File name:

die_win32_portable_2.04.zip

Full analysis: https://app.any.run/tasks/e11c08e4-6033-4830-8570-d9b285b1b990
Verdict: Malicious activity
Analysis date: September 23, 2019, 13:59:51
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

EEA56BAD14EC8D63FCEA679CD82CCEC0

SHA1:

4BBAC206223B8742669864A80C689BB875453CE3

SHA256:

A55B795EEBFD2CB610307575D27E0D6FA154284ACD0AA16FF3967D345EDE2EA1

SSDEEP:

196608:DJmtJ5EXGlYVDU8rjEcE6hwZVU/zxh8UFcqdGaUH/ANSagnxvfhWpEJAAEO:+OG+lU8PEc0ZVUroUaSUHKoRSEJkO

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • diel.exe (PID: 2892)
      • SearchProtocolHost.exe (PID: 596)

    • Application was dropped or rewritten from another process

      • diel.exe (PID: 2892)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3160)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • WinRAR.exe (PID: 3160)

    • Manual execution by user

      • diel.exe (PID: 1492)

    • Modifies the open verb of a shell class

      • rundll32.exe (PID: 3300)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xpi | Mozilla Firefox browser extension (66.6)
.zip | ZIP compressed archive (33.3)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2019:06:29 21:59:12
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: die_win32_portable/base/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
5
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start rundll32.exe no specs winrar.exe diel.exe no specs diel.exe no specs searchprotocolhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
596"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe4_ Global\UsGthrCtrlFltPipeMssGthrPipe4 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1492"C:\Users\admin\Desktop\die_win32_portable\diel.exe" C:\Users\admin\Desktop\die_win32_portable\diel.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\die_win32_portable\diel.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
2892"C:\Users\admin\Desktop\die_win32_portable\base\diel.exe" C:\Users\admin\Desktop\die_win32_portable\base\diel.exe—diel.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\die_win32_portable\base\diel.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\desktop\die_win32_portable\base\msvcp120.dll
c:\users\admin\desktop\die_win32_portable\base\msvcr120.dll
c:\users\admin\desktop\die_win32_portable\base\qt5core.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
3160"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\die_win32_portable_2.04.zip.xpi"C:\Program Files\WinRAR\WinRAR.exe
rundll32.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3300"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\die_win32_portable_2.04.zip.xpiC:\Windows\system32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
Total events
2 302
Read events
2 032
Write events
268
Delete events
2

Modification events

(PID) Process:(3300) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Windows\system32\NOTEPAD.EXE
Value:
Notepad
(PID) Process:(3300) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\PROGRA~1\MICROS~1\Office14\OIS.EXE
Value:
Microsoft Office 2010
(PID) Process:(3300) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Value:
Microsoft Word
(PID) Process:(3300) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:NodeSlots
Value:
020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202
(PID) Process:(3300) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:MRUListEx
Value:
01000000070000000200000009000000080000000000000006000000030000000500000004000000FFFFFFFF
(PID) Process:(3300) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0
Operation:writeName:MRUListEx
Value:
0100000000000000040000000200000003000000FFFFFFFF
(PID) Process:(3300) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\35\Shell
Operation:writeName:SniffedFolderType
Value:
Generic
(PID) Process:(3300) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\72\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3300) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\1
Operation:writeName:5
Value:
64003100000000008C3E021210005749343232337E3100004C0008000400EFBEEE3A90268C3E02122A000000C7000000000001000000000000000000000000000000570069006E0064006F007700730020005300690064006500620061007200000018000000
(PID) Process:(3300) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\1
Operation:writeName:MRUListEx
Value:
050000000400000003000000010000000000000002000000FFFFFFFF
Executable files
17
Suspicious files
0
Text files
1 323
Unknown types
9

Dropped files

PID
Process
Filename
Type
3160WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3160.24333\die_win32_portable\base\db\Binary\archives.1.sgtext
MD5:—
SHA256:—
3160WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3160.24333\die_win32_portable\base\db\Binary\bzip.1.sgtext
MD5:5DF51796F29A332990CFEB3CF1728023
SHA256:26E409AE2517FEE690C00BB63EDA2C62935484A6EEFA680760F76B038C361CBE
3160WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3160.24333\die_win32_portable\base\db\Binary\AAALogo.1.sgtext
MD5:E92C115C72DA1D351E89A3092D4EE9D9
SHA256:4AC6B9076AD9A5ABB8849058D5E2F7EB32C5244B8D79D344D036760949D3E372
3160WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3160.24333\die_win32_portable\base\db\Binary\BMP.1.sgtext
MD5:454F741CAC5CD8E2F3ADCDEBA7AF7C5A
SHA256:2B128C67E1011D71B0C354FDEF5C7E8E867E5E3395C15A8C055AA17C40C72C3E
3160WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3160.24333\die_win32_portable\base\db\Binary\ACE.1.sgtext
MD5:3EF3594E4C70D09536A57DABA4858C98
SHA256:9B3A0C690A1BD30BFFCCF3E565423264D65378A5E286BFB8C16F2CDF00A0E067
3160WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3160.24333\die_win32_portable\base\db\Binary\7z.1.sgtext
MD5:25CF0911FEA65A5A6A3D8AFA09C3C376
SHA256:ACECD5BE79FB377F2728651B7CBB77866914DA8CE3E8D83BFAE5A0A52CE2AA06
3160WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3160.24333\die_win32_portable\base\db\arjtext
MD5:E4158633E7F2AEC1703496E43345BA7B
SHA256:AC3967DD2AEE6BF203E502E76CDA8636D4AE60BBAF0ACFC04993B060CD5778BE
3160WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3160.24333\die_win32_portable\base\db\Binary\ARJ.1.sgtext
MD5:54D0943CB2258DC1B7DA947E690C21D2
SHA256:18B44BFB9C336354A949507BE1E67BF68759D88EDB12CA8F734C46FFB526428A
3160WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3160.24333\die_win32_portable\base\db\Binary\audio.1.sgtext
MD5:5AC64FDDEF988C97A168446A05DE1293
SHA256:950C686E40877907C16A34A49216A10643424A1918CDCBF08B2933F9324E85BA
3160WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3160.24333\die_win32_portable\base\db\archivetext
MD5:C73B9153F26CBBC887BF0D6C9A450968
SHA256:DDD0B146C6352FBA723376F5C6F4D64A44C008BD289B4AA5ABC371AB6D6C795D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
die_win32_portable_2.04.zip