File name:

Alina.zip

Full analysis: https://app.any.run/tasks/66b8d5c5-0368-40aa-9118-0284855545b6
Verdict: Malicious activity
Analysis date: January 29, 2024, 04:40:47
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

9A70586AF61CAEF844A0A9969B2D5C36

SHA1:

215868350BDD2C4AF3B1A71209E518500D9A7BB6

SHA256:

BC9C0D26872140B2ECB156AB065E02A85CF483E407BE9AEEB66F701A7F9B3EB3

SSDEEP:

98304:6+ScpO9zf0N18zVYJEIblXyrwLdArAgmpOXeodEpgjkbqWpWLajyPbF1606ICdx7:LR2fbqZvLwhdtIy81DIQ6IVQxejvb9

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 1936)
      • Spark.exe (PID: 452)

    • Runs injected code in another process

      • windefender.exe (PID: 2712)

    • Application was injected by another process

      • explorer.exe (PID: 1164)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • WinRAR.exe (PID: 1936)

    • Executing commands from ".cmd" file

      • WinRAR.exe (PID: 1936)

    • Executable content was dropped or overwritten

      • Spark.exe (PID: 452)

    • Starts itself from another location

      • Spark.exe (PID: 452)

    • Reads the Internet Settings

      • Spark.exe (PID: 452)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1936)

    • Creates files or folders in the user directory

      • Spark.exe (PID: 452)

    • Reads the computer name

      • windefender.exe (PID: 2712)
      • Spark.exe (PID: 452)

    • Checks supported languages

      • windefender.exe (PID: 2712)
      • Spark.exe (PID: 452)

    • Checks proxy server information

      • Spark.exe (PID: 452)

    • Reads the machine GUID from the registry

      • Spark.exe (PID: 452)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2015:01:20 19:14:30
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: Alina POS/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
5
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start inject winrar.exe cmd.exe no specs spark.exe windefender.exe no specs explorer.exe

Process information

PID
CMD
Path
Indicators
Parent process
452"C:\Users\admin\AppData\Local\Temp\Alina\Alina POS\Source\Debug\Spark.exe" C:\Users\admin\AppData\Local\Temp\Alina\Alina POS\Source\Debug\Spark.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\alina\alina pos\source\debug\spark.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
1164C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1936"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Alina.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2560C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\Alina\Alina POS\Rootkit\Compile.EXE.GCC.cmd" "C:\Windows\System32\cmd.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2712"C:\Users\admin\AppData\Roaming\Installed\windefender.exe"C:\Users\admin\AppData\Roaming\Installed\windefender.exe—Spark.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\installed\windefender.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
Total events
1 803
Read events
1 752
Write events
51
Delete events
0

Modification events

(PID) Process:(1164) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
01000000D08C9DDF0115D1118C7A00C04FC297EB01000000DBDD10622BD67741A42163F361389C4700000000020000000000106600000001000020000000714C0B985B0540658F4A2080B484A48FEA0193B4945278E76DEADC9EF300F178000000000E80000000020000200000002B477AD6A48910EDA2BF44A8E4FAAFB7E2EDF3EE6F87B8965B303D8016BD90EA30000000CB02147CAA96DADF9F5A3BD08AC8A954F632048A3EC443FAA534C64E43A96953CAB4A202A2BC0443ADBC5B693897DBB44000000078BCD17E1DCD91E99A86D38616C049FA8C5E2A7C07BB269B76B0709DC8A01ABF25866BF6638D5C4422D1151CE173748901F5A2433E1BD07914E254B07BB130FD
(PID) Process:(1936) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1164) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.zip\OpenWithList
Operation:writeName:MRUList
Value:
a
(PID) Process:(1936) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(1936) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(1936) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(1936) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(1936) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1936) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1936) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
2
Suspicious files
17
Text files
53
Unknown types
1

Dropped files

PID
Process
Filename
Type
1936WinRAR.exeC:\Users\admin\AppData\Local\Temp\Alina\Alina POS\Source\Debug\Spark.exeexecutable
MD5:D431F54201251619C07E4D5BF39E01CD
SHA256:1FABBD3D6FB5BF868EF07BE4774649C4DD3F90959EF1E4477EDD08F96DE47F03
1936WinRAR.exeC:\Users\admin\AppData\Local\Temp\Alina\Alina POS\Panel\duck_bun.zipcompressed
MD5:93E4987B574B90617CE3F46C881E722C
SHA256:4C9946D4DD1E96F6AE84E5E1FC9593CE08EA1A0764E30F8EDE2C6AC0D76ED140
1936WinRAR.exeC:\Users\admin\AppData\Local\Temp\Alina\Alina POS\Rootkit\FileToByteArray.ctext
MD5:1E585530164500CAC389387C9E2D9D9A
SHA256:DB4369AB556312D1BB0D5744A1F835605C1F3C1E8B5E9D00D64A007F30BB8B54
1936WinRAR.exeC:\Users\admin\AppData\Local\Temp\Alina\Alina POS\Rootkit\InjectedDLL.ctext
MD5:D87605CC83E8F10B99E9A1571118B938
SHA256:B7F40F691FF326B56445CC70197CEE89F7896B1380426306452983C916C20E8B
1936WinRAR.exeC:\Users\admin\AppData\Local\Temp\Alina\Alina POS\Panel\gate1.phptext
MD5:8F274C028A8D53CE5522A83ECEE10E07
SHA256:A8475F361844EEEA401B2CFF334DDE5321B621C1000A4F537E00AB52FE8F494D
1936WinRAR.exeC:\Users\admin\AppData\Local\Temp\Alina\Alina POS\Panel\export.phptext
MD5:510B9441E110B57B2F08E7E3BB3F5AE6
SHA256:F92FC8009D090077F8B85759CC0973BC0C337B9F25DC806A70FDD2139440B1D2
1936WinRAR.exeC:\Users\admin\AppData\Local\Temp\Alina\Alina POS\Panel\front\logs.phptext
MD5:E4427A1D798A5F9F20198CBCE2963A08
SHA256:813D24E1223692B12B73D327A0136BA902E5F3D1DE237F82BCDE37F4410417BC
1936WinRAR.exeC:\Users\admin\AppData\Local\Temp\Alina\Alina POS\Rootkit\Settings.inctext
MD5:260929D29B20FAF82427F25FF0B01007
SHA256:E4AC3BB8077585C431B4C96401B53CC06DE32D9A7AD0D08B661A4F7A6E4ED17D
1936WinRAR.exeC:\Users\admin\AppData\Local\Temp\Alina\Alina POS\Panel\front\cards.phptext
MD5:6D3D961F1406EF324D13372085A1859E
SHA256:428F6A813974AC68D58824BD3D5510287173061AC3D927C80E2F76930CC28ABD
1936WinRAR.exeC:\Users\admin\AppData\Local\Temp\Alina\Alina POS\Panel\config.phptext
MD5:4BE5EE8896A23174D0214277A26DA037
SHA256:3E5C3121D8BDE1172FF581DE42818A7DA6243ED3DB302D0148EE7689CF1FD565
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
2
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

Domain
IP
Reputation
adobeflasherup1.com
  • —
unknown
javaoracle2.ru
  • —
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Alina.zip