC0FA456D1DC68CE315E41BDDA3B50EC4
2252EXCEL.EXEC:\Users\admin\peg1.ocxexecutable
MD5:400ACF98C6709C5789F5AE59287C8E8E
SHA256:3A845CF36F9A04EB6FA48E329316966BC0FA456D1DC68CE315E41BDDA3B50EC4
2252EXCEL.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751der
MD5:EC8FF3B1DED0246437B1472C69DD1811
SHA256:E634C2D1ED20E0638C95597ADF4C9D392EBAB932D3353F18AF1E4421F4BB9CAB
2252EXCEL.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751binary
MD5:5A80892C70C10A0239418C682FBAD761
SHA256:893EA60299A58721914BD2AB34FAF72450BA8B3B2F7D5EA67614486F04FD4D6F
2252EXCEL.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\1G1FQ2YY.txttext
MD5:0FC4EA49EE0A5A2C49AB0117306AF336
SHA256:73E533BA8F2555EFD009B3CE0F4FBEC9FE7CAF44DEDA3F34D7152E4CEBA1EC29
2940WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa2940.39088\W-9 form.zipcompressed
MD5:8957F382579B95E6782A2B8643944DBF
SHA256:B3B92F165552EBA1485EC157E538B394996C7C7083B9432F2A79A48500EE9BDB
2252EXCEL.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:5702B2C8BB336BFE66633500482FAE26
SHA256:7119A741D310E550BC3006B969B4BEDE69657819F56EF1593BB38181B440472D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
9
DNS requests
9
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2252
EXCEL.EXE
GET
200
166.62.28.144:80
http://subbalakshmi.com/data_winning/kYv6xb/
US
executable
314 Kb
suspicious
2252
EXCEL.EXE
GET
—
177.11.48.94:80
http://www.dh.net.br/catalogo1/0cJpUJXBhuBaMdVWQf/
BR
—
—
unknown
2252
EXCEL.EXE
GET
200
23.45.105.185:80
http://x1.c.lencr.org/
NL
der
717 b
whitelisted
2252
EXCEL.EXE
GET
200
23.216.77.80:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?b42c17e06f7132f6
US
compressed
4.70 Kb
whitelisted
2252
EXCEL.EXE
GET
200
184.24.77.79:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgM1OnL%2FOkWb2eDsuqsGNmS02g%3D%3D
US
der
503 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2252
EXCEL.EXE
23.216.77.80:80
ctldl.windowsupdate.com
NTT DOCOMO, INC.
US
suspicious
2252
EXCEL.EXE
103.45.230.202:443
webhoanggia.com
Quang Trung Software City Development Company
VN
suspicious
2252
EXCEL.EXE
166.62.28.144:80
subbalakshmi.com
GoDaddy.com, LLC
US
suspicious
2252
EXCEL.EXE
23.45.105.185:80
x1.c.lencr.org
Akamai International B.V.
NL
unknown
2252
EXCEL.EXE
177.11.48.94:80
www.dh.net.br
Brasil Site Informatica LTDA
BR
unknown
2252
EXCEL.EXE
175.45.125.128:443
www.controlnetworks.com.au
Vocus Connect International Backbone
AU
suspicious
2252
EXCEL.EXE
184.24.77.79:80
r3.o.lencr.org
Time Warner Cable Internet LLC
US
suspicious
—
—
175.45.125.128:443
www.controlnetworks.com.au
Vocus Connect International Backbone
AU
suspicious

DNS requests

Domain
IP
Reputation
subbalakshmi.com
  • 166.62.28.144
suspicious
webhoanggia.com
  • 103.45.230.202
unknown
ctldl.windowsupdate.com
  • 23.216.77.80
  • 23.216.77.69
whitelisted
x1.c.lencr.org
  • 23.45.105.185
whitelisted
r3.o.lencr.org
  • 184.24.77.79
  • 184.24.77.48
shared
www.dh.net.br
  • 177.11.48.94
unknown
www.controlnetworks.com.au
  • 175.45.125.128
suspicious
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

PID
Process
Class
Message
2252
EXCEL.EXE
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2252
EXCEL.EXE
A Network Trojan was detected
ET CURRENT_EVENTS Likely Evil EXE download from MSXMLHTTP non-exe extension M2
2252
EXCEL.EXE
Misc activity
ET INFO EXE - Served Attached HTTP
2252
EXCEL.EXE
Potentially Bad Traffic
ET INFO TLS Handshake Failure
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
DoIT Zipped.zip