File name:

Microsoft.Windows.Universal.CD.keygen.zip

Full analysis: https://app.any.run/tasks/6d542ac7-c02d-4ea0-8398-360265a41e3b
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: August 09, 2020, 05:00:11
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
stealer
trojan
evasion
socelars
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

8F8FFC97DB5D6DF613B7E562FAE1F55E

SHA1:

0FE81860F9399D4D75DC36BDA3FA4FF6DD1F1200

SHA256:

A5ECB3F6E2267E81F4A8504FB293852867CFD90E51AA65BEEB2377E1124E40A2

SSDEEP:

393216:XPqig8DVts2KQNV4BL/qlmpXb6aiGVDSUH:u8DRVwLqlMXb6wRSUH

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Microsoft.Windows.Universal.CD.keygen.exe (PID: 2204)
      • keygen-step-3.exe (PID: 1132)
      • keygen-pr.exe (PID: 1840)
      • keygen-step-4.exe (PID: 3208)
      • key.exe (PID: 3028)
      • key.exe (PID: 1944)
      • whhw.exe (PID: 1028)
      • setup.upx.exe (PID: 2112)
      • id6.exe (PID: 668)
      • Setup.exe (PID: 1700)
      • Setup.exe (PID: 2892)
      • searzar.exe (PID: 2212)
      • jfiag_gg.exe (PID: 1256)
      • hjjgaa.exe (PID: 2148)
      • Install.exe (PID: 1740)
      • hjjgaa.exe (PID: 2956)
      • Install.exe (PID: 3500)

    • Stealing of credential data

      • keygen-step-3.exe (PID: 1132)
      • setup.upx.exe (PID: 2112)
      • id6.exe (PID: 668)

    • Runs PING.EXE for delay simulation

      • cmd.exe (PID: 2532)
      • cmd.exe (PID: 2896)

    • Actions looks like stealing of personal data

      • id6.exe (PID: 668)
      • keygen-step-4.exe (PID: 3208)
      • searzar.exe (PID: 2212)

    • Connects to CnC server

      • id6.exe (PID: 668)
      • searzar.exe (PID: 2212)

    • SOCELARS was detected

      • searzar.exe (PID: 2212)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • keygen-pr.exe (PID: 1840)
      • Microsoft.Windows.Universal.CD.keygen.exe (PID: 2204)
      • WinRAR.exe (PID: 3024)
      • keygen-step-4.exe (PID: 3208)
      • whhw.exe (PID: 1028)
      • Setup.exe (PID: 1700)
      • Setup.exe (PID: 2892)
      • Setup.tmp (PID: 2672)
      • hjjgaa.exe (PID: 2956)

    • Reads the cookies of Google Chrome

      • keygen-step-3.exe (PID: 1132)
      • setup.upx.exe (PID: 2112)
      • id6.exe (PID: 668)
      • searzar.exe (PID: 2212)
      • jfiag_gg.exe (PID: 1256)

    • Starts CMD.EXE for commands execution

      • Microsoft.Windows.Universal.CD.keygen.exe (PID: 2204)
      • keygen-step-3.exe (PID: 1132)
      • setup.upx.exe (PID: 2112)

    • Starts CMD.EXE for self-deleting

      • keygen-step-3.exe (PID: 1132)
      • setup.upx.exe (PID: 2112)

    • Application launched itself

      • key.exe (PID: 3028)
      • hjjgaa.exe (PID: 2148)

    • Reads the cookies of Mozilla Firefox

      • id6.exe (PID: 668)
      • searzar.exe (PID: 2212)

    • Creates files in the user directory

      • id6.exe (PID: 668)

    • Reads Internet Cache Settings

      • id6.exe (PID: 668)
      • searzar.exe (PID: 2212)

    • Reads the Windows organization settings

      • Setup.tmp (PID: 2672)

    • Checks for external IP

      • hjjgaa.exe (PID: 2956)

    • Creates a software uninstall entry

      • searzar.exe (PID: 2212)

    • Reads Windows owner or organization settings

      • Setup.tmp (PID: 2672)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • keygen-step-4.exe (PID: 3208)

    • Application was dropped or rewritten from another process

      • Setup.tmp (PID: 2672)
      • Setup.tmp (PID: 3972)

    • Creates a software uninstall entry

      • Setup.tmp (PID: 2672)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: 0x0009
ZipCompression: None
ZipModifyDate: 2020:06:10 18:30:00
ZipCRC: 0x7584dee9
ZipCompressedSize: 60
ZipUncompressedSize: 60
ZipFileName: FILE_ID.DIZ
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
68
Monitored processes
25
Malicious processes
13
Suspicious processes
3

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start winrar.exe microsoft.windows.universal.cd.keygen.exe cmd.exe no specs keygen-pr.exe keygen-step-3.exe keygen-step-4.exe cmd.exe no specs ping.exe no specs key.exe no specs whhw.exe key.exe no specs setup.upx.exe cmd.exe no specs ping.exe no specs id6.exe setup.exe setup.tmp no specs setup.exe setup.tmp #SOCELARS searzar.exe hjjgaa.exe no specs hjjgaa.exe install.exe no specs install.exe jfiag_gg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
668"C:\Users\admin\AppData\Local\Temp\RarSFX2\id6.exe" C:\Users\admin\AppData\Local\Temp\RarSFX2\id6.exe
keygen-step-4.exe
User:
admin
Integrity Level:
MEDIUM
Description:
20200801 Microsoft 基础类应用程序
Exit code:
4294967295
Version:
1, 0, 0, 1
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx2\id6.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1028"C:\Users\admin\AppData\Local\Temp\RarSFX2\whhw.exe" C:\Users\admin\AppData\Local\Temp\RarSFX2\whhw.exe
keygen-step-4.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx2\whhw.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1132keygen-step-3.exe C:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx0\keygen-step-3.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
1256C:\Users\admin\AppData\Local\Temp\jfiag_gg.exe /scookiestxt C:\Users\admin\AppData\Local\Temp\fjgha23_fa.txtC:\Users\admin\AppData\Local\Temp\jfiag_gg.exe—hjjgaa.exe
User:
admin
Company:
NirSoft
Integrity Level:
HIGH
Description:
ChromeCookiesView
Exit code:
0
Version:
1.60
Modules
Images
c:\users\admin\appdata\local\temp\jfiag_gg.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\gdi32.dll
1412ping 1.1.1.1 -n 1 -w 3000 C:\Windows\system32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ping.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
1700"C:\Users\admin\AppData\Local\Temp\RarSFX2\Setup.exe" C:\Users\admin\AppData\Local\Temp\RarSFX2\Setup.exe
keygen-step-4.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
searzar Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx2\setup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1740"C:\Users\admin\AppData\Local\Temp\RarSFX2\Install.exe" C:\Users\admin\AppData\Local\Temp\RarSFX2\Install.exe—keygen-step-4.exe
User:
admin
Company:
CyberLink Corp.
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx2\install.exe
c:\systemroot\system32\ntdll.dll
1840keygen-pr.exe -p83fsase3GeC:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx0\keygen-pr.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1944C:\Users\admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.datC:\Users\admin\AppData\Local\Temp\RarSFX1\key.exe—key.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2016cmd /c ""C:\Users\admin\AppData\Local\Temp\RarSFX0\keygen.bat" "C:\Windows\system32\cmd.exe—Microsoft.Windows.Universal.CD.keygen.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
2 793
Read events
2 691
Write events
96
Delete events
6

Modification events

(PID) Process:(3024) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3024) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3024) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\137\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3024) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\137\52C64B7E
Operation:writeName:@C:\Windows\system32\NetworkExplorer.dll,-1
Value:
Network
(PID) Process:(3024) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Microsoft.Windows.Universal.CD.keygen.zip
(PID) Process:(3024) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3024) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3024) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3024) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3024) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\137\52C64B7E
Operation:writeName:@C:\Windows\system32\msinfo32.exe,-10001
Value:
System Information File
Executable files
21
Suspicious files
5
Text files
8
Unknown types
6

Dropped files

PID
Process
Filename
Type
3024WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3024.6823\Microsoft.Windows.Universal.CD.keygen.exeexecutable
MD5:—
SHA256:—
2204Microsoft.Windows.Universal.CD.keygen.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exeexecutable
MD5:—
SHA256:—
2204Microsoft.Windows.Universal.CD.keygen.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\keygen.battext
MD5:—
SHA256:—
3024WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3024.6823\TSRh.nfotext
MD5:—
SHA256:—
2204Microsoft.Windows.Universal.CD.keygen.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exeexecutable
MD5:—
SHA256:—
1132keygen-step-3.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Login Data1sqlite
MD5:—
SHA256:—
3208keygen-step-4.exeC:\Users\admin\AppData\Local\Temp\RarSFX2\whhw.exeexecutable
MD5:—
SHA256:—
3208keygen-step-4.exeC:\Users\admin\AppData\Local\Temp\RarSFX2\id6.exeexecutable
MD5:—
SHA256:—
668id6.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cookies.sqlite-shm —
MD5:—
SHA256:—
3208keygen-step-4.exeC:\Users\admin\AppData\Local\Temp\RarSFX2\Setup.exeexecutable
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
10
DNS requests
8
Threats
19

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
668
id6.exe
POST
200
194.54.83.254:80
http://freekzvideo.cloud/business/receive
UA
—
—
malicious
1132
keygen-step-3.exe
POST
200
45.32.114.117:80
http://www.wdsfw34erf93.com/index.php/api/fb
SG
text
24 b
whitelisted
2112
setup.upx.exe
POST
200
45.32.114.117:80
http://www.wdsfw34erf93.com/index.php/api/fb
SG
text
24 b
whitelisted
2212
searzar.exe
GET
200
2.16.186.11:80
http://isrg.trustid.ocsp.identrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D
unknown
der
1.37 Kb
whitelisted
2956
hjjgaa.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/
unknown
text
289 b
malicious
2212
searzar.exe
GET
200
2.16.186.11:80
http://ocsp.int-x3.letsencrypt.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBR%2B5mrncpqz%2FPiiIGRsFqEtYHEIXQQUqEpqYwR93brm0Tm3pkVl7%2FOo7KECEgObfHHgHlsa0R7fVL2Sj72S7g%3D%3D
unknown
der
527 b
whitelisted
2212
searzar.exe
GET
200
149.28.244.249:80
http://www.ipcode.pw/
US
text
2 b
malicious
2212
searzar.exe
POST
200
38.27.96.30:80
http://www.nicekkk.pw/Home/Index/getdata
US
text
7 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2212
searzar.exe
38.27.96.30:80
www.nicekkk.pw
HOSTSPACE NETWORKS LLC
US
malicious
2956
hjjgaa.exe
208.95.112.1:80
ip-api.com
IBURST
—
malicious
1132
keygen-step-3.exe
45.32.114.117:80
www.wdsfw34erf93.com
Choopa, LLC
SG
malicious
2112
setup.upx.exe
45.32.114.117:80
www.wdsfw34erf93.com
Choopa, LLC
SG
malicious
668
id6.exe
194.54.83.254:80
freekzvideo.cloud
Omnilance Ltd
UA
malicious
2212
searzar.exe
88.99.66.31:443
iplogger.org
Hetzner Online GmbH
DE
malicious
2212
searzar.exe
149.28.244.249:80
www.ipcode.pw
—
US
suspicious
2212
searzar.exe
2.16.186.11:80
isrg.trustid.ocsp.identrust.com
Akamai International B.V.
—
whitelisted

DNS requests

Domain
IP
Reputation
www.wdsfw34erf93.com
  • 45.32.114.117
whitelisted
freekzvideo.cloud
  • 194.54.83.254
malicious
www.ipcode.pw
  • 149.28.244.249
malicious
iplogger.org
  • 88.99.66.31
shared
isrg.trustid.ocsp.identrust.com
  • 2.16.186.11
  • 2.16.186.35
whitelisted
ocsp.int-x3.letsencrypt.org
  • 2.16.186.11
  • 2.16.186.27
whitelisted
www.nicekkk.pw
  • 38.27.96.30
malicious
ip-api.com
  • 208.95.112.1
malicious

Threats

PID
Process
Class
Message
1056
svchost.exe
Potentially Bad Traffic
ET INFO Observed DNS Query to .cloud TLD
668
id6.exe
A Network Trojan was detected
ET TROJAN Suspicious User-Agent (WindowsNT) With No Separating Space
668
id6.exe
Potentially Bad Traffic
ET INFO HTTP Request to Suspicious *.cloud Domain
1056
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.pw domain - Likely Hostile
2212
searzar.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.pw domain
2212
searzar.exe
Potential Corporate Privacy Violation
POLICY [PTsecurity] IP Check Domain SSL certificate
2212
searzar.exe
Potential Corporate Privacy Violation
POLICY [PTsecurity] IP Check Domain SSL certificate
1056
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.pw domain - Likely Hostile
2956
hjjgaa.exe
Potential Corporate Privacy Violation
ET POLICY External IP Lookup ip-api.com
2956
hjjgaa.exe
Potential Corporate Privacy Violation
AV POLICY Internal Host Retrieving External IP Address (ip-api. com)
7 ETPRO signatures available at the full report
Process
Message
id6.exe
006
id6.exe
http://freekzvideo.cloud/business/receive
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Microsoft.Windows.Universal.CD.keygen.zip