File name:

VirTool.MSIL.CryptInject.zip

Full analysis: https://app.any.run/tasks/af494b7c-c879-4a18-b4c5-506351891fff
Verdict: Malicious activity
Analysis date: December 08, 2023, 23:30:52
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

F54A6C775A61AEF84419BA7221876B1B

SHA1:

4D0DBB333CAA433D16670169D8278DE511025CF0

SHA256:

BF7779098DA0EE1CD1E086C1F43DDCFE909878465B836E32D139C178B9B2815F

SSDEEP:

192:KnKKduvzbRwoloJTK/0NZQCx3paXoA4BrFcgF5ak9KaCUzm1zi:KAv/RxlvGaYjB9N9VCOwi

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses Task Scheduler to run other applications

      • avira_en_sptl1_1249301446-1702076626__pavwws-spotlight-release.exe (PID: 3224)

    • Drops the executable file immediately after the start

      • avira_en_sptl1_1249301446-1702076626__pavwws-spotlight-release.exe (PID: 3224)

  • SUSPICIOUS

    • Reads settings of System Certificates

      • q2.exe (PID: 3200)
      • Avira.Spotlight.Bootstrapper.exe (PID: 3380)

    • The process creates files with name similar to system file names

      • avira_en_sptl1_1249301446-1702076626__pavwws-spotlight-release.exe (PID: 3224)

    • Reads security settings of Internet Explorer

      • q2.exe (PID: 3200)

    • Checks Windows Trust Settings

      • q2.exe (PID: 3200)

    • Reads the Internet Settings

      • q2.exe (PID: 3200)
      • Avira.Spotlight.Bootstrapper.exe (PID: 3380)

    • Searches for installed software

      • Avira.Spotlight.Bootstrapper.exe (PID: 3380)

  • INFO

    • Reads the computer name

      • q2.exe (PID: 3200)
      • wmpnscfg.exe (PID: 4080)
      • Avira.Spotlight.Bootstrapper.exe (PID: 3380)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3048)

    • Manual execution by a user

      • q2.exe (PID: 3200)
      • avira_en_sptl1_1249301446-1702076626__pavwws-spotlight-release.exe (PID: 3224)
      • wmpnscfg.exe (PID: 4080)

    • Checks proxy server information

      • q2.exe (PID: 3200)

    • Checks supported languages

      • q2.exe (PID: 3200)
      • wmpnscfg.exe (PID: 4080)
      • avira_en_sptl1_1249301446-1702076626__pavwws-spotlight-release.exe (PID: 3224)
      • Avira.Spotlight.Bootstrapper.exe (PID: 3380)

    • Reads the machine GUID from the registry

      • q2.exe (PID: 3200)
      • Avira.Spotlight.Bootstrapper.exe (PID: 3380)

    • Create files in a temporary directory

      • avira_en_sptl1_1249301446-1702076626__pavwws-spotlight-release.exe (PID: 3224)
      • Avira.Spotlight.Bootstrapper.exe (PID: 3380)

    • Creates files or folders in the user directory

      • q2.exe (PID: 3200)

    • Creates files in the program directory

      • Avira.Spotlight.Bootstrapper.exe (PID: 3380)

    • Reads Environment values

      • Avira.Spotlight.Bootstrapper.exe (PID: 3380)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2023:12:08 16:47:32
ZipCRC: 0xa639c300
ZipCompressedSize: 8440
ZipUncompressedSize: 24576
ZipFileName: q2.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
52
Monitored processes
6
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs q2.exe wmpnscfg.exe no specs avira_en_sptl1_1249301446-1702076626__pavwws-spotlight-release.exe avira.spotlight.bootstrapper.exe schtasks.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3048"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\VirTool.MSIL.CryptInject.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3200"C:\Users\admin\Desktop\q2.exe" C:\Users\admin\Desktop\q2.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\q2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\wininet.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
3224"C:\Users\admin\Desktop\avira_en_sptl1_1249301446-1702076626__pavwws-spotlight-release.exe" C:\Users\admin\Desktop\avira_en_sptl1_1249301446-1702076626__pavwws-spotlight-release.exe
explorer.exe
User:
admin
Company:
Avira Operations GmbH
Integrity Level:
HIGH
Description:
Avira Security
Exit code:
0
Version:
1.0.45.1
Modules
Images
c:\users\admin\desktop\avira_en_sptl1_1249301446-1702076626__pavwws-spotlight-release.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
3380"C:\Users\admin\AppData\Local\Temp\.CR.27401\Avira.Spotlight.Bootstrapper.exe" "C:\Users\admin\AppData\Local\Temp\.CR.27401\Avira.Spotlight.Bootstrapper.exe" OriginalFileName=avira_en_sptl1_1249301446-1702076626__pavwws-spotlight-release.exeC:\Users\admin\AppData\Local\Temp\.CR.27401\Avira.Spotlight.Bootstrapper.exe
avira_en_sptl1_1249301446-1702076626__pavwws-spotlight-release.exe
User:
admin
Company:
Avira Operations GmbH
Integrity Level:
HIGH
Description:
Avira Security
Exit code:
0
Version:
1.0.45.1
Modules
Images
c:\users\admin\appdata\local\temp\.cr.27401\avira.spotlight.bootstrapper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3776"C:\Windows\system32\schtasks.exe" /Create /Xml "C:\Users\admin\AppData\Local\Temp\.CR.4225\Avira_Security_Installation.xml" /F /TN "Avira_Security_Installation"C:\Windows\System32\schtasks.exe—avira_en_sptl1_1249301446-1702076626__pavwws-spotlight-release.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
4080"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
30 552
Read events
30 392
Write events
160
Delete events
0

Modification events

(PID) Process:(3048) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3048) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3048) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3048) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3048) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3048) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3048) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3048) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3048) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
(PID) Process:(3048) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\General
Operation:writeName:LastFolder
Value:
C:\Users\admin\Desktop
Executable files
3
Suspicious files
7
Text files
2 418
Unknown types
0

Dropped files

PID
Process
Filename
Type
3200q2.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\20KLOPNA.htmhtml
MD5:B3B7B65619C07EE6E6C7058B33FD780A
SHA256:71E7FD08F132E6E0AE6CA65C1703BA29C36B319CA8F1949009ED2EDC13CB8C70
3200q2.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\B40MXLLM.htmhtml
MD5:5308620F06B1B61F0AE32E12A2DA954E
SHA256:F0BF2A2AB411B245AABE88214B65DCBAF37A55D9EBDAFA43DEB15FDDE6CBFE87
3048WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3048.25895\q2.exeexecutable
MD5:C04FD8D9198095192E7D55345966DA2E
SHA256:0C98769E42B364711C478226EF199BFBBA90DB80175EB1B8CD565AA694C09852
3200q2.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\WX731MYG.htmhtml
MD5:5308620F06B1B61F0AE32E12A2DA954E
SHA256:F0BF2A2AB411B245AABE88214B65DCBAF37A55D9EBDAFA43DEB15FDDE6CBFE87
3200q2.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\DS050Q89.htmhtml
MD5:5308620F06B1B61F0AE32E12A2DA954E
SHA256:F0BF2A2AB411B245AABE88214B65DCBAF37A55D9EBDAFA43DEB15FDDE6CBFE87
3200q2.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\0M55NSGJ.htmhtml
MD5:5308620F06B1B61F0AE32E12A2DA954E
SHA256:F0BF2A2AB411B245AABE88214B65DCBAF37A55D9EBDAFA43DEB15FDDE6CBFE87
3200q2.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\0518O0SE.htmhtml
MD5:B3B7B65619C07EE6E6C7058B33FD780A
SHA256:71E7FD08F132E6E0AE6CA65C1703BA29C36B319CA8F1949009ED2EDC13CB8C70
3200q2.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\J944RMBQ.htmhtml
MD5:B3B7B65619C07EE6E6C7058B33FD780A
SHA256:71E7FD08F132E6E0AE6CA65C1703BA29C36B319CA8F1949009ED2EDC13CB8C70
3200q2.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\JBOYJY3G.htmhtml
MD5:B3B7B65619C07EE6E6C7058B33FD780A
SHA256:71E7FD08F132E6E0AE6CA65C1703BA29C36B319CA8F1949009ED2EDC13CB8C70
3200q2.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\HFMBKB47.htmhtml
MD5:5308620F06B1B61F0AE32E12A2DA954E
SHA256:F0BF2A2AB411B245AABE88214B65DCBAF37A55D9EBDAFA43DEB15FDDE6CBFE87
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2 402
TCP/UDP connections
18
DNS requests
10
Threats
2 417

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3200
q2.exe
GET
301
15.197.142.173:80
http://www.malwareanalysisbook.com/
unknown
html
74 b
unknown
3200
q2.exe
GET
301
15.197.142.173:80
http://www.malwareanalysisbook.com/
unknown
html
74 b
unknown
3200
q2.exe
GET
301
15.197.142.173:80
http://www.malwareanalysisbook.com/
unknown
html
74 b
unknown
3200
q2.exe
GET
301
15.197.142.173:80
http://www.malwareanalysisbook.com/
unknown
html
74 b
unknown
3200
q2.exe
GET
301
15.197.142.173:80
http://www.malwareanalysisbook.com/
unknown
html
74 b
unknown
3200
q2.exe
GET
301
15.197.142.173:80
http://www.malwareanalysisbook.com/
unknown
html
74 b
unknown
3200
q2.exe
GET
301
15.197.142.173:80
http://www.practicalmalwareanalysis.com/
unknown
html
63 b
unknown
3200
q2.exe
GET
301
15.197.142.173:80
http://www.practicalmalwareanalysis.com/
unknown
html
63 b
unknown
3200
q2.exe
GET
301
15.197.142.173:80
http://www.malwareanalysisbook.com/
unknown
html
74 b
unknown
3200
q2.exe
GET
301
15.197.142.173:80
http://www.practicalmalwareanalysis.com/
unknown
html
63 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3200
q2.exe
15.197.142.173:80
www.malwareanalysisbook.com
AMAZON-02
US
unknown
3200
q2.exe
104.20.120.46:443
nostarch.com
CLOUDFLARENET
—
unknown
3200
q2.exe
87.248.204.0:80
ctldl.windowsupdate.com
LLNW
US
unknown
3200
q2.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3380
Avira.Spotlight.Bootstrapper.exe
35.158.225.56:443
dispatch.avira-update.com
AMAZON-02
DE
unknown
3380
Avira.Spotlight.Bootstrapper.exe
35.186.241.51:443
api.mixpanel.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
www.malwareanalysisbook.com
  • 15.197.142.173
  • 3.33.152.147
whitelisted
www.practicalmalwareanalysis.com
  • 15.197.142.173
  • 3.33.152.147
whitelisted
nostarch.com
  • 104.20.120.46
  • 104.20.121.46
whitelisted
ctldl.windowsupdate.com
  • 87.248.204.0
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
dispatch.avira-update.com
  • 35.158.225.56
  • 18.193.148.194
unknown
api.mixpanel.com
  • 35.186.241.51
  • 107.178.240.159
  • 130.211.34.183
  • 35.190.25.25
whitelisted
api.my.avira.com
  • 3.69.178.3
  • 54.93.214.52
unknown
package.avira.com
  • 2.18.161.103
unknown

Threats

Found threats are available for the paid subscriptions
2417 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
VirTool.MSIL.CryptInject.zip