analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

evil.zip

Full analysis: https://app.any.run/tasks/3fdf755b-b3f7-470c-b132-71867c94a1a0
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: August 17, 2019, 10:05:11
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ransomware
tflower
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

C4B433E4A2540048D861C64E5DA9098A

SHA1:

B75A0F2B1EB57FBD07FCF89CF886A21E85BCD24E

SHA256:

AD2F281FDC35DDEB59995BCAA791C842B3CC9A30492E331752712617CC781349

SSDEEP:

49152:NB/Cr91HjHIo/tRlUWqVDRpDmLCaJLnnzVm8NFULnnzVm8NFU:vC51LtRGWGpTa9nTNF6nTNFU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • wabeeh.exe (PID: 2804)
      • wabhup.exe (PID: 1188)
      • wablwg.exe (PID: 3076)

    • Starts BCDEDIT.EXE to disable recovery

      • wabeeh.exe (PID: 2804)
      • wabhup.exe (PID: 1188)
      • wablwg.exe (PID: 3076)

    • Deletes shadow copies

      • wabeeh.exe (PID: 2804)
      • wabhup.exe (PID: 1188)
      • wablwg.exe (PID: 3076)

    • Application was dropped or rewritten from another process

      • wabeeh.exe (PID: 2804)
      • wabhup.exe (PID: 1188)
      • wablwg.exe (PID: 3076)

    • TFlower was detected

      • wabeeh.exe (PID: 2804)
      • wabhup.exe (PID: 1188)
      • wablwg.exe (PID: 3076)

    • Actions looks like stealing of personal data

      • wablwg.exe (PID: 3076)
      • wabhup.exe (PID: 1188)
      • wabeeh.exe (PID: 2804)

    • Changes settings of System certificates

      • wablwg.exe (PID: 3076)

    • Dropped file may contain instructions of ransomware

      • wabhup.exe (PID: 1188)
      • wablwg.exe (PID: 3076)
      • wabeeh.exe (PID: 2804)

    • Modifies files in Chrome extension folder

      • wabhup.exe (PID: 1188)

  • SUSPICIOUS

    • Writes to a desktop.ini file (may be used to cloak folders)

      • wabeeh.exe (PID: 2804)
      • wabhup.exe (PID: 1188)
      • wablwg.exe (PID: 3076)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2796)

    • Reads the cookies of Mozilla Firefox

      • wabhup.exe (PID: 1188)
      • wabeeh.exe (PID: 2804)
      • wablwg.exe (PID: 3076)

    • Adds / modifies Windows certificates

      • wablwg.exe (PID: 3076)

    • Creates files in the user directory

      • wabhup.exe (PID: 1188)
      • notepad++.exe (PID: 3508)

    • Executed via COM

      • DllHost.exe (PID: 2720)
      • DllHost.exe (PID: 3588)

    • Creates files in the program directory

      • wablwg.exe (PID: 3076)
      • wabeeh.exe (PID: 2804)

  • INFO

    • Dropped object may contain TOR URL's

      • wabhup.exe (PID: 1188)
      • wablwg.exe (PID: 3076)
      • wabeeh.exe (PID: 2804)

    • Dropped object may contain Bitcoin addresses

      • wabhup.exe (PID: 1188)
      • wablwg.exe (PID: 3076)
      • wabeeh.exe (PID: 2804)

    • Manual execution by user

      • WINWORD.EXE (PID: 2688)
      • WINWORD.EXE (PID: 3912)
      • notepad++.exe (PID: 3508)
      • NOTEPAD.EXE (PID: 2492)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2688)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2688)
      • WINWORD.EXE (PID: 3912)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0008
ZipCompression: Deflated
ZipModifyDate: 2019:08:06 13:32:12
ZipCRC: 0x55f82965
ZipCompressedSize: 1103364
ZipUncompressedSize: 1103024
ZipFileName: wabigg.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
80
Monitored processes
26
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start drop and start drop and start start winrar.exe #TFLOWER wabeeh.exe vssadmin.exe no specs bcdedit.exe no specs bcdedit.exe no specs bcdedit.exe no specs bcdedit.exe no specs #TFLOWER wabhup.exe vssadmin.exe no specs bcdedit.exe no specs bcdedit.exe no specs bcdedit.exe no specs bcdedit.exe no specs #TFLOWER wablwg.exe vssadmin.exe no specs bcdedit.exe no specs bcdedit.exe no specs bcdedit.exe no specs bcdedit.exe no specs winword.exe no specs winword.exe no specs PhotoViewer.dll no specs notepad++.exe gup.exe notepad.exe no specs PhotoViewer.dll no specs

Process information

PID
CMD
Path
Indicators
Parent process
2796"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\evil.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
2804"C:\Users\admin\AppData\Local\Temp\Rar$EXa2796.33895\wabeeh.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2796.33895\wabeeh.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3532vssadmin.exe delete shadows /all /quietC:\Windows\system32\vssadmin.exe—wabeeh.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Command Line Interface for Microsoft® Volume Shadow Copy Service
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3660bcdedit.exe /set {default} recoveryenabled noC:\Windows\system32\bcdedit.exe—wabeeh.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Boot Configuration Data Editor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3756bcdedit.exe /set {default} bootstatuspolicy ignoreallfailuresC:\Windows\system32\bcdedit.exe—wabeeh.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Boot Configuration Data Editor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3824bcdedit.exe /set {current} recoveryenabled noC:\Windows\system32\bcdedit.exe—wabeeh.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Boot Configuration Data Editor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3956bcdedit.exe /set {current} bootstatuspolicy ignoreallfailuresC:\Windows\system32\bcdedit.exe—wabeeh.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Boot Configuration Data Editor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1188"C:\Users\admin\AppData\Local\Temp\Rar$EXa2796.34407\wabhup.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2796.34407\wabhup.exe
WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) Contacts Import Tool
Exit code:
0
Version:
10.0.18362.1 (WinBuild.160101.0800)
3668vssadmin.exe delete shadows /all /quietC:\Windows\system32\vssadmin.exe—wabhup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Command Line Interface for Microsoft® Volume Shadow Copy Service
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3776bcdedit.exe /set {default} recoveryenabled noC:\Windows\system32\bcdedit.exe—wabhup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Boot Configuration Data Editor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Total events
2 651
Read events
2 463
Write events
0
Delete events
0

Modification events

No data
Executable files
9
Suspicious files
6 142
Text files
104
Unknown types
31

Dropped files

PID
Process
Filename
Type
2804wabeeh.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\desktop.inibinary
MD5:432D54D6C36FC845F2F6F38EC23AD29D
SHA256:FD098FA14D549FD411D170CDDBA7065123E3527C1259F13C1D4A9F1E238849F4
2796WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2796.33895\wabigg.exebinary
MD5:AD439DE58D51DBCBA60543E566B536CE
SHA256:35D976299CDFE0C0EC26266F2B4E33041E2816D03D4B9644421569DC8A50E409
2796WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2796.33895\wabeeh.exeexecutable
MD5:E059048A84BA10327EE28C9B007DC048
SHA256:A6422490E252E650B0B0D4DE662DA39197233702DA784F4FFB79E4FC74F41CD4
2804wabeeh.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Mozilla Firefox\application.inibinary
MD5:452064650DC637ED04D391EA7DE05ADD
SHA256:01C6A6AB5F0EA540F3B9BB7076E4D6AE8458E229F4FEB28D8A86731AC3AAEFDE
2804wabeeh.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\FileZilla FTP Client\GPL.htmlbinary
MD5:8F27BF0AC5351045B3F3443EE9813CB0
SHA256:CAA2D45939F3888ECE82FDF293D6829B56BF174CD1CAAAB5B2C4FF0B7BE50D93
2804wabeeh.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Mozilla Firefox\updater.inibinary
MD5:48EAD17D9C39D51CCB99A7EA5B1DA3B9
SHA256:22141B5EA114E7D5AFD5BA108E7700EDE078517C58057F5FE392ADFD7C71356B
2796WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2796.33895\wabhup.exeexecutable
MD5:E78BF898854113285FE9EF1AB739562F
SHA256:FF879EF72DB2A3837304E0517F725B0F87FDAD6E6DC45E0175C585CAB33FDCED
2804wabeeh.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Notepad++\langs.model.xmlbinary
MD5:7A564D5426FE74E51DDD91D411083F0D
SHA256:9A7AF290DDC4AC574D0E900B15076416AA5E7E3F6DC5794BCE573035F7BE10D4
2804wabeeh.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Mozilla Firefox\crashreporter.inibinary
MD5:1CBB4B5E9CC4A98F9976545420FA19C1
SHA256:ABBA0ABD3FA6DBD9118CE33006087AF6B94262FC98B86884C817926BD074AC33
2804wabeeh.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Notepad++\functionList.xmlbinary
MD5:7A07D2A979F0AC4EDDA7C6D92D4F5397
SHA256:F2B1BC1771D6CD3D4105A398B95544328D5BB464E4C7DEAC06132F7ED7B421F6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
6
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.20.190.11:80
http://isrg.trustid.ocsp.identrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D
unknown
der
1.37 Kb
whitelisted
2804
wabeeh.exe
GET
200
2.16.106.186:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
unknown
compressed
56.6 Kb
whitelisted
2804
wabeeh.exe
GET
200
2.16.106.186:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/F373B387065A28848AF2F34ACE192BDDC78E9CAC.crt
unknown
der
1.44 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2804
wabeeh.exe
89.46.105.91:443
www.affittofacilesicuro.com
Aruba S.p.A.
IT
unknown
2752
gup.exe
37.59.28.236:443
notepad-plus-plus.org
OVH SAS
FR
whitelisted
1188
wabhup.exe
89.46.105.91:443
www.affittofacilesicuro.com
Aruba S.p.A.
IT
unknown
3076
wablwg.exe
89.46.105.91:443
www.affittofacilesicuro.com
Aruba S.p.A.
IT
unknown
2804
wabeeh.exe
2.16.106.186:80
www.download.windowsupdate.com
Akamai International B.V.
—
whitelisted
—
—
2.20.190.11:80
isrg.trustid.ocsp.identrust.com
Akamai International B.V.
—
whitelisted

DNS requests

Domain
IP
Reputation
www.affittofacilesicuro.com
  • 89.46.105.91
whitelisted
www.download.windowsupdate.com
  • 2.16.106.186
  • 2.16.106.233
whitelisted
notepad-plus-plus.org
  • 37.59.28.236
whitelisted
isrg.trustid.ocsp.identrust.com
  • 2.20.190.11
  • 2.20.189.204
whitelisted

Threats

No threats detected
Process
Message
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
42C4C5846BB675C74E2B2C90C69AB44366401093
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
evil.zip