File name:

escargot-msn-5.0.0575-en.zip

Full analysis: https://app.any.run/tasks/46fb200c-dcb4-4409-8726-2b053a9b25f1
Verdict: Malicious activity
Analysis date: March 10, 2024, 11:54:35
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
opendir
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

BB21E4D5862F2AA373F90D19BAF44B9E

SHA1:

75C5648969706ED06D8A542CED632C1D3FB5E3E0

SHA256:

BEEC09CC772EF29D86E77F2AA691814E7BA0419C15E81BE4F4A38F3AFAF516A9

SSDEEP:

98304:p9csrnZKWjXaFFkxKdsLd5K5rILiubSafqmwVV/UpCM5Z8tdJZ2XDPqmTLKtZAt4:HvX2Yhhluu0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • rundll32.exe (PID: 3672)

    • Changes the autorun value in the registry

      • msnmsgr.exe (PID: 1336)

    • Scans artifacts that could help determine the target

      • msnmsgr.exe (PID: 1336)
      • msnmsgr.exe (PID: 1728)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • rundll32.exe (PID: 3672)
      • msiexec.exe (PID: 2636)

    • Executes as Windows Service

      • VSSVC.exe (PID: 4000)

    • Reads the Internet Settings

      • msnmsgr.exe (PID: 1336)
      • msnmsgr.exe (PID: 1728)

    • Reads Internet Explorer settings

      • msnmsgr.exe (PID: 1728)

    • Reads security settings of Internet Explorer

      • msnmsgr.exe (PID: 1728)

    • Reads settings of System Certificates

      • msnmsgr.exe (PID: 1728)

    • Checks Windows Trust Settings

      • msnmsgr.exe (PID: 1728)

    • Reads Microsoft Outlook installation path

      • msnmsgr.exe (PID: 1728)

    • Adds/modifies Windows certificates

      • msnmsgr.exe (PID: 1728)

    • Non-standard symbols in registry

      • OUTLOOK.EXE (PID: 3336)

    • Connects to unusual port

      • msnmsgr.exe (PID: 1728)

  • INFO

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 2852)
      • msiexec.exe (PID: 2636)

    • Manual execution by a user

      • msiexec.exe (PID: 2636)
      • WinRAR.exe (PID: 2852)
      • RUN_AFTER_INSTALL.exe (PID: 3800)
      • RUN_AFTER_INSTALL.exe (PID: 3544)
      • msnmsgr.exe (PID: 1728)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2852)
      • msiexec.exe (PID: 2636)

    • Checks supported languages

      • msnmsgr.exe (PID: 1336)
      • RUN_AFTER_INSTALL.exe (PID: 3800)
      • msnmsgr.exe (PID: 1728)

    • Reads the machine GUID from the registry

      • msnmsgr.exe (PID: 1336)
      • RUN_AFTER_INSTALL.exe (PID: 3800)
      • msnmsgr.exe (PID: 1728)

    • Reads the computer name

      • msnmsgr.exe (PID: 1336)
      • msnmsgr.exe (PID: 1728)

    • Checks proxy server information

      • msnmsgr.exe (PID: 1336)
      • msnmsgr.exe (PID: 1728)

    • Create files in a temporary directory

      • RUN_AFTER_INSTALL.exe (PID: 3800)
      • msnmsgr.exe (PID: 1728)

    • Reads the software policy settings

      • msnmsgr.exe (PID: 1728)

    • Creates files or folders in the user directory

      • msnmsgr.exe (PID: 1728)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xpi | Mozilla Firefox browser extension (66.6)
.zip | ZIP compressed archive (33.3)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2021:03:20 11:39:54
ZipCRC: 0x7147b282
ZipCompressedSize: 2162417
ZipUncompressedSize: 2392064
ZipFileName: escargot-msn-5.0.0575-en.msi
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
60
Monitored processes
9
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start rundll32.exe no specs winrar.exe msiexec.exe vssvc.exe no specs msnmsgr.exe run_after_install.exe no specs run_after_install.exe msnmsgr.exe outlook.exe

Process information

PID
CMD
Path
Indicators
Parent process
1336"C:\Program Files\MSN Messenger\msnmsgr.exe"C:\Program Files\MSN Messenger\msnmsgr.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Messenger
Exit code:
1
Version:
5.0.0575
Modules
Images
c:\program files\msn messenger\msnmsgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1728"C:\Program Files\MSN Messenger\msnmsgr.exe" C:\Program Files\MSN Messenger\msnmsgr.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Messenger
Exit code:
0
Version:
5.0.0575
Modules
Images
c:\program files\msn messenger\msnmsgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2636"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\Desktop\escargot-msn-5.0.0575-en.msi" C:\Windows\System32\msiexec.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2852"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\escargot-msn-5.0.0575-en.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3336"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE" -c IPM.Note /m "mailto:eladnaniadam@escargot.chat"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE
msnmsgr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Exit code:
0
Version:
14.0.6025.1000
Modules
Images
c:\program files\microsoft office\office14\outlook.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3544"C:\Users\admin\Desktop\RUN_AFTER_INSTALL.exe" C:\Users\admin\Desktop\RUN_AFTER_INSTALL.exe—explorer.exe
User:
admin
Company:
Level Leap, Inc (levelleap.com)
Integrity Level:
MEDIUM
Description:
Patcher for Escargot
Exit code:
3221226540
Version:
1.00
Modules
Images
c:\users\admin\desktop\run_after_install.exe
c:\windows\system32\ntdll.dll
3672"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL "C:\Users\admin\Desktop\escargot-msn-5.0.0575-en.zip.xpi"C:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
3800"C:\Users\admin\Desktop\RUN_AFTER_INSTALL.exe" C:\Users\admin\Desktop\RUN_AFTER_INSTALL.exe
explorer.exe
User:
admin
Company:
Level Leap, Inc (levelleap.com)
Integrity Level:
HIGH
Description:
Patcher for Escargot
Exit code:
0
Version:
1.00
Modules
Images
c:\users\admin\desktop\run_after_install.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
4000C:\Windows\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
23 345
Read events
22 580
Write events
701
Delete events
64

Modification events

(PID) Process:(2852) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2852) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2852) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2852) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(2852) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2852) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(2852) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\escargot-msn-5.0.0575-en.zip
(PID) Process:(2852) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2852) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2852) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
4
Suspicious files
19
Text files
19
Unknown types
4

Dropped files

PID
Process
Filename
Type
2636msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI5937.tmpexecutable
MD5:F89D26235C1C595031E66F1535393751
SHA256:921A5FC7E0E6E14E5B4AB7E6AA4795E26EF268FE21945BCA1060029B4772F8E1
2852WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2852.18970\escargot-msn-5.0.0575-en.msiexecutable
MD5:FDA36DB9CF47698D0E19A3AB74392D8B
SHA256:D429B485B05B85187A07F2C7FF285D6B99AB82B30F0DA2459636CA460165B981
1728msnmsgr.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAder
MD5:29070CEB4AFE380B9CBF44E594D33871
SHA256:E773E41D069C9506C323BC4A169C0494E0533B89DF5C703201A2FC629CC5C8EB
1728msnmsgr.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464binary
MD5:8C0FC68E528BB3ED191141458EF9D9E1
SHA256:60FC617EDF6EBFB8286DD5C4D5007825433F226E90F6AD97D71DE4858F7612C1
1728msnmsgr.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464der
MD5:8202A1CD02E7D69597995CABBE881A12
SHA256:58F381C3A0A0ACE6321DA22E40BD44A597BD98B9C9390AB9258426B5CF75A7A5
1728msnmsgr.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\28895D559676252E05B26EA7DF029EEE_A46D6BFE731D828B5DFECFFCC1B4D8DFder
MD5:B5A62129951D890E9490F811AE5A4E8E
SHA256:440CC2654171D8FAF8A6E5E143D7D79F70294CB3CC52A9EA3CEB483038798C7E
2852WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2852.18970\RUN_AFTER_INSTALL.exeexecutable
MD5:0CDC028A56850C6E233DF18992C0E122
SHA256:10F5ABB5A22F22A3A521AACD4289CB43759C82CA7986D451514F6E101AE54BF7
1728msnmsgr.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:097D0348E62AF4DEAB15B09E13F8BEC9
SHA256:AA9A1BA71D425D692BAC6FB950EE4DC5B3DE74D1B907057A6DEDCAEF6C564752
1728msnmsgr.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:B13601EF8A4141C143A891548011B5D3
SHA256:0816B81AC2500CFAA44573E9DF9BCB9675D81968C6560E96961DB3AD41D96EAE
1728msnmsgr.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\adxml_main[1].htmhtml
MD5:CD2E0E43980A00FB6A2742D3AFD803B8
SHA256:BD9DF047D51943ACC4BC6CF55D88EDB5B6785A53337EE2A0F74DD521AEDDE87D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
22
TCP/UDP connections
31
DNS requests
17
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1080
svchost.exe
GET
304
2.18.121.202:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?d24e253035548135
unknown
—
—
unknown
1728
msnmsgr.exe
GET
304
2.18.121.71:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?08dfc1b550c4ebed
unknown
—
—
unknown
1728
msnmsgr.exe
GET
200
142.250.186.67:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
binary
1.41 Kb
unknown
1728
msnmsgr.exe
GET
200
142.250.186.67:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFCjJ1PwkYAi7fE%3D
unknown
binary
724 b
unknown
1728
msnmsgr.exe
GET
200
142.250.186.67:80
http://ocsp.pki.goog/s/gts1p5/gpmwVaPxyz8/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTsSieX%2BJFZNROWeLPoyKIdCXsxLgQU1fyeDd8eyt0Il5duK8VfxSv17LgCEA5zqYMOM7T%2FE7sziAKxSmU%3D
unknown
binary
471 b
unknown
1728
msnmsgr.exe
GET
301
143.198.4.104:80
http://msnmsgr.escargot.chat/svcs/mms/adxml_main.asp?Version=5.0&Plcid=0409&CLCID=0409&BrandID=MSMSGS&country=00&PUID=e90310745484e9a3&random=1665484
unknown
html
178 b
unknown
1728
msnmsgr.exe
GET
301
143.198.4.104:80
http://msnmsgr.escargot.chat/svcs/mms/portal.asp?Plcid=0409&Version=5.0&CLCID=0409&BrandID=MSMSGS&Country=00&component=MSNExtra&autolaunch=1&random=1665484&pod=797
unknown
html
178 b
unknown
1728
msnmsgr.exe
GET
302
143.198.4.104:80
http://msnmsgr.escargot.chat/5meen_us/60?Plcid=0409&Version=5.0&CLCID=0409&BrandID=MSMSGS&Country=00
unknown
text
10 b
unknown
1728
msnmsgr.exe
GET
302
143.198.4.104:80
http://msnmsgr.escargot.chat/svcs/mms/tabs.asp
unknown
text
10 b
unknown
1728
msnmsgr.exe
GET
200
104.236.95.230:80
http://conf.escargot.chat/etc/tabs
unknown
xml
1.50 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1728
msnmsgr.exe
143.198.4.104:443
msnmsgr.escargot.chat
DIGITALOCEAN-ASN
US
unknown
1728
msnmsgr.exe
2.18.121.71:80
ctldl.windowsupdate.com
AKAMAI-AS
FR
unknown
1728
msnmsgr.exe
142.250.186.67:80
ocsp.pki.goog
GOOGLE
US
whitelisted
1728
msnmsgr.exe
143.198.4.104:1863
msnmsgr.escargot.chat
DIGITALOCEAN-ASN
US
unknown
1728
msnmsgr.exe
64.4.61.253:7001
e450.voice.microsoft.com
—
—
unknown
1728
msnmsgr.exe
143.198.4.104:80
msnmsgr.escargot.chat
DIGITALOCEAN-ASN
US
unknown

DNS requests

Domain
IP
Reputation
msnmsgr.escargot.chat
  • 143.198.4.104
unknown
ctldl.windowsupdate.com
  • 2.18.121.71
  • 2.18.121.202
whitelisted
ocsp.pki.goog
  • 142.250.186.67
whitelisted
m1.escargot.chat
  • 143.198.4.104
unknown
e450.voice.microsoft.com
  • 64.4.61.253
unknown
conf.escargot.chat
  • 104.236.95.230
unknown
escargot.chat
  • 104.236.95.230
unknown
storage.levelleap.com
  • 208.113.160.141
unknown
x1.c.lencr.org
  • 2.22.202.44
whitelisted
r3.o.lencr.org
  • 2.18.121.9
  • 2.18.121.22
  • 2.18.121.15
  • 2.18.121.10
  • 2.18.121.20
  • 2.18.121.18
  • 2.18.121.19
  • 2.18.121.26
  • 2.18.121.23
shared

Threats

PID
Process
Class
Message
1728
msnmsgr.exe
Potential Corporate Privacy Violation
GPL CHAT MSN login attempt
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
escargot-msn-5.0.0575-en.zip