File name:

SoftPerfectNetworkScannerPortable_8.2.0.zip

Full analysis: https://app.any.run/tasks/9fac378f-11b3-42ca-b609-757659798f45
Verdict: Malicious activity
Analysis date: June 06, 2024, 08:28:50
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=store
MD5:

A63B80C71900C8AD4E49A568A71522E5

SHA1:

60E00C4EE2992A9FD2EE7B054E43ACC521BDAD04

SHA256:

C2480055D7AED11E7AF6DE88AAC3FEB89BC6479071435EF719705A15CE31E6C9

SSDEEP:

98304:h7ES/HGneJIW5vFMPnrsL7tEWhLAiBShr78P7kzT2tL11e+o034qFq7zD4/9RUQy:p7K3kK8AtBX+tWCSFDV

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3980)
      • SoftPerfectNetworkScannerPortable.exe (PID: 524)

  • SUSPICIOUS

    • Malware-specific behavior (creating "System.dll" in Temp)

      • SoftPerfectNetworkScannerPortable.exe (PID: 524)

    • The process creates files with name similar to system file names

      • SoftPerfectNetworkScannerPortable.exe (PID: 524)

    • Reads security settings of Internet Explorer

      • SoftPerfectNetworkScannerPortable.exe (PID: 524)

    • Reads the Internet Settings

      • SoftPerfectNetworkScannerPortable.exe (PID: 524)

    • Executable content was dropped or overwritten

      • SoftPerfectNetworkScannerPortable.exe (PID: 524)

    • Uses pipe srvsvc via SMB (transferring data)

      • netscan.exe (PID: 1236)

  • INFO

    • Manual execution by a user

      • SoftPerfectNetworkScannerPortable.exe (PID: 524)
      • explorer.exe (PID: 4028)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3980)

    • Checks supported languages

      • SoftPerfectNetworkScannerPortable.exe (PID: 524)
      • netscan.exe (PID: 1236)

    • Reads the computer name

      • SoftPerfectNetworkScannerPortable.exe (PID: 524)
      • netscan.exe (PID: 1236)

    • Create files in a temporary directory

      • SoftPerfectNetworkScannerPortable.exe (PID: 524)

    • Reads the machine GUID from the registry

      • SoftPerfectNetworkScannerPortable.exe (PID: 524)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2023:11:20 10:25:30
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: SoftPerfectNetworkScannerPortable_8.2.0/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
4
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe explorer.exe no specs softperfectnetworkscannerportable.exe netscan.exe

Process information

PID
CMD
Path
Indicators
Parent process
524"C:\Users\admin\AppData\Local\Temp\SoftPerfectNetworkScannerPortable_8.2.0\SoftPerfectNetworkScannerPortable_8.2.0\SoftPerfectNetworkScannerPortable.exe" C:\Users\admin\AppData\Local\Temp\SoftPerfectNetworkScannerPortable_8.2.0\SoftPerfectNetworkScannerPortable_8.2.0\SoftPerfectNetworkScannerPortable.exe
explorer.exe
User:
admin
Company:
https://joosengportableapp.blogspot.com
Integrity Level:
MEDIUM
Description:
SoftPerfect Network Scanner Portable Launcher
Version:
2020.04.15.0
Modules
Images
c:\users\admin\appdata\local\temp\softperfectnetworkscannerportable_8.2.0\softperfectnetworkscannerportable_8.2.0\softperfectnetworkscannerportable.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
1236C:\Users\admin\AppData\Local\Temp\SoftPerfectNetworkScannerPortable_8.2.0\SoftPerfectNetworkScannerPortable_8.2.0\App\32-bit\netscan.exeC:\Users\admin\AppData\Local\Temp\SoftPerfectNetworkScannerPortable_8.2.0\SoftPerfectNetworkScannerPortable_8.2.0\App\32-bit\netscan.exe
SoftPerfectNetworkScannerPortable.exe
User:
admin
Company:
SoftPerfect Pty Ltd
Integrity Level:
MEDIUM
Description:
Application for scanning networks
Version:
8.2.0.0
Modules
Images
c:\users\admin\appdata\local\temp\softperfectnetworkscannerportable_8.2.0\softperfectnetworkscannerportable_8.2.0\app\32-bit\netscan.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3980"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\SoftPerfectNetworkScannerPortable_8.2.0.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
4028"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
6 299
Read events
6 266
Write events
33
Delete events
0

Modification events

(PID) Process:(3980) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3980) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3980) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3980) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3980) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3980) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(3980) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\SoftPerfectNetworkScannerPortable_8.2.0.zip
(PID) Process:(3980) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3980) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3980) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
12
Suspicious files
0
Text files
13
Unknown types
0

Dropped files

PID
Process
Filename
Type
3980WinRAR.exeC:\Users\admin\AppData\Local\Temp\SoftPerfectNetworkScannerPortable_8.2.0\SoftPerfectNetworkScannerPortable_8.2.0\App\32-bit\netscan.exeexecutable
MD5:A29D5181017BCF8BF6CC1000806D02E8
SHA256:B3EB283C2C18CBD61E2059F0AA1C52ECC395F3FE492196661018337E982BB1D5
3980WinRAR.exeC:\Users\admin\AppData\Local\Temp\SoftPerfectNetworkScannerPortable_8.2.0\SoftPerfectNetworkScannerPortable_8.2.0\App\64-bit\netscan.exeexecutable
MD5:87F1184C3BA77B8DFE156113D432D7AD
SHA256:8ECEA5E10FE8A23CAE5B3A7A21706B5FDD6C3042F549D773D7E4D8CF13408032
3980WinRAR.exeC:\Users\admin\AppData\Local\Temp\SoftPerfectNetworkScannerPortable_8.2.0\SoftPerfectNetworkScannerPortable_8.2.0\App\32-bit\libsmi2.dllexecutable
MD5:5DAEFBB8B68A54AE9FBB523277174E14
SHA256:06910174BF00D4C16A99F5F70DE45EADFB470F43261D32856A68D05DDC1BB02C
3980WinRAR.exeC:\Users\admin\AppData\Local\Temp\SoftPerfectNetworkScannerPortable_8.2.0\SoftPerfectNetworkScannerPortable_8.2.0\App\64-bit\libsmi2.dllexecutable
MD5:CF93B5C3CFA0319949F32A3B44546671
SHA256:045353527D7454FC43D692125A00AD8E68EEB247724AB80310FC8DF3E74C5B8F
3980WinRAR.exeC:\Users\admin\AppData\Local\Temp\SoftPerfectNetworkScannerPortable_8.2.0\SoftPerfectNetworkScannerPortable_8.2.0\Data\settings\netscan.licxml
MD5:AC3331319DB65403210019A4B16B499D
SHA256:458F6172B88E7DC338B4EA51CE6B56B662A8F6302441ABA4A47ED6B2035CB688
3980WinRAR.exeC:\Users\admin\AppData\Local\Temp\SoftPerfectNetworkScannerPortable_8.2.0\SoftPerfectNetworkScannerPortable_8.2.0\SoftPerfectNetworkScannerPortable.exeexecutable
MD5:41858B996E5B59821FD5880621F20792
SHA256:237E7D8399A8730C5A658B46E6084947E1993DA53F7242D41869A1B21BD7ADC7
524SoftPerfectNetworkScannerPortable.exeC:\Users\admin\AppData\Local\Temp\nsp7785.tmp\UAC.dllexecutable
MD5:7F56C0D6A8733DEC142814ED5A58B0EE
SHA256:86445396775370AFF5834F10BDA25E505B6F89EFC69A04FE1CE46F5D128BE73F
524SoftPerfectNetworkScannerPortable.exeC:\Users\admin\AppData\Local\Temp\nsp7785.tmp\System.dllexecutable
MD5:24BA3B21FE9C5D01A7C21D32958B3A16
SHA256:EF63F2D4DC4CCB6B35449F56B19915A26EE6DC7089DF01499F44DA4DB5AB1499
3980WinRAR.exeC:\Users\admin\AppData\Local\Temp\SoftPerfectNetworkScannerPortable_8.2.0\SoftPerfectNetworkScannerPortable_8.2.0\Data\settings\netscan.xmlxml
MD5:867EF96B05E7B3521686886DF5A99BFE
SHA256:C6E9124F9F16AF7282BDAAEA896A86F1934CF14CAEDA8E94AFFFC36A9304BAB6
524SoftPerfectNetworkScannerPortable.exeC:\Users\admin\AppData\Local\Temp\nsp7785.tmp\splash.jpgimage
MD5:1756E28E635A0A51826EFD104C330787
SHA256:8E1C1D2A4DA4376B69248ADD69B22F570B5F8F9B444DCBB80CA4E176083BC781
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
19
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
1236
netscan.exe
192.168.1.2:137
—
—
—
unknown
1236
netscan.exe
192.168.1.2:445
—
—
—
unknown
1236
netscan.exe
192.168.1.2:161
—
—
—
unknown
1236
netscan.exe
192.168.1.2:5353
—
—
—
unknown
4
System
192.168.1.2:445
—
—
—
unknown
4
System
192.168.1.2:139
—
—
—
unknown

DNS requests

Domain
IP
Reputation
2.1.168.192.in-addr.arpa
  • —
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
SoftPerfectNetworkScannerPortable_8.2.0.zip