analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

jailbreak-master.zip

Full analysis: https://app.any.run/tasks/30fc9e80-e334-4dac-89a0-2c3f5657e076
Verdict: Malicious activity
Analysis date: September 19, 2019, 10:27:00
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

B28DB8208018F46166CD34E2B603E5B1

SHA1:

B3F3CE5BF914E944314282D8D2BB2A8F6BA249F6

SHA256:

AD4B7DB6BE59E3F5A4D17087F0A48B567CF9AF49C0309E486A084C6C0A630DFC

SSDEEP:

12288:5fofS7wYViDXiY0g5X/dHFCjtJORW6iZfoQS7wYViDm:5AKkYhY0wdHMJORW6OAbkYX

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • mmc.exe (PID: 2564)
      • jailbreak32.exe (PID: 936)
      • SearchProtocolHost.exe (PID: 2544)

    • Application was dropped or rewritten from another process

      • jailbreak32.exe (PID: 936)

  • SUSPICIOUS

    • Creates files in the user directory

      • rundll32.exe (PID: 3292)
      • notepad++.exe (PID: 2696)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3524)

    • Reads Internet Cache Settings

      • mmc.exe (PID: 2564)

  • INFO

    • Manual execution by user

      • mmc.exe (PID: 2956)
      • cmd.exe (PID: 3484)
      • rundll32.exe (PID: 3292)
      • notepad++.exe (PID: 2696)
      • mmc.exe (PID: 3936)

    • Reads settings of System Certificates

      • mmc.exe (PID: 2564)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: jailbreak-master/
ZipUncompressedSize: -
ZipCompressedSize: -
ZipCRC: 0x00000000
ZipModifyDate: 2015:12:28 09:11:23
ZipCompression: None
ZipBitFlag: -
ZipRequiredVersion: 10
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
56
Monitored processes
10
Malicious processes
1
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe mmc.exe no specs mmc.exe searchprotocolhost.exe no specs cmd.exe jailbreak32.exe no specs mmc.exe no specs rundll32.exe no specs notepad++.exe gup.exe

Process information

PID
CMD
Path
Indicators
Parent process
3524"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\jailbreak-master.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
2956"C:\Windows\system32\mmc.exe" C:\Windows\system32\mmc.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Management Console
Exit code:
3221226540
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3936"C:\Windows\system32\mmc.exe" C:\Windows\system32\mmc.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Management Console
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2544"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\system32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
3484"C:\Windows\System32\cmd.exe" /C "C:\Users\admin\Desktop\jailbreak-master\jbcert32.bat" C:\Windows\System32\cmd.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
936jailbreak32.exe C:\Windows\system32\mmc.exe C:\Windows\system32\certmgr.msc -32C:\Users\admin\Desktop\jailbreak-master\binaries\jailbreak32.exe—cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
2564C:\Windows\system32\mmc.exe C:\Windows\system32\certmgr.msc -32C:\Windows\system32\mmc.exe—jailbreak32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Management Console
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3292"C:\Windows\system32\rundll32.exe" cryptext.dll,CryptExtAddPFX C:\Users\admin\Desktop\aaa.pfxC:\Windows\system32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2696"C:\Program Files\Notepad++\notepad++.exe" "C:\Users\admin\Desktop\aaa.pfx"C:\Program Files\Notepad++\notepad++.exe
explorer.exe
User:
admin
Company:
Don HO [email protected]
Integrity Level:
MEDIUM
Description:
Notepad++ : a free (GNU) source code editor
Exit code:
0
Version:
7.51
3768"C:\Program Files\Notepad++\updater\gup.exe" -v7.51C:\Program Files\Notepad++\updater\gup.exe
notepad++.exe
User:
admin
Company:
Don HO [email protected]
Integrity Level:
MEDIUM
Description:
GUP : a free (LGPL) Generic Updater
Exit code:
4294967295
Version:
4.1
Total events
1 706
Read events
1 423
Write events
0
Delete events
0

Modification events

No data
Executable files
10
Suspicious files
9
Text files
48
Unknown types
3

Dropped files

PID
Process
Filename
Type
3936mmc.exeC:\Users\admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\E02357FC7708441D4B0BE5F371F4B28961870F70binary
MD5:0110D68A1FE6E1C3A0637D55B11C35C9
SHA256:8840611C3FCBEE367C2FF132AE5E174BE336051EA84A8F5891BA98C0ACA1A2B0
3524WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3524.40028\jailbreak-master\binaries\jailbreak32.exeexecutable
MD5:8FBE0B5E85EE953A824CC952AE50D3B7
SHA256:7E50BC71C20EFDAE915BA1647D7B8C4FDB2A189908D9861F795DEE699FFE1DE3
3524WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3524.40028\jailbreak-master\binaries\EasyHook32.dllexecutable
MD5:F63E21C5C2D00209F6B81B39409833AA
SHA256:9344363DF85BC76135431E64F3BE606355A8C33D6EA9918573B53500537A1F2B
3524WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3524.40028\jailbreak-master\binaries\jailbreakhook32.dllexecutable
MD5:236171178DE3C0D985AB7038E5B1E64D
SHA256:796C4E92F5B78E5FAF2C2DD22BEA768638DE14B10D3C37B666A62B162901A6B7
3524WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3524.40028\jailbreak-master\binaries\jailbreak64.exe.sha256text
MD5:263321A3A4A7E64D9AB99FC5FF2F2FBB
SHA256:ED014305ACA9D332D9256F23AB8A9161E6D7CBB42CEC9BA9344435752486D44A
3524WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3524.40028\jailbreak-master\binaries\jailbreakhook64.dllexecutable
MD5:E22157334BF3230BB4DAD9300CC98ADE
SHA256:37DACC7C6BAB48616AC05AE3A932A6652E982245B74D5F751FAC2B39B474E9D1
3524WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3524.40028\jailbreak-master\binaries\jbstore2_32.exeexecutable
MD5:1628962629B241EAAFA6DD56A893F66F
SHA256:A0A774A2FCB2EAB730809D09FCFCA9EAE3CE5D7CF2DEB3CF5CBCCDC58036FF24
3524WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3524.40028\jailbreak-master\binaries\jailbreakhook32.dll.sha256text
MD5:BE5C02D593DE710A06E950BD1ACBD59B
SHA256:B597E0EA941E8C9C3DF51B8F51420C841785706CEA2D8D16C930600F51A7B583
3524WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3524.40028\jailbreak-master\LICENSEtext
MD5:D8406488EA21766D65902668C1F625F3
SHA256:9D8CB63A8C8A1060D0162757DAE6BED58D0C66708D67E2300A834093A23F5D0A
3524WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3524.40028\jailbreak-master\binaries\EasyHook64.dll.sha256text
MD5:D3ADA1F2F27C81B86E50500B7DBA234A
SHA256:B5B1B541D75C7BE261A7B0B78218F0CBA1636B5B9EF74C66F23C9EB3E27AAC71
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
2
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2Fz5hY5qj0aEmX0H4s05bY%3D
US
der
1.47 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3768
gup.exe
104.31.88.28:443
notepad-plus-plus.org
Cloudflare Inc
US
shared

DNS requests

Domain
IP
Reputation
notepad-plus-plus.org
  • 104.31.88.28
  • 104.31.89.28
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted

Threats

No threats detected
Process
Message
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
42C4C5846BB675C74E2B2C90C69AB44366401093
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
jailbreak-master.zip