File name:

Password is 1234321.zip

Full analysis: https://app.any.run/tasks/174da95b-bc12-416c-bf01-38cf6a913e84
Verdict: Malicious activity
Analysis date: June 06, 2024, 12:55:42
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v5.1 to extract, compression method=AES Encrypted
MD5:

806B2482E03DD0288FB14561AC18B75B

SHA1:

E052AED4C9E87E4A8320ED0D1DD63EA51FD36828

SHA256:

B3BA4101E67DF45C5465A3E736A007CFF2A0E07B4D064E157C3CD16622347FC3

SSDEEP:

98304:RTMeXGDjogLmi6KOR81zlm4T2hNaRh2yIiLgN3eCdEWRZYtIfY/kml7xOg+eY1iP:L10jMAL5918FV2AidjXwGT3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Сведения о пом‮‮exe.exe (PID: 1764)
      • a.exe (PID: 1380)
      • a.exe (PID: 2712)
      • a.exe (PID: 2940)
      • a.exe (PID: 3276)
      • Сведения о пом‮‮fdp.exe (PID: 4004)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 3964)
      • Сведения о пом‮‮exe.exe (PID: 1764)
      • a.exe (PID: 1380)
      • a.exe (PID: 2712)
      • a.exe (PID: 2940)
      • a.exe (PID: 3276)
      • Сведения о пом‮‮fdp.exe (PID: 4004)

    • Uses ATTRIB.EXE to modify file attributes

      • Сведения о пом‮‮fdp.exe (PID: 4004)
      • Сведения о пом‮‮exe.exe (PID: 1764)
      • a.exe (PID: 1380)
      • a.exe (PID: 2712)
      • a.exe (PID: 2940)
      • a.exe (PID: 3276)

    • Executable content was dropped or overwritten

      • Сведения о пом‮‮exe.exe (PID: 1764)
      • a.exe (PID: 1380)
      • a.exe (PID: 2712)
      • a.exe (PID: 2940)
      • a.exe (PID: 3276)
      • Сведения о пом‮‮fdp.exe (PID: 4004)

    • Reads the Internet Settings

      • Сведения о пом‮‮exe.exe (PID: 1764)
      • a.exe (PID: 1380)
      • a.exe (PID: 2712)
      • a.exe (PID: 2940)
      • a.exe (PID: 3276)
      • Сведения о пом‮‮fdp.exe (PID: 4004)

    • Creates/Modifies COM task schedule object

      • WINWORD.EXE (PID: 2868)

    • Changes default file association

      • WINWORD.EXE (PID: 2868)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3964)

    • Checks supported languages

      • Сведения о пом‮‮exe.exe (PID: 1764)
      • Сведения о пом‮‮fdp.exe (PID: 4004)
      • a.exe (PID: 1380)
      • a.exe (PID: 2712)
      • a.exe (PID: 2940)
      • a.exe (PID: 3276)

    • Manual execution by a user

      • Сведения о пом‮‮exe.exe (PID: 1764)
      • cmd.exe (PID: 2328)
      • a.exe (PID: 1380)
      • rundll32.exe (PID: 580)
      • cmd.exe (PID: 2660)
      • a.exe (PID: 2940)
      • a.exe (PID: 3276)

    • Reads the computer name

      • Сведения о пом‮‮exe.exe (PID: 1764)
      • a.exe (PID: 1380)
      • a.exe (PID: 2712)
      • a.exe (PID: 2940)
      • a.exe (PID: 3276)
      • Сведения о пом‮‮fdp.exe (PID: 4004)

    • Create files in a temporary directory

      • Сведения о пом‮‮exe.exe (PID: 1764)
      • Сведения о пом‮‮fdp.exe (PID: 4004)
      • a.exe (PID: 1380)
      • a.exe (PID: 2712)
      • a.exe (PID: 2940)
      • a.exe (PID: 3276)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3964)

    • Reads Microsoft Office registry keys

      • Сведения о пом‮‮exe.exe (PID: 1764)
      • a.exe (PID: 1380)
      • a.exe (PID: 2712)
      • a.exe (PID: 2940)
      • a.exe (PID: 3276)
      • Сведения о пом‮‮fdp.exe (PID: 4004)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 51
ZipBitFlag: 0x0801
ZipCompression: Unknown (99)
ZipModifyDate: 2021:10:03 15:34:54
ZipCRC: 0x00000000
ZipCompressedSize: 9796351
ZipUncompressedSize: 9985967
ZipFileName: Сведения о пом‮‮fdp.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
72
Monitored processes
22
Malicious processes
2
Suspicious processes
5

Behavior graph

Click at the process to see the details
start winrar.exe сведения о пом‮‮fdp.exe winword.exe no specs attrib.exe no specs сведения о пом‮‮exe.exe winword.exe no specs attrib.exe no specs rundll32.exe no specs cmd.exe no specs a.exe winword.exe no specs attrib.exe no specs cmd.exe no specs a.exe winword.exe no specs attrib.exe no specs a.exe winword.exe no specs attrib.exe no specs a.exe winword.exe no specs attrib.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
316"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\RarSFX0\Meow_meow.docx"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—Сведения о пом‮‮exe.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
580"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\Desktop\a‮‮exeC:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
972"C:\Windows\System32\attrib.exe" +h +s mm.exeC:\Windows\System32\attrib.exe—a.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Attribute Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\attrib.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ulib.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1116"C:\Windows\System32\attrib.exe" +h +s mm.exeC:\Windows\System32\attrib.exe—Сведения о пом‮‮fdp.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Attribute Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\attrib.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ulib.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1380"C:\Users\admin\Desktop\a.exe" C:\Users\admin\Desktop\a.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\a.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24542_none_5c0717c7a00ddc6d\gdiplus.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1660"C:\Windows\System32\attrib.exe" +h +s mm.exeC:\Windows\System32\attrib.exe—Сведения о пом‮‮exe.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Attribute Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\attrib.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ulib.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1764"C:\Users\admin\Desktop\Сведения о пом‮‮exe.exe" C:\Users\admin\Desktop\Сведения о пом‮‮exe.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\сведения о пом‮‮exe.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24542_none_5c0717c7a00ddc6d\gdiplus.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2324"C:\Windows\System32\attrib.exe" +h +s mm.exeC:\Windows\System32\attrib.exe—a.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Attribute Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\attrib.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ulib.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2328"C:\Windows\system32\cmd.exe" C:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
3221225786
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2408"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\RarSFX0\Meow_meow.docx"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—a.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
Total events
62 367
Read events
59 846
Write events
1 045
Delete events
1 476

Modification events

(PID) Process:(3964) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3964) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3964) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3964) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3964) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3964) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(3964) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Password is 1234321.zip
(PID) Process:(3964) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3964) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3964) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
8
Suspicious files
39
Text files
1
Unknown types
3

Dropped files

PID
Process
Filename
Type
4036WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR65E0.tmp.cvr —
MD5:—
SHA256:—
316WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR1951.tmp.cvr —
MD5:—
SHA256:—
4004Сведения о пом‮‮fdp.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\Meow_meow.docxdocument
MD5:2973F78C3CD75A24C8736B78C77E2674
SHA256:3F41AA9FACF70BD0BB1D1AF8AF383420660EBDDB425025F8D29FDEFB572749F3
4004Сведения о пом‮‮fdp.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\mm.exeexecutable
MD5:4C2774D2C1CE1416B5FC598297EA4A31
SHA256:1DD4A6D221601754CF3E1EEA251E9F134CDAAC4C47FEFA42D5F16E5534103509
2408WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR533.tmp.cvr —
MD5:—
SHA256:—
3964WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3964.36800\Сведения о пом‮‮fdp.exeexecutable
MD5:91DD0FECFD1349A5C433F52CCC428C65
SHA256:1836DB6FC52BC016C35734454F0FD00BF1691568A2769B98F4D3F267772E88A3
4036WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{D87D88D6-829D-4348-AA20-C80A17EF17FC}.tmpbinary
MD5:0F4C51A4EFD78D6758C89681C48582FA
SHA256:B7A6713E12B1D6B08A5DC0600C529D07DA2D48DF57914496C42383D1BB7AB9B2
1764Сведения о пом‮‮exe.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\mm.exeexecutable
MD5:4C2774D2C1CE1416B5FC598297EA4A31
SHA256:1DD4A6D221601754CF3E1EEA251E9F134CDAAC4C47FEFA42D5F16E5534103509
4036WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{36460A40-3B51-486A-B59A-7A7D5CA9C8A1}.tmpbinary
MD5:1D98E60E38680D53EF5A0DF1CA766431
SHA256:29FC6E1CCC93165149081172C0FC64027E9D25FCF3A5EF46FDFE497D8523D66A
3964WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3964.38239\Сведения о пом‮‮fdp.exeexecutable
MD5:91DD0FECFD1349A5C433F52CCC428C65
SHA256:1836DB6FC52BC016C35734454F0FD00BF1691568A2769B98F4D3F267772E88A3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
1088
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Password is 1234321.zip