analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

l.jpg.zip

Full analysis: https://app.any.run/tasks/e0197949-03ee-42cc-bfa9-ef84b2b5c88a
Verdict: Malicious activity
Analysis date: July 11, 2019, 13:13:04
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

BD6988301DFD3EABD1C5B60CA434F356

SHA1:

43F8200F87E78BB1CA91DF09536412D418DC8BB9

SHA256:

B9F5F056D9DE39065E82D15B0011543B6A8BF31767F4023E937C7EC8853D84AC

SSDEEP:

24576:ulhhwwS0Oza9wFUbIyPsqAu1ybmjEpH9uUZmci:ulLwwS0OzaOyI2sNu1HElNZU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • l.exe (PID: 2128)
      • IMDCSC.exe (PID: 3720)
      • l.exe (PID: 3624)
      • IMDCSC.exe (PID: 2876)

    • Changes the autorun value in the registry

      • l.exe (PID: 3624)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 988)
      • l.exe (PID: 3624)

    • Application launched itself

      • l.exe (PID: 2128)
      • IMDCSC.exe (PID: 3720)

    • Starts CMD.EXE for commands execution

      • l.exe (PID: 2128)
      • IMDCSC.exe (PID: 3720)

    • Starts itself from another location

      • l.exe (PID: 3624)

  • INFO

    • Manual execution by user

      • l.exe (PID: 2128)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: l.jpg
ZipUncompressedSize: 1143808
ZipCompressedSize: 906940
ZipCRC: 0x18c3bd25
ZipModifyDate: 2019:07:09 15:15:00
ZipCompression: Deflated
ZipBitFlag: 0x0001
ZipRequiredVersion: 788
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
50
Monitored processes
9
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start winrar.exe l.exe no specs cmd.exe no specs cmd.exe no specs l.exe imdcsc.exe no specs cmd.exe no specs cmd.exe no specs imdcsc.exe

Process information

PID
CMD
Path
Indicators
Parent process
988"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\l.jpg.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
2128"C:\Users\admin\Desktop\l.exe" C:\Users\admin\Desktop\l.exe—explorer.exe
User:
admin
Company:
ubulonaluyubuwizobiduc
Integrity Level:
MEDIUM
Description:
agogimak
Exit code:
0
Version:
8.12.16.20
964"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\admin\Desktop\l.exe:Zone.Identifier"C:\Windows\System32\cmd.exe—l.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2152"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\admin\Desktop\l.exe:Zone.Identifier"C:\Windows\System32\cmd.exe—l.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3624"C:\Users\admin\Desktop\l.exe"C:\Users\admin\Desktop\l.exe
l.exe
User:
admin
Company:
ubulonaluyubuwizobiduc
Integrity Level:
MEDIUM
Description:
agogimak
Exit code:
0
Version:
8.12.16.20
3720"C:\Users\admin\Documents\DCSCMIN\IMDCSC.exe" C:\Users\admin\Documents\DCSCMIN\IMDCSC.exe—l.exe
User:
admin
Company:
ubulonaluyubuwizobiduc
Integrity Level:
MEDIUM
Description:
agogimak
Exit code:
0
Version:
8.12.16.20
3180"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\admin\Documents\DCSCMIN\IMDCSC.exe:Zone.Identifier"C:\Windows\System32\cmd.exe—IMDCSC.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1872"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\admin\Documents\DCSCMIN\IMDCSC.exe:Zone.Identifier"C:\Windows\System32\cmd.exe—IMDCSC.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2876"C:\Users\admin\Documents\DCSCMIN\IMDCSC.exe"C:\Users\admin\Documents\DCSCMIN\IMDCSC.exe
IMDCSC.exe
User:
admin
Company:
ubulonaluyubuwizobiduc
Integrity Level:
MEDIUM
Description:
agogimak
Version:
8.12.16.20
Total events
988
Read events
956
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
988WinRAR.exeC:\Users\admin\Desktop\l.jpgexecutable
MD5:7FDF34CBAAB4A2536274BCF0ABC3C81C
SHA256:13747DA2DC6D5E123A657F63178AA44BB811C3F03BF49607BB46BD8F412A102F
3624l.exeC:\Users\admin\Documents\DCSCMIN\IMDCSC.exeexecutable
MD5:7FDF34CBAAB4A2536274BCF0ABC3C81C
SHA256:13747DA2DC6D5E123A657F63178AA44BB811C3F03BF49607BB46BD8F412A102F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
128.90.107.42:3450
medicosta.linkpc.net
Powerhouse Management, Inc.
CR
unknown
2876
IMDCSC.exe
128.90.107.42:3450
medicosta.linkpc.net
Powerhouse Management, Inc.
CR
unknown

DNS requests

Domain
IP
Reputation
medicosta.linkpc.net
  • 128.90.107.42
malicious

Threats

Found threats are available for the paid subscriptions
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
l.jpg.zip