File name:

escargot-msn-5.0.0575-en.zip

Full analysis: https://app.any.run/tasks/49f8c9f6-d833-4b11-be18-7aed719a5372
Verdict: Malicious activity
Analysis date: March 10, 2024, 11:47:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
opendir
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

BB21E4D5862F2AA373F90D19BAF44B9E

SHA1:

75C5648969706ED06D8A542CED632C1D3FB5E3E0

SHA256:

BEEC09CC772EF29D86E77F2AA691814E7BA0419C15E81BE4F4A38F3AFAF516A9

SSDEEP:

98304:p9csrnZKWjXaFFkxKdsLd5K5rILiubSafqmwVV/UpCM5Z8tdJZ2XDPqmTLKtZAt4:HvX2Yhhluu0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • msnmsgr.exe (PID: 2244)

    • Drops the executable file immediately after the start

      • rundll32.exe (PID: 2472)

    • Scans artifacts that could help determine the target

      • msnmsgr.exe (PID: 2244)
      • msnmsgr.exe (PID: 3556)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • rundll32.exe (PID: 2472)
      • msiexec.exe (PID: 3500)

    • Executes as Windows Service

      • VSSVC.exe (PID: 3392)

    • Reads the Internet Settings

      • msnmsgr.exe (PID: 2244)
      • msnmsgr.exe (PID: 3556)

    • Checks Windows Trust Settings

      • msnmsgr.exe (PID: 3556)

    • Reads security settings of Internet Explorer

      • msnmsgr.exe (PID: 3556)

    • Adds/modifies Windows certificates

      • msnmsgr.exe (PID: 3556)

    • Reads settings of System Certificates

      • msnmsgr.exe (PID: 3556)

    • Connects to unusual port

      • msnmsgr.exe (PID: 3556)

    • Reads Microsoft Outlook installation path

      • msnmsgr.exe (PID: 3556)

    • Reads Internet Explorer settings

      • msnmsgr.exe (PID: 3556)

  • INFO

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3944)
      • msiexec.exe (PID: 3500)

    • Manual execution by a user

      • WinRAR.exe (PID: 3944)
      • rundll32.exe (PID: 3720)
      • msiexec.exe (PID: 3500)
      • RUN_AFTER_INSTALL.exe (PID: 2972)
      • RUN_AFTER_INSTALL.exe (PID: 1544)
      • msnmsgr.exe (PID: 3556)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 3500)
      • WinRAR.exe (PID: 3944)

    • Reads the machine GUID from the registry

      • msnmsgr.exe (PID: 2244)
      • RUN_AFTER_INSTALL.exe (PID: 1544)
      • msnmsgr.exe (PID: 3556)

    • Reads the computer name

      • msnmsgr.exe (PID: 2244)
      • msnmsgr.exe (PID: 3556)

    • Checks supported languages

      • msnmsgr.exe (PID: 2244)
      • RUN_AFTER_INSTALL.exe (PID: 1544)
      • msnmsgr.exe (PID: 3556)

    • Checks proxy server information

      • msnmsgr.exe (PID: 2244)
      • msnmsgr.exe (PID: 3556)

    • Create files in a temporary directory

      • RUN_AFTER_INSTALL.exe (PID: 1544)
      • msnmsgr.exe (PID: 3556)

    • Reads the software policy settings

      • msnmsgr.exe (PID: 3556)

    • Creates files or folders in the user directory

      • msnmsgr.exe (PID: 3556)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xpi | Mozilla Firefox browser extension (66.6)
.zip | ZIP compressed archive (33.3)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2021:03:20 11:39:54
ZipCRC: 0x7147b282
ZipCompressedSize: 2162417
ZipUncompressedSize: 2392064
ZipFileName: escargot-msn-5.0.0575-en.msi
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
54
Monitored processes
9
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start rundll32.exe no specs rundll32.exe no specs winrar.exe msiexec.exe vssvc.exe no specs msnmsgr.exe run_after_install.exe no specs run_after_install.exe msnmsgr.exe

Process information

PID
CMD
Path
Indicators
Parent process
1544"C:\Users\admin\Desktop\RUN_AFTER_INSTALL.exe" C:\Users\admin\Desktop\RUN_AFTER_INSTALL.exe
explorer.exe
User:
admin
Company:
Level Leap, Inc (levelleap.com)
Integrity Level:
HIGH
Description:
Patcher for Escargot
Exit code:
0
Version:
1.00
Modules
Images
c:\users\admin\desktop\run_after_install.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2244"C:\Program Files\MSN Messenger\msnmsgr.exe"C:\Program Files\MSN Messenger\msnmsgr.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Messenger
Exit code:
1
Version:
5.0.0575
Modules
Images
c:\program files\msn messenger\msnmsgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2472"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL "C:\Users\admin\Desktop\escargot-msn-5.0.0575-en.zip.xpi"C:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
2972"C:\Users\admin\Desktop\RUN_AFTER_INSTALL.exe" C:\Users\admin\Desktop\RUN_AFTER_INSTALL.exe—explorer.exe
User:
admin
Company:
Level Leap, Inc (levelleap.com)
Integrity Level:
MEDIUM
Description:
Patcher for Escargot
Exit code:
3221226540
Version:
1.00
Modules
Images
c:\users\admin\desktop\run_after_install.exe
c:\windows\system32\ntdll.dll
3392C:\Windows\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3500"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\Desktop\escargot-msn-5.0.0575-en.msi" C:\Windows\System32\msiexec.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3556"C:\Program Files\MSN Messenger\msnmsgr.exe" C:\Program Files\MSN Messenger\msnmsgr.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Messenger
Exit code:
0
Version:
5.0.0575
Modules
Images
c:\program files\msn messenger\msnmsgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3720"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\Desktop\escargot-msn-5.0.0575-en.zip.xpiC:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
3944"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\escargot-msn-5.0.0575-en.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
Total events
12 088
Read events
11 858
Write events
203
Delete events
27

Modification events

(PID) Process:(3944) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3944) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3944) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3944) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3944) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3944) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(3944) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\escargot-msn-5.0.0575-en.zip
(PID) Process:(3944) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3944) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3944) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
4
Suspicious files
6
Text files
18
Unknown types
5

Dropped files

PID
Process
Filename
Type
3944WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3944.26174\RUN_AFTER_INSTALL.exeexecutable
MD5:0CDC028A56850C6E233DF18992C0E122
SHA256:10F5ABB5A22F22A3A521AACD4289CB43759C82CA7986D451514F6E101AE54BF7
3556msnmsgr.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:3AA9A4C77380967F9DCCBF42D2C1D289
SHA256:66237F71069966635C418E0E98B04AC7EF8BB0BCEF5AACDD1C2353A8E4AA5233
3944WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3944.26174\escargot-msn-5.0.0575-en.msiexecutable
MD5:FDA36DB9CF47698D0E19A3AB74392D8B
SHA256:D429B485B05B85187A07F2C7FF285D6B99AB82B30F0DA2459636CA460165B981
3556msnmsgr.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:6EC7E3A90A364EBB94FC1CC9E9158FC7
SHA256:31B9B36EAB494D5019341A1EC731AB85CE45AC0CC5EBE0A701D655D0AF47A6ED
3500msiexec.exeC:\Users\admin\AppData\Local\Temp\MSIA796.tmpexecutable
MD5:F89D26235C1C595031E66F1535393751
SHA256:921A5FC7E0E6E14E5B4AB7E6AA4795E26EF268FE21945BCA1060029B4772F8E1
3500msiexec.exeC:\Users\admin\AppData\Local\Temp\MSIA042.tmpexecutable
MD5:F89D26235C1C595031E66F1535393751
SHA256:921A5FC7E0E6E14E5B4AB7E6AA4795E26EF268FE21945BCA1060029B4772F8E1
3556msnmsgr.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\28895D559676252E05B26EA7DF029EEE_A46D6BFE731D828B5DFECFFCC1B4D8DFbinary
MD5:842F303A02DB1820CCD22E91A4B59405
SHA256:DB771C2515AC917A2A0D2ED8EBBA3D5F95E0E3D98C84EC89F2E291E8732BB4E0
3556msnmsgr.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464der
MD5:8202A1CD02E7D69597995CABBE881A12
SHA256:58F381C3A0A0ACE6321DA22E40BD44A597BD98B9C9390AB9258426B5CF75A7A5
3556msnmsgr.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\28895D559676252E05B26EA7DF029EEE_A46D6BFE731D828B5DFECFFCC1B4D8DFder
MD5:B5A62129951D890E9490F811AE5A4E8E
SHA256:440CC2654171D8FAF8A6E5E143D7D79F70294CB3CC52A9EA3CEB483038798C7E
3556msnmsgr.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\adxml_main[1].htmhtml
MD5:CD2E0E43980A00FB6A2742D3AFD803B8
SHA256:BD9DF047D51943ACC4BC6CF55D88EDB5B6785A53337EE2A0F74DD521AEDDE87D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
20
TCP/UDP connections
27
DNS requests
13
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3556
msnmsgr.exe
GET
304
173.222.108.226:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?87bd4a9a22bae384
unknown
—
—
unknown
3556
msnmsgr.exe
GET
301
143.198.4.104:80
http://msnmsgr.escargot.chat/svcs/mms/adxml_main.asp?Version=5.0&Plcid=0409&CLCID=0409&BrandID=MSMSGS&country=00&PUID=e90310745484e9a3&random=1752421
unknown
html
178 b
unknown
3556
msnmsgr.exe
GET
301
143.198.4.104:80
http://msnmsgr.escargot.chat/svcs/mms/portal.asp?Plcid=0409&Version=5.0&CLCID=0409&BrandID=MSMSGS&Country=00&component=MSNExtra&autolaunch=1&random=1752421&pod=797
unknown
html
178 b
unknown
3556
msnmsgr.exe
GET
302
143.198.4.104:80
http://msnmsgr.escargot.chat/svcs/mms/tabs.asp
unknown
text
10 b
unknown
3556
msnmsgr.exe
GET
302
143.198.4.104:80
http://msnmsgr.escargot.chat/5meen_us/60?Plcid=0409&Version=5.0&CLCID=0409&BrandID=MSMSGS&Country=00
unknown
text
10 b
unknown
3556
msnmsgr.exe
GET
301
104.236.95.230:80
http://escargot.chat/today/wlm/
unknown
html
178 b
unknown
3556
msnmsgr.exe
GET
200
142.250.184.195:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
binary
1.41 Kb
unknown
3556
msnmsgr.exe
GET
200
104.236.95.230:80
http://conf.escargot.chat/etc/tabs
unknown
xml
1.50 Kb
unknown
3556
msnmsgr.exe
GET
200
2.19.105.18:80
http://x1.c.lencr.org/
unknown
binary
717 b
unknown
3556
msnmsgr.exe
GET
200
208.113.160.141:80
http://storage.levelleap.com/nina/clients/msnp/tabicon/escargot.png
unknown
image
4.44 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3556
msnmsgr.exe
143.198.4.104:443
msnmsgr.escargot.chat
DIGITALOCEAN-ASN
US
unknown
3556
msnmsgr.exe
173.222.108.226:80
ctldl.windowsupdate.com
Akamai International B.V.
CH
unknown
3556
msnmsgr.exe
142.250.184.195:80
ocsp.pki.goog
GOOGLE
US
whitelisted
1080
svchost.exe
173.222.108.226:80
ctldl.windowsupdate.com
Akamai International B.V.
CH
unknown
3556
msnmsgr.exe
143.198.4.104:1863
msnmsgr.escargot.chat
DIGITALOCEAN-ASN
US
unknown
3556
msnmsgr.exe
143.198.4.104:80
msnmsgr.escargot.chat
DIGITALOCEAN-ASN
US
unknown

DNS requests

Domain
IP
Reputation
msnmsgr.escargot.chat
  • 143.198.4.104
unknown
ctldl.windowsupdate.com
  • 173.222.108.226
  • 173.222.108.210
whitelisted
ocsp.pki.goog
  • 142.250.184.195
whitelisted
m1.escargot.chat
  • 143.198.4.104
unknown
e450.voice.microsoft.com
  • 64.4.61.253
unknown
conf.escargot.chat
  • 104.236.95.230
unknown
escargot.chat
  • 104.236.95.230
unknown
storage.levelleap.com
  • 208.113.160.141
unknown
x1.c.lencr.org
  • 2.19.105.18
whitelisted
r3.o.lencr.org
  • 95.101.54.131
  • 95.101.54.121
  • 95.101.54.201
  • 95.101.54.144
  • 95.101.54.217
  • 95.101.54.137
  • 95.101.54.138
  • 95.101.54.107
  • 95.101.54.194
shared

Threats

PID
Process
Class
Message
3556
msnmsgr.exe
Potential Corporate Privacy Violation
GPL CHAT MSN login attempt
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
escargot-msn-5.0.0575-en.zip