File name:

Nv2-PC.zip

Full analysis: https://app.any.run/tasks/b9368f2b-9672-4533-aadc-a566171eba45
Verdict: Malicious activity
Analysis date: March 10, 2024, 09:16:34
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

8A07CB456276C40D7167DE20DE9D2B9A

SHA1:

44C07355473654CA112DD942D004EEAEA4E75BF9

SHA256:

A5FD97368F47067F5A4157847F66041A8802F016B38B8C63A4E8D35BFB0B3ECC

SSDEEP:

98304:pgItChwWw67OZd/9zS4paVDMl/fk6rdgSa969:aiMAYM/1S4p6O/sydgs

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 2160)

    • Creates a writable file in the system directory

      • Nv2-PC.exe (PID: 2364)
      • printfilterpipelinesvc.exe (PID: 980)

  • SUSPICIOUS

    • Reads the Internet Settings

      • Nv2-PC.exe (PID: 3720)
      • Nv2-PC.exe (PID: 2364)
      • printfilterpipelinesvc.exe (PID: 980)

    • Reads security settings of Internet Explorer

      • Nv2-PC.exe (PID: 3720)
      • Nv2-PC.exe (PID: 2364)
      • ONENOTE.EXE (PID: 2804)

    • Checks Windows Trust Settings

      • ONENOTE.EXE (PID: 2804)

    • Reads settings of System Certificates

      • ONENOTE.EXE (PID: 2804)

    • Non-standard symbols in registry

      • ONENOTE.EXE (PID: 2804)

  • INFO

    • Creates files or folders in the user directory

      • Nv2-PC.exe (PID: 3720)
      • Nv2-PC.exe (PID: 2364)
      • printfilterpipelinesvc.exe (PID: 980)
      • ONENOTE.EXE (PID: 2804)

    • Reads CPU info

      • Nv2-PC.exe (PID: 3720)
      • Nv2-PC.exe (PID: 2364)

    • Reads the machine GUID from the registry

      • Nv2-PC.exe (PID: 3720)
      • Nv2-PC.exe (PID: 2364)
      • ONENOTE.EXE (PID: 2804)

    • Reads the computer name

      • Nv2-PC.exe (PID: 3720)
      • Nv2-PC.exe (PID: 2364)
      • ONENOTE.EXE (PID: 2804)

    • Checks supported languages

      • Nv2-PC.exe (PID: 3720)
      • Nv2-PC.exe (PID: 2364)
      • ONENOTE.EXE (PID: 2804)
      • ONENOTEM.EXE (PID: 3556)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2160)

    • Manual execution by a user

      • Nv2-PC.exe (PID: 3720)
      • Nv2-PC.exe (PID: 2364)

    • Checks proxy server information

      • Nv2-PC.exe (PID: 3720)
      • Nv2-PC.exe (PID: 2364)

    • Reads Microsoft Office registry keys

      • ONENOTE.EXE (PID: 2804)
      • ONENOTEM.EXE (PID: 3556)

    • Reads Environment values

      • ONENOTE.EXE (PID: 2804)

    • Reads the software policy settings

      • ONENOTE.EXE (PID: 2804)

    • Create files in a temporary directory

      • ONENOTE.EXE (PID: 2804)
      • Nv2-PC.exe (PID: 2364)

    • Process checks computer location settings

      • ONENOTE.EXE (PID: 2804)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2013:06:27 12:30:04
ZipCRC: 0x862d9549
ZipCompressedSize: 4786383
ZipUncompressedSize: 10821938
ZipFileName: Nv2-PC.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
47
Monitored processes
6
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe nv2-pc.exe nv2-pc.exe printfilterpipelinesvc.exe no specs onenote.exe onenotem.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
980C:\Windows\system32\printfilterpipelinesvc.exe -EmbeddingC:\Windows\System32\printfilterpipelinesvc.exe—svchost.exe
User:
LOCAL SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Print Filter Pipeline Host
Exit code:
0
Version:
6.1.7601.24537 (win7sp1_ldr_escrow.191114-1547)
Modules
Images
c:\windows\system32\printfilterpipelinesvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2160"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Nv2-PC.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2364"C:\Users\admin\AppData\Local\Temp\Nv2-PC\Nv2-PC.exe" C:\Users\admin\AppData\Local\Temp\Nv2-PC\Nv2-PC.exe
explorer.exe
User:
admin
Company:
Adobe Systems, Inc.
Integrity Level:
MEDIUM
Description:
Adobe Flash Player 11.1 r102
Exit code:
0
Version:
11,1,102,55
Modules
Images
c:\users\admin\appdata\local\temp\nv2-pc\nv2-pc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
c:\windows\system32\ole32.dll
2804/insertdoc "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\{B4730B4F-5B06-42A0-BDB8-A40CE4C21A5B}.xps" 133545358780260000C:\Program Files\Microsoft Office\Office14\ONENOTE.EXE
printfilterpipelinesvc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft OneNote
Exit code:
0
Version:
14.0.6022.1000
Modules
Images
c:\program files\microsoft office\office14\onenote.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3556/tsrC:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE—ONENOTE.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft OneNote Quick Launcher
Exit code:
0
Version:
14.0.6015.1000
Modules
Images
c:\program files\microsoft office\office14\onenotem.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
3720"C:\Users\admin\AppData\Local\Temp\Nv2-PC\Nv2-PC.exe" C:\Users\admin\AppData\Local\Temp\Nv2-PC\Nv2-PC.exe
explorer.exe
User:
admin
Company:
Adobe Systems, Inc.
Integrity Level:
MEDIUM
Description:
Adobe Flash Player 11.1 r102
Exit code:
0
Version:
11,1,102,55
Modules
Images
c:\users\admin\appdata\local\temp\nv2-pc\nv2-pc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
c:\windows\system32\ole32.dll
Total events
12 779
Read events
12 635
Write events
125
Delete events
19

Modification events

(PID) Process:(2160) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2160) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2160) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2160) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(2160) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2160) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(2160) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Nv2-PC.zip
(PID) Process:(2160) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2160) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2160) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
1
Suspicious files
36
Text files
6
Unknown types
1

Dropped files

PID
Process
Filename
Type
980printfilterpipelinesvc.exeC:\Windows\system32\spool\PRINTERS\PPm8egt6x1thzwqnk272exb05_.TMP —
MD5:—
SHA256:—
980printfilterpipelinesvc.exeC:\Windows\system32\spool\PRINTERS\PPx3m1f34urpv46plr0y08uwqkb.TMP —
MD5:—
SHA256:—
980printfilterpipelinesvc.exeC:\Windows\system32\spool\PRINTERS\PPklrqwx3wumdoytcnu0y3m02rc.TMP —
MD5:—
SHA256:—
2804ONENOTE.EXEC:\Users\admin\AppData\Local\Temp\CVR1CD5.tmp.cvr —
MD5:—
SHA256:—
2804ONENOTE.EXEC:\Users\admin\AppData\Local\Microsoft\OneNote\14.0\OneNoteOfflineCache.onecache —
MD5:—
SHA256:—
2160WinRAR.exeC:\Users\admin\AppData\Local\Temp\Nv2-PC\license.txttext
MD5:D6DDA80AC0401852CA19B832EDD0E49F
SHA256:3D3202A554FCE9358A994ABBED3EDBEFF772C27F54E34885B5714850848EA807
3720Nv2-PC.exeC:\Users\admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#local\settings.solsol
MD5:662FE1E7665F2B4DFDD4F5DD79C6C264
SHA256:2CCB9D5C8B6AA6E9131DB74072416AFE895A86C789642ACFE56FC8DA8181DBA8
3720Nv2-PC.exeC:\Users\admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.solbinary
MD5:4E442C66F85325FE25C83EE8855432CA
SHA256:C1F7F9394B37899EC9EFE36DD2C26C80837F357D86F20F67DC13F6491F0CFEA9
3720Nv2-PC.exeC:\Users\admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#local\settings.sxxsol
MD5:662FE1E7665F2B4DFDD4F5DD79C6C264
SHA256:2CCB9D5C8B6AA6E9131DB74072416AFE895A86C789642ACFE56FC8DA8181DBA8
3720Nv2-PC.exeC:\Users\admin\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\VZTUFNTU\localhost\n_account.sxxsol
MD5:250B5146F696E4841010DD154CE10817
SHA256:17CBD99E4A64C359E6201B36A170F0469571AECD6A21FD98D57C0D6401534A7B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
6
DNS requests
3
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3720
Nv2-PC.exe
GET
200
163.172.57.40:80
http://nserver.thewayoftheninja.org/crossdomain.xml
unknown
text
524 b
unknown
3720
Nv2-PC.exe
GET
200
188.114.97.0:80
http://www.thewayoftheninja.org/crossdomain.xml
unknown
text
524 b
unknown
3720
Nv2-PC.exe
GET
200
16.182.39.216:80
http://bucket.thewayoftheninja.org/news.xml?RND=6881710062219979
unknown
xml
2.27 Kb
unknown
2364
Nv2-PC.exe
GET
200
16.182.39.216:80
http://bucket.thewayoftheninja.org/news.xml?RND=6101710062272700
unknown
xml
2.27 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3720
Nv2-PC.exe
163.172.57.40:80
nserver.thewayoftheninja.org
Online S.a.s.
FR
unknown
3720
Nv2-PC.exe
16.182.39.216:80
bucket.thewayoftheninja.org
—
US
unknown
3720
Nv2-PC.exe
188.114.97.0:80
www.thewayoftheninja.org
CLOUDFLARENET
NL
unknown
2364
Nv2-PC.exe
16.182.39.216:80
bucket.thewayoftheninja.org
—
US
unknown

DNS requests

Domain
IP
Reputation
nserver.thewayoftheninja.org
  • 163.172.57.40
unknown
www.thewayoftheninja.org
  • 188.114.97.0
unknown
bucket.thewayoftheninja.org
  • 16.182.39.216
unknown

Threats

PID
Process
Class
Message
3720
Nv2-PC.exe
Potential Corporate Privacy Violation
ET POLICY Outdated Flash Version M1
4 ETPRO signatures available at the full report
Process
Message
ONENOTE.EXE
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
ONENOTE.EXE
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
ONENOTE.EXE
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
ONENOTE.EXE
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
ONENOTE.EXE
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
ONENOTE.EXE
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Nv2-PC.zip