File name:

Alina.zip

Full analysis: https://app.any.run/tasks/66b8d5c5-0368-40aa-9118-0284855545b6
Verdict: Malicious activity
Analysis date: January 29, 2024, 04:40:47
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

9A70586AF61CAEF844A0A9969B2D5C36

SHA1:

215868350BDD2C4AF3B1A71209E518500D9A7BB6

SHA256:

BC9C0D26872140B2ECB156AB065E02A85CF483E407BE9AEEB66F701A7F9B3EB3

SSDEEP:

98304:6+ScpO9zf0N18zVYJEIblXyrwLdArAgmpOXeodEpgjkbqWpWLajyPbF1606ICdx7:LR2fbqZvLwhdtIy81DIQ6IVQxejvb9

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 1936)
      • Spark.exe (PID: 452)

    • Application was injected by another process

      • explorer.exe (PID: 1164)

    • Runs injected code in another process

      • windefender.exe (PID: 2712)

  • SUSPICIOUS

    • Executing commands from ".cmd" file

      • WinRAR.exe (PID: 1936)

    • Starts CMD.EXE for commands execution

      • WinRAR.exe (PID: 1936)

    • Executable content was dropped or overwritten

      • Spark.exe (PID: 452)

    • Starts itself from another location

      • Spark.exe (PID: 452)

    • Reads the Internet Settings

      • Spark.exe (PID: 452)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1936)

    • Checks supported languages

      • Spark.exe (PID: 452)
      • windefender.exe (PID: 2712)

    • Reads the computer name

      • windefender.exe (PID: 2712)
      • Spark.exe (PID: 452)

    • Creates files or folders in the user directory

      • Spark.exe (PID: 452)

    • Checks proxy server information

      • Spark.exe (PID: 452)

    • Reads the machine GUID from the registry

      • Spark.exe (PID: 452)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2015:01:20 19:14:30
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: Alina POS/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
5
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start inject winrar.exe cmd.exe no specs spark.exe windefender.exe no specs explorer.exe

Process information

PID
CMD
Path
Indicators
Parent process
452"C:\Users\admin\AppData\Local\Temp\Alina\Alina POS\Source\Debug\Spark.exe" C:\Users\admin\AppData\Local\Temp\Alina\Alina POS\Source\Debug\Spark.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\alina\alina pos\source\debug\spark.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
1164C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1936"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Alina.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2560C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\Alina\Alina POS\Rootkit\Compile.EXE.GCC.cmd" "C:\Windows\System32\cmd.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2712"C:\Users\admin\AppData\Roaming\Installed\windefender.exe"C:\Users\admin\AppData\Roaming\Installed\windefender.exe—Spark.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\installed\windefender.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
Total events
1 803
Read events
1 752
Write events
51
Delete events
0

Modification events

(PID) Process:(1164) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
01000000D08C9DDF0115D1118C7A00C04FC297EB01000000DBDD10622BD67741A42163F361389C4700000000020000000000106600000001000020000000714C0B985B0540658F4A2080B484A48FEA0193B4945278E76DEADC9EF300F178000000000E80000000020000200000002B477AD6A48910EDA2BF44A8E4FAAFB7E2EDF3EE6F87B8965B303D8016BD90EA30000000CB02147CAA96DADF9F5A3BD08AC8A954F632048A3EC443FAA534C64E43A96953CAB4A202A2BC0443ADBC5B693897DBB44000000078BCD17E1DCD91E99A86D38616C049FA8C5E2A7C07BB269B76B0709DC8A01ABF25866BF6638D5C4422D1151CE173748901F5A2433E1BD07914E254B07BB130FD
(PID) Process:(1936) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1164) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.zip\OpenWithList
Operation:writeName:MRUList
Value:
a
(PID) Process:(1936) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(1936) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(1936) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(1936) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(1936) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1936) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1936) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
2
Suspicious files
17
Text files
53
Unknown types
1

Dropped files

PID
Process
Filename
Type
1936WinRAR.exeC:\Users\admin\AppData\Local\Temp\Alina\Alina POS\Panel\admin.phptext
MD5:4A20AF8E9A5C4AEC6809545F30DE3879
SHA256:55A5787E9AF116203675B71F10DB38E6B334B2228D30568BF54E30364E4B202F
1936WinRAR.exeC:\Users\admin\AppData\Local\Temp\Alina\Alina POS\Panel\config.phptext
MD5:4BE5EE8896A23174D0214277A26DA037
SHA256:3E5C3121D8BDE1172FF581DE42818A7DA6243ED3DB302D0148EE7689CF1FD565
1936WinRAR.exeC:\Users\admin\AppData\Local\Temp\Alina\Alina POS\Panel\export.phptext
MD5:510B9441E110B57B2F08E7E3BB3F5AE6
SHA256:F92FC8009D090077F8B85759CC0973BC0C337B9F25DC806A70FDD2139440B1D2
1936WinRAR.exeC:\Users\admin\AppData\Local\Temp\Alina\Alina POS\Panel\duck_bun.zipcompressed
MD5:93E4987B574B90617CE3F46C881E722C
SHA256:4C9946D4DD1E96F6AE84E5E1FC9593CE08EA1A0764E30F8EDE2C6AC0D76ED140
1936WinRAR.exeC:\Users\admin\AppData\Local\Temp\Alina\Alina POS\Rootkit\InjectedDLL.ctext
MD5:D87605CC83E8F10B99E9A1571118B938
SHA256:B7F40F691FF326B56445CC70197CEE89F7896B1380426306452983C916C20E8B
1936WinRAR.exeC:\Users\admin\AppData\Local\Temp\Alina\Alina POS\Rootkit\FileToByteArray.ctext
MD5:1E585530164500CAC389387C9E2D9D9A
SHA256:DB4369AB556312D1BB0D5744A1F835605C1F3C1E8B5E9D00D64A007F30BB8B54
1936WinRAR.exeC:\Users\admin\AppData\Local\Temp\Alina\Alina POS\Rootkit\Settings.inctext
MD5:260929D29B20FAF82427F25FF0B01007
SHA256:E4AC3BB8077585C431B4C96401B53CC06DE32D9A7AD0D08B661A4F7A6E4ED17D
1936WinRAR.exeC:\Users\admin\AppData\Local\Temp\Alina\Alina POS\Source\grab\Base.htext
MD5:0E6D3A5E1C21E2F219A02968C802A639
SHA256:9516AAF713D6B48AFA885F8571FA2EC4EFC71BFB66BA41B3A67C31DA622FF8CF
1936WinRAR.exeC:\Users\admin\AppData\Local\Temp\Alina\Alina POS\Source\Debug\Spark.ilkilk
MD5:4E5050D17AF621EDA81D0262DF3CEA47
SHA256:05FD30915D11709C138C6520C4FD066AD12AF28A5E3C5858AD52ED9FB589E394
1936WinRAR.exeC:\Users\admin\AppData\Local\Temp\Alina\Alina POS\Source\Debug\Spark.pdbpdb
MD5:36D723DB4B19CD936D5C009EF096C6FB
SHA256:ADCB4ABD99511D9EAE4307FDE5F3ABD86558A5DDBCAE460B06AA40F4805537AD
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
2
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

Domain
IP
Reputation
adobeflasherup1.com
  • —
unknown
javaoracle2.ru
  • —
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Alina.zip