analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

6561056999243776.zip

Full analysis: https://app.any.run/tasks/7a589a0c-2161-4830-a857-88471b41df85
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: January 24, 2022, 22:32:44
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
ransomware
stop
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

B6EEEDB52C8B64799C50CDBD39C79C2F

SHA1:

C21F6A1A65375D27B74415B286D2F88F63411FC2

SHA256:

C0217DB96F90E98F6A9522FB5CE578C3B6EBD0EB6B2C80A3B89CFD3AC2B37051

SSDEEP:

12288:tGg6VhQO0sag3UIKEsZbwBomYoVbgM/sDc5TZmlxC+bsKX4RobFbkX3UQImngVv:8Thx0sag3knKO+zU6TUG8XJJ0kbmgVv

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe (PID: 4076)
      • e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe (PID: 3788)
      • e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe (PID: 3700)
      • e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe (PID: 4012)

    • Changes settings of System certificates

      • e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe (PID: 3788)
      • e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe (PID: 4012)

    • Loads the Task Scheduler COM API

      • e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe (PID: 3788)
      • e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe (PID: 4012)

    • Changes the autorun value in the registry

      • e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe (PID: 3788)

    • STOP was detected

      • e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe (PID: 4012)

  • SUSPICIOUS

    • Checks supported languages

      • WinRAR.exe (PID: 2200)
      • e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe (PID: 4076)
      • e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe (PID: 3788)
      • e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe (PID: 3700)
      • e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe (PID: 4012)

    • Reads the computer name

      • WinRAR.exe (PID: 2200)
      • e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe (PID: 3788)
      • e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe (PID: 4012)

    • Drops a file that was compiled in debug mode

      • WinRAR.exe (PID: 2200)
      • e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe (PID: 3788)

    • Uses RUNDLL32.EXE to load library

      • WinRAR.exe (PID: 2200)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2200)
      • e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe (PID: 3788)

    • Creates files in the user directory

      • WinRAR.exe (PID: 2200)

    • Application launched itself

      • e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe (PID: 4076)
      • e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe (PID: 3788)
      • e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe (PID: 3700)

    • Adds / modifies Windows certificates

      • e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe (PID: 3788)
      • e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe (PID: 4012)

    • Uses ICACLS.EXE to modify access control list

      • e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe (PID: 3788)

  • INFO

    • Reads the computer name

      • rundll32.exe (PID: 3116)
      • explorer.exe (PID: 2120)
      • rundll32.exe (PID: 1820)
      • icacls.exe (PID: 3220)

    • Checks supported languages

      • rundll32.exe (PID: 3116)
      • explorer.exe (PID: 2120)
      • rundll32.exe (PID: 1820)
      • icacls.exe (PID: 3220)

    • Manual execution by user

      • explorer.exe (PID: 2120)
      • rundll32.exe (PID: 1820)
      • e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe (PID: 4076)

    • Reads settings of System Certificates

      • e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe (PID: 3788)
      • e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe (PID: 4012)

    • Checks Windows Trust Settings

      • e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe (PID: 3788)
      • e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe (PID: 4012)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6
ZipUncompressedSize: 861696
ZipCompressedSize: 695831
ZipCRC: 0x20bdac55
ZipModifyDate: 1980:00:00 00:00:00
ZipCompression: Deflated
ZipBitFlag: 0x0009
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
49
Monitored processes
9
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start winrar.exe rundll32.exe no specs explorer.exe no specs rundll32.exe no specs e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe no specs e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe icacls.exe no specs e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe #STOP e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe

Process information

PID
CMD
Path
Indicators
Parent process
2200"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Roaming\6561056999243776.zip"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3116"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\Rar$DIb2200.22754\e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6C:\Windows\system32\rundll32.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
2120"C:\Windows\explorer.exe" C:\Windows\explorer.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\usp10.dll
c:\windows\system32\gdi32.dll
1820"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Roaming\6561056999243776\e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6C:\Windows\system32\rundll32.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
4076"C:\Users\admin\AppData\Roaming\6561056999243776\e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe" C:\Users\admin\AppData\Roaming\6561056999243776\e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\6561056999243776\e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3788"C:\Users\admin\AppData\Roaming\6561056999243776\e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe" C:\Users\admin\AppData\Roaming\6561056999243776\e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe
e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\6561056999243776\e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\mpr.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\wininet.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
c:\windows\system32\user32.dll
3220icacls "C:\Users\admin\AppData\Local\c77cc2f6-e3e4-458a-a6f9-63f1667ae9e8" /deny *S-1-1-0:(OI)(CI)(DE,DC)C:\Windows\system32\icacls.exe—e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
3700"C:\Users\admin\AppData\Roaming\6561056999243776\e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe" --Admin IsNotAutoStart IsNotTaskC:\Users\admin\AppData\Roaming\6561056999243776\e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe
e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\6561056999243776\e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
4012"C:\Users\admin\AppData\Roaming\6561056999243776\e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe" --Admin IsNotAutoStart IsNotTaskC:\Users\admin\AppData\Roaming\6561056999243776\e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe
e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\roaming\6561056999243776\e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\mpr.dll
c:\windows\system32\wininet.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
c:\windows\system32\user32.dll
Total events
9 861
Read events
9 717
Write events
138
Delete events
6

Modification events

(PID) Process:(2200) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2200) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2200) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2200) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2200) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2200) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Roaming\6561056999243776.zip
(PID) Process:(2200) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2200) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2200) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2200) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
3
Suspicious files
8
Text files
1
Unknown types
2

Dropped files

PID
Process
Filename
Type
3788e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850Dbinary
MD5:5D627D180059B5568102294B1A029CA0
SHA256:6CEE408BFE3ECBC10EB033848A2A5F2566ED0405C340AFD31A6E03FF1B5E9149
4012e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exeC:\Users\admin\AppData\Local\bowsakkdestx.txtbinary
MD5:856F86FA2DBB84B24F7DC5CE447859FB
SHA256:4D8FF1AB7F22F5D740C6FC63021358E207DE1E918983DAAA773AA3EB6F40BA96
3788e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:C85EC314836F8034C2AAE3D183D4F4AD
SHA256:2396BB2C3ED1970A4319781B8B4D19D92760C5C75DF965E85F9678C78E41FCDF
2200WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIb2200.22754\e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6executable
MD5:58C134EF33BE6BAFAD0C44CDD2364B42
SHA256:E002F29096D44762347DF2B8875EB6683747F3604210E0C3C89BC6F50ED21BA6
3788e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\geo[1].jsonbinary
MD5:9C7C82D6DE8FCFBEBC5693D1AE6815EE
SHA256:E22A291BB5B3C4DF18EBF91900C699089668D6CA8AA220B284E8ECDEF539A888
3788e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Ebinary
MD5:5416C4C590D65C48E052069489B62CF3
SHA256:4190020B7CADC33035A34965FD3E1F3F83C476E495D2C982FCEC26A8DF5C9C8B
4012e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\geo[1].jsonbinary
MD5:9C7C82D6DE8FCFBEBC5693D1AE6815EE
SHA256:E22A291BB5B3C4DF18EBF91900C699089668D6CA8AA220B284E8ECDEF539A888
4012e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exeC:\SystemID\PersonalID.txttext
MD5:5F8B73CDFC3CB55693977750C305887E
SHA256:828F4B9C3CDA16D67A118F2AB95A5F36619C6600F71A180DBDDD606CB5F8F7E8
3788e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exeC:\Users\admin\AppData\Local\c77cc2f6-e3e4-458a-a6f9-63f1667ae9e8\e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exeexecutable
MD5:58C134EF33BE6BAFAD0C44CDD2364B42
SHA256:E002F29096D44762347DF2B8875EB6683747F3604210E0C3C89BC6F50ED21BA6
2200WinRAR.exeC:\Users\admin\AppData\Roaming\6561056999243776\e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6executable
MD5:58C134EF33BE6BAFAD0C44CDD2364B42
SHA256:E002F29096D44762347DF2B8875EB6683747F3604210E0C3C89BC6F50ED21BA6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
8
DNS requests
6
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3788
e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe
GET
200
104.18.30.182:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
US
der
727 b
whitelisted
3788
e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe
GET
200
104.18.30.182:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
US
der
471 b
whitelisted
4012
e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe
GET
200
14.51.96.70:80
http://tzgl.org/fhsgtsspen6/get.php?pid=6E3AAB7CB29BC9495DFDE01272C66F39&first=true
KR
binary
559 b
malicious
4012
e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe
GET
404
14.51.96.70:80
http://tzgl.org/files/1/build3.exe
KR
html
216 b
malicious
3788
e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe
GET
200
67.26.81.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?90490e20428f7d87
US
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3788
e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe
67.26.81.254:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
suspicious
4012
e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe
77.123.139.190:443
api.2ip.ua
Volia
UA
suspicious
3788
e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe
77.123.139.190:443
api.2ip.ua
Volia
UA
suspicious
3788
e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe
104.18.30.182:80
ocsp.comodoca.com
Cloudflare Inc
US
suspicious
4012
e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe
14.51.96.70:80
tzgl.org
Korea Telecom
KR
malicious

DNS requests

Domain
IP
Reputation
api.2ip.ua
  • 77.123.139.190
shared
ctldl.windowsupdate.com
  • 67.26.81.254
  • 67.26.137.254
  • 8.253.204.120
  • 67.27.233.126
  • 8.253.207.120
whitelisted
ocsp.comodoca.com
  • 104.18.30.182
  • 104.18.31.182
whitelisted
ocsp.usertrust.com
  • 104.18.30.182
  • 104.18.31.182
whitelisted
kotob.top
  • —
malicious
tzgl.org
  • 14.51.96.70
  • 110.14.121.123
  • 189.129.113.216
  • 211.119.84.112
  • 211.40.39.251
  • 211.119.84.111
  • 210.92.250.133
  • 222.236.49.124
  • 178.31.236.98
  • 138.36.3.134
malicious

Threats

PID
Process
Class
Message
—
—
A Network Trojan was detected
ET POLICY External IP Address Lookup DNS Query (2ip .ua)
3788
e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe
Potentially Bad Traffic
ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI)
4012
e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe
Potentially Bad Traffic
ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI)
—
—
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
4012
e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe
A Network Trojan was detected
ET USER_AGENTS Suspicious User Agent (Microsoft Internet Explorer)
4012
e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe
A Network Trojan was detected
ET USER_AGENTS Suspicious User Agent (Microsoft Internet Explorer)
4012
e002f29096d44762347df2b8875eb6683747f3604210e0c3c89bc6f50ed21ba6.exe
A Network Trojan was detected
ET TROJAN Potential Dridex.Maldoc Minimal Executable Request
3 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
6561056999243776.zip