analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

f2143eeb82564f8ff6cacffbea6a0ada.zip

Full analysis: https://app.any.run/tasks/b378f9c0-1f17-4810-9111-c402d9bf67d2
Verdict: Malicious activity
Analysis date: May 21, 2022, 06:50:23
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

B25DAC140DAFD052C24A98F95CCDEA35

SHA1:

5DADD05703FFBCA1862EFFAEDBEC73F2C2BCC105

SHA256:

ACBCD4A0C6349F8F9956E6E1010E18F5E980E4AFA5114479C0742085284F4D52

SSDEEP:

6144:BeUXMk2vcPxXyPhVBVuuDpxtaMwoRm/RtZdhfSQpqyy2HivY1eHG+nVwod6q:B3M7cPMPbBVuudxtarGm5aQpM2CEswoR

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads the computer name

      • WinRAR.exe (PID: 2952)

    • Checks supported languages

      • WinRAR.exe (PID: 2952)

    • Uses RUNDLL32.EXE to load library

      • WinRAR.exe (PID: 2952)

    • Executes application which crashes

      • WinRAR.exe (PID: 2952)

    • Reads the date of Windows installation

      • rundll32.exe (PID: 1372)
      • rundll32.exe (PID: 2320)

    • Starts Microsoft Office Application

      • rundll32.exe (PID: 1372)
      • rundll32.exe (PID: 2320)

    • Reads default file associations for system extensions

      • rundll32.exe (PID: 2320)

  • INFO

    • Reads the computer name

      • rundll32.exe (PID: 2692)
      • explorer.exe (PID: 4080)
      • rundll32.exe (PID: 1372)
      • WINWORD.EXE (PID: 2748)
      • rundll32.exe (PID: 2320)
      • EXCEL.EXE (PID: 2504)

    • Checks supported languages

      • rundll32.exe (PID: 2692)
      • ntvdm.exe (PID: 2504)
      • explorer.exe (PID: 4080)
      • ntvdm.exe (PID: 2552)
      • rundll32.exe (PID: 1372)
      • WINWORD.EXE (PID: 2748)
      • rundll32.exe (PID: 2320)
      • EXCEL.EXE (PID: 2504)
      • ntvdm.exe (PID: 3456)

    • Manual execution by user

      • explorer.exe (PID: 4080)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2748)

    • Changes default file association

      • rundll32.exe (PID: 2320)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2748)
      • EXCEL.EXE (PID: 2504)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: f2143eeb82564f8ff6cacffbea6a0ada
ZipUncompressedSize: 304672
ZipCompressedSize: 304734
ZipCRC: 0xca7d6413
ZipModifyDate: 2022:05:21 08:44:16
ZipCompression: Deflated
ZipBitFlag: 0x0009
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
50
Monitored processes
10
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs rundll32.exe no specs ntvdm.exe no specs ntvdm.exe no specs explorer.exe no specs rundll32.exe no specs winword.exe no specs rundll32.exe no specs excel.exe no specs ntvdm.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2952"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\f2143eeb82564f8ff6cacffbea6a0ada.zip"C:\Program Files\WinRAR\WinRAR.exe—Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
2692"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\Rar$DIb2952.49639\f2143eeb82564f8ff6cacffbea6a0adaC:\Windows\system32\rundll32.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2552"C:\Windows\system32\ntvdm.exe" -i1 C:\Windows\system32\ntvdm.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
NTVDM.EXE
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2504"C:\Windows\system32\ntvdm.exe" -i2 C:\Windows\system32\ntvdm.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
NTVDM.EXE
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
4080"C:\Windows\explorer.exe" C:\Windows\explorer.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1372"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\Rar$DIb2952.8922\f2143eeb82564f8ff6cacffbea6a0adaC:\Windows\system32\rundll32.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2748"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Rar$DIb2952.8922\f2143eeb82564f8ff6cacffbea6a0ada"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
2320"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\Rar$DIb2952.10856\f2143eeb82564f8ff6cacffbea6a0adaC:\Windows\system32\rundll32.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2504"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" "C:\Users\admin\AppData\Local\Temp\Rar$DIb2952.10856\f2143eeb82564f8ff6cacffbea6a0ada"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE—rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Exit code:
0
Version:
14.0.6024.1000
3456"C:\Windows\system32\ntvdm.exe" -i3 C:\Windows\system32\ntvdm.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
NTVDM.EXE
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
13 718
Read events
13 110
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
16
Text files
6
Unknown types
3

Dropped files

PID
Process
Filename
Type
2748WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR8F1E.tmp.cvr —
MD5:—
SHA256:—
2952WinRAR.exeC:\Users\admin\AppData\Local\Temp\f2143eeb82564f8ff6cacffbea6a0ada.zipcompressed
MD5:A2B6E5CAB0AF092A0D7A7F8E3A4AD656
SHA256:2295B345E49B569B1A1DE64262A67CE566AA9628F90E0A0E6D78962FB6780607
2504EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVR9FB.tmp.cvr —
MD5:—
SHA256:—
2952WinRAR.exeC:\Users\admin\AppData\Local\Temp\__rzi_2952.1931compressed
MD5:A2B6E5CAB0AF092A0D7A7F8E3A4AD656
SHA256:2295B345E49B569B1A1DE64262A67CE566AA9628F90E0A0E6D78962FB6780607
2748WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRD0002.docbinary
MD5:F10BD68AFA1F82FEBB2410778B6FD918
SHA256:25908B7D70F2080A4C9420C29377E047F2DB0AC7263C6E7AE325AC400856F6E0
2952WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIb2952.49639\f2143eeb82564f8ff6cacffbea6a0adacompressed
MD5:8C7D227CB0E24885581ED6310ED16DF6
SHA256:6990DB5DE10C830A8992184C7F2040EF8536CFE7E7D35E405925757564B30855
2952WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIb2952.10856\f2143eeb82564f8ff6cacffbea6a0adacompressed
MD5:8C7D227CB0E24885581ED6310ED16DF6
SHA256:6990DB5DE10C830A8992184C7F2040EF8536CFE7E7D35E405925757564B30855
2552ntvdm.exeC:\Users\admin\AppData\Local\Temp\scs73DA.tmptext
MD5:8CF6DDB5AA59B49F34B967CD46F013B6
SHA256:EE06792197C3E025B84860A72460EAF628C66637685F8C52C5A08A9CC35D376C
2952WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2952.2128\f2143eeb82564f8ff6cacffbea6a0ada.execompressed
MD5:8C7D227CB0E24885581ED6310ED16DF6
SHA256:6990DB5DE10C830A8992184C7F2040EF8536CFE7E7D35E405925757564B30855
2748WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:19F7254F60211B58CC4C891BAFF3FC7B
SHA256:5E360E0C8CCAA009AF73956685DF211787179644C401E1465836FB41E5096A6C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
f2143eeb82564f8ff6cacffbea6a0ada.zip