File name:

escargot-msn-5.0.0575-en.zip

Full analysis: https://app.any.run/tasks/49f8c9f6-d833-4b11-be18-7aed719a5372
Verdict: Malicious activity
Analysis date: March 10, 2024, 11:47:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
opendir
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

BB21E4D5862F2AA373F90D19BAF44B9E

SHA1:

75C5648969706ED06D8A542CED632C1D3FB5E3E0

SHA256:

BEEC09CC772EF29D86E77F2AA691814E7BA0419C15E81BE4F4A38F3AFAF516A9

SSDEEP:

98304:p9csrnZKWjXaFFkxKdsLd5K5rILiubSafqmwVV/UpCM5Z8tdJZ2XDPqmTLKtZAt4:HvX2Yhhluu0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • rundll32.exe (PID: 2472)

    • Changes the autorun value in the registry

      • msnmsgr.exe (PID: 2244)

    • Scans artifacts that could help determine the target

      • msnmsgr.exe (PID: 2244)
      • msnmsgr.exe (PID: 3556)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • rundll32.exe (PID: 2472)
      • msiexec.exe (PID: 3500)

    • Executes as Windows Service

      • VSSVC.exe (PID: 3392)

    • Reads the Internet Settings

      • msnmsgr.exe (PID: 2244)
      • msnmsgr.exe (PID: 3556)

    • Checks Windows Trust Settings

      • msnmsgr.exe (PID: 3556)

    • Reads security settings of Internet Explorer

      • msnmsgr.exe (PID: 3556)

    • Reads Microsoft Outlook installation path

      • msnmsgr.exe (PID: 3556)

    • Reads settings of System Certificates

      • msnmsgr.exe (PID: 3556)

    • Reads Internet Explorer settings

      • msnmsgr.exe (PID: 3556)

    • Connects to unusual port

      • msnmsgr.exe (PID: 3556)

    • Adds/modifies Windows certificates

      • msnmsgr.exe (PID: 3556)

  • INFO

    • Manual execution by a user

      • rundll32.exe (PID: 3720)
      • msiexec.exe (PID: 3500)
      • WinRAR.exe (PID: 3944)
      • RUN_AFTER_INSTALL.exe (PID: 1544)
      • RUN_AFTER_INSTALL.exe (PID: 2972)
      • msnmsgr.exe (PID: 3556)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3944)
      • msiexec.exe (PID: 3500)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 3500)
      • WinRAR.exe (PID: 3944)

    • Checks supported languages

      • msnmsgr.exe (PID: 2244)
      • RUN_AFTER_INSTALL.exe (PID: 1544)
      • msnmsgr.exe (PID: 3556)

    • Reads the computer name

      • msnmsgr.exe (PID: 2244)
      • msnmsgr.exe (PID: 3556)

    • Checks proxy server information

      • msnmsgr.exe (PID: 2244)
      • msnmsgr.exe (PID: 3556)

    • Reads the machine GUID from the registry

      • msnmsgr.exe (PID: 2244)
      • RUN_AFTER_INSTALL.exe (PID: 1544)
      • msnmsgr.exe (PID: 3556)

    • Create files in a temporary directory

      • RUN_AFTER_INSTALL.exe (PID: 1544)
      • msnmsgr.exe (PID: 3556)

    • Creates files or folders in the user directory

      • msnmsgr.exe (PID: 3556)

    • Reads the software policy settings

      • msnmsgr.exe (PID: 3556)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xpi | Mozilla Firefox browser extension (66.6)
.zip | ZIP compressed archive (33.3)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2021:03:20 11:39:54
ZipCRC: 0x7147b282
ZipCompressedSize: 2162417
ZipUncompressedSize: 2392064
ZipFileName: escargot-msn-5.0.0575-en.msi
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
54
Monitored processes
9
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start rundll32.exe no specs rundll32.exe no specs winrar.exe msiexec.exe vssvc.exe no specs msnmsgr.exe run_after_install.exe no specs run_after_install.exe msnmsgr.exe

Process information

PID
CMD
Path
Indicators
Parent process
1544"C:\Users\admin\Desktop\RUN_AFTER_INSTALL.exe" C:\Users\admin\Desktop\RUN_AFTER_INSTALL.exe
explorer.exe
User:
admin
Company:
Level Leap, Inc (levelleap.com)
Integrity Level:
HIGH
Description:
Patcher for Escargot
Exit code:
0
Version:
1.00
Modules
Images
c:\users\admin\desktop\run_after_install.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2244"C:\Program Files\MSN Messenger\msnmsgr.exe"C:\Program Files\MSN Messenger\msnmsgr.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Messenger
Exit code:
1
Version:
5.0.0575
Modules
Images
c:\program files\msn messenger\msnmsgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2472"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL "C:\Users\admin\Desktop\escargot-msn-5.0.0575-en.zip.xpi"C:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
2972"C:\Users\admin\Desktop\RUN_AFTER_INSTALL.exe" C:\Users\admin\Desktop\RUN_AFTER_INSTALL.exe—explorer.exe
User:
admin
Company:
Level Leap, Inc (levelleap.com)
Integrity Level:
MEDIUM
Description:
Patcher for Escargot
Exit code:
3221226540
Version:
1.00
Modules
Images
c:\users\admin\desktop\run_after_install.exe
c:\windows\system32\ntdll.dll
3392C:\Windows\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3500"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\Desktop\escargot-msn-5.0.0575-en.msi" C:\Windows\System32\msiexec.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3556"C:\Program Files\MSN Messenger\msnmsgr.exe" C:\Program Files\MSN Messenger\msnmsgr.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Messenger
Exit code:
0
Version:
5.0.0575
Modules
Images
c:\program files\msn messenger\msnmsgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3720"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\Desktop\escargot-msn-5.0.0575-en.zip.xpiC:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
3944"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\escargot-msn-5.0.0575-en.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
Total events
12 088
Read events
11 858
Write events
203
Delete events
27

Modification events

(PID) Process:(3944) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3944) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3944) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3944) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3944) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3944) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(3944) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\escargot-msn-5.0.0575-en.zip
(PID) Process:(3944) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3944) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3944) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
4
Suspicious files
6
Text files
18
Unknown types
5

Dropped files

PID
Process
Filename
Type
3944WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3944.26174\RUN_AFTER_INSTALL.exeexecutable
MD5:0CDC028A56850C6E233DF18992C0E122
SHA256:10F5ABB5A22F22A3A521AACD4289CB43759C82CA7986D451514F6E101AE54BF7
3944WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3944.26174\escargot-msn-5.0.0575-en.msiexecutable
MD5:FDA36DB9CF47698D0E19A3AB74392D8B
SHA256:D429B485B05B85187A07F2C7FF285D6B99AB82B30F0DA2459636CA460165B981
3556msnmsgr.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\28895D559676252E05B26EA7DF029EEE_A46D6BFE731D828B5DFECFFCC1B4D8DFder
MD5:B5A62129951D890E9490F811AE5A4E8E
SHA256:440CC2654171D8FAF8A6E5E143D7D79F70294CB3CC52A9EA3CEB483038798C7E
3556msnmsgr.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAder
MD5:29070CEB4AFE380B9CBF44E594D33871
SHA256:E773E41D069C9506C323BC4A169C0494E0533B89DF5C703201A2FC629CC5C8EB
3556msnmsgr.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\login[1].txttext
MD5:5B86B0C22A16100FB201A7C525C3D4FA
SHA256:07717CAAE4B7BD6B1621DB61D1395BA773F7FBE7177A5D1263C37E13176CB426
3556msnmsgr.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\tabs[1].xmlxml
MD5:215FF7D9909B0D22B46A1E22DBA2E58E
SHA256:3B2EE95EAD64178A670293078A647C5F16A626C4B7C6E50FC433D50AF7884FE7
3556msnmsgr.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\portal[1].htmhtml
MD5:CD2E0E43980A00FB6A2742D3AFD803B8
SHA256:BD9DF047D51943ACC4BC6CF55D88EDB5B6785A53337EE2A0F74DD521AEDDE87D
3556msnmsgr.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751binary
MD5:BE0470561D8F2F4AA393BC998977066D
SHA256:587C16503207B2B5F17E2DD73900F55F82951A0FDF08F1BEC6D43603A538C93A
3556msnmsgr.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\wlm[1].htmhtml
MD5:BD2695F4B079C71DBDDDE3436286FB9C
SHA256:2E04A18FF185BA5B16F762A0538339BC4049ACEAEF9738EDD43AF77D2CEB788B
3556msnmsgr.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\pprdr[1].asptext
MD5:5B86B0C22A16100FB201A7C525C3D4FA
SHA256:07717CAAE4B7BD6B1621DB61D1395BA773F7FBE7177A5D1263C37E13176CB426
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
20
TCP/UDP connections
27
DNS requests
13
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3556
msnmsgr.exe
GET
200
208.113.160.141:80
http://storage.levelleap.com/nina/clients/msnp/tabicon/facebook.png
unknown
image
3.55 Kb
—
3556
msnmsgr.exe
GET
200
208.113.160.141:80
http://storage.levelleap.com/nina/clients/msnp/tabicon/msn-weather.png
unknown
image
4.27 Kb
—
3556
msnmsgr.exe
GET
200
95.101.54.131:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgM6fEWypeiOQXeFlk9D%2BodgMQ%3D%3D
unknown
binary
503 b
—
3556
msnmsgr.exe
GET
200
208.113.160.141:80
http://storage.levelleap.com/nina/clients/msnp/tabicon/youtube.png
unknown
image
3.57 Kb
—
3556
msnmsgr.exe
GET
301
143.198.4.104:80
http://msnmsgr.escargot.chat/svcs/mms/RecruitTemplate.asp?Version=5.0&Plcid=0409&CLCID=0409&Country=00&BrandID=MSMSGS&OS=Win
unknown
html
178 b
—
3556
msnmsgr.exe
GET
301
143.198.4.104:80
http://msnmsgr.escargot.chat/svcs/mms/ads.asp?Version=5.0&Plcid=0409&LCID=0409&LocID=00&BrandID=MSMSGS&Adsvr=MS
unknown
html
178 b
—
3556
msnmsgr.exe
GET
304
173.222.108.226:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?87bd4a9a22bae384
unknown
—
—
—
3556
msnmsgr.exe
GET
200
142.250.184.195:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
binary
1.41 Kb
—
3556
msnmsgr.exe
GET
200
142.250.184.195:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFCjJ1PwkYAi7fE%3D
unknown
binary
724 b
—
3556
msnmsgr.exe
GET
200
142.250.184.195:80
http://ocsp.pki.goog/s/gts1p5/gpmwVaPxyz8/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTsSieX%2BJFZNROWeLPoyKIdCXsxLgQU1fyeDd8eyt0Il5duK8VfxSv17LgCEA5zqYMOM7T%2FE7sziAKxSmU%3D
unknown
binary
471 b
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
unknown
—
—
224.0.0.252:5355
—
—
—
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3556
msnmsgr.exe
143.198.4.104:443
msnmsgr.escargot.chat
DIGITALOCEAN-ASN
US
unknown
3556
msnmsgr.exe
173.222.108.226:80
ctldl.windowsupdate.com
Akamai International B.V.
CH
unknown
3556
msnmsgr.exe
142.250.184.195:80
ocsp.pki.goog
GOOGLE
US
unknown
1080
svchost.exe
173.222.108.226:80
ctldl.windowsupdate.com
Akamai International B.V.
CH
unknown
3556
msnmsgr.exe
143.198.4.104:1863
msnmsgr.escargot.chat
DIGITALOCEAN-ASN
US
unknown
3556
msnmsgr.exe
143.198.4.104:80
msnmsgr.escargot.chat
DIGITALOCEAN-ASN
US
unknown

DNS requests

Domain
IP
Reputation
msnmsgr.escargot.chat
  • 143.198.4.104
unknown
ctldl.windowsupdate.com
  • 173.222.108.226
  • 173.222.108.210
unknown
ocsp.pki.goog
  • 142.250.184.195
unknown
m1.escargot.chat
  • 143.198.4.104
unknown
e450.voice.microsoft.com
  • 64.4.61.253
unknown
conf.escargot.chat
  • 104.236.95.230
unknown
escargot.chat
  • 104.236.95.230
unknown
storage.levelleap.com
  • 208.113.160.141
unknown
x1.c.lencr.org
  • 2.19.105.18
unknown
r3.o.lencr.org
  • 95.101.54.131
  • 95.101.54.121
  • 95.101.54.201
  • 95.101.54.144
  • 95.101.54.217
  • 95.101.54.137
  • 95.101.54.138
  • 95.101.54.107
  • 95.101.54.194
unknown

Threats

PID
Process
Class
Message
—
—
Potential Corporate Privacy Violation
GPL CHAT MSN login attempt
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
escargot-msn-5.0.0575-en.zip