File name:

SoftPerfectNetworkScannerPortable_8.2.0.zip

Full analysis: https://app.any.run/tasks/9fac378f-11b3-42ca-b609-757659798f45
Verdict: Malicious activity
Analysis date: June 06, 2024, 08:28:50
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=store
MD5:

A63B80C71900C8AD4E49A568A71522E5

SHA1:

60E00C4EE2992A9FD2EE7B054E43ACC521BDAD04

SHA256:

C2480055D7AED11E7AF6DE88AAC3FEB89BC6479071435EF719705A15CE31E6C9

SSDEEP:

98304:h7ES/HGneJIW5vFMPnrsL7tEWhLAiBShr78P7kzT2tL11e+o034qFq7zD4/9RUQy:p7K3kK8AtBX+tWCSFDV

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3980)
      • SoftPerfectNetworkScannerPortable.exe (PID: 524)

  • SUSPICIOUS

    • Uses pipe srvsvc via SMB (transferring data)

      • netscan.exe (PID: 1236)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • SoftPerfectNetworkScannerPortable.exe (PID: 524)

    • The process creates files with name similar to system file names

      • SoftPerfectNetworkScannerPortable.exe (PID: 524)

    • Reads security settings of Internet Explorer

      • SoftPerfectNetworkScannerPortable.exe (PID: 524)

    • Reads the Internet Settings

      • SoftPerfectNetworkScannerPortable.exe (PID: 524)

    • Executable content was dropped or overwritten

      • SoftPerfectNetworkScannerPortable.exe (PID: 524)

  • INFO

    • Manual execution by a user

      • SoftPerfectNetworkScannerPortable.exe (PID: 524)
      • explorer.exe (PID: 4028)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3980)

    • Checks supported languages

      • netscan.exe (PID: 1236)
      • SoftPerfectNetworkScannerPortable.exe (PID: 524)

    • Reads the computer name

      • SoftPerfectNetworkScannerPortable.exe (PID: 524)
      • netscan.exe (PID: 1236)

    • Create files in a temporary directory

      • SoftPerfectNetworkScannerPortable.exe (PID: 524)

    • Reads the machine GUID from the registry

      • SoftPerfectNetworkScannerPortable.exe (PID: 524)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2023:11:20 10:25:30
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: SoftPerfectNetworkScannerPortable_8.2.0/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
4
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe explorer.exe no specs softperfectnetworkscannerportable.exe netscan.exe

Process information

PID
CMD
Path
Indicators
Parent process
524"C:\Users\admin\AppData\Local\Temp\SoftPerfectNetworkScannerPortable_8.2.0\SoftPerfectNetworkScannerPortable_8.2.0\SoftPerfectNetworkScannerPortable.exe" C:\Users\admin\AppData\Local\Temp\SoftPerfectNetworkScannerPortable_8.2.0\SoftPerfectNetworkScannerPortable_8.2.0\SoftPerfectNetworkScannerPortable.exe
explorer.exe
User:
admin
Company:
https://joosengportableapp.blogspot.com
Integrity Level:
MEDIUM
Description:
SoftPerfect Network Scanner Portable Launcher
Version:
2020.04.15.0
Modules
Images
c:\users\admin\appdata\local\temp\softperfectnetworkscannerportable_8.2.0\softperfectnetworkscannerportable_8.2.0\softperfectnetworkscannerportable.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
1236C:\Users\admin\AppData\Local\Temp\SoftPerfectNetworkScannerPortable_8.2.0\SoftPerfectNetworkScannerPortable_8.2.0\App\32-bit\netscan.exeC:\Users\admin\AppData\Local\Temp\SoftPerfectNetworkScannerPortable_8.2.0\SoftPerfectNetworkScannerPortable_8.2.0\App\32-bit\netscan.exe
SoftPerfectNetworkScannerPortable.exe
User:
admin
Company:
SoftPerfect Pty Ltd
Integrity Level:
MEDIUM
Description:
Application for scanning networks
Version:
8.2.0.0
Modules
Images
c:\users\admin\appdata\local\temp\softperfectnetworkscannerportable_8.2.0\softperfectnetworkscannerportable_8.2.0\app\32-bit\netscan.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3980"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\SoftPerfectNetworkScannerPortable_8.2.0.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
4028"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
6 299
Read events
6 266
Write events
33
Delete events
0

Modification events

(PID) Process:(3980) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3980) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3980) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3980) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3980) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3980) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(3980) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\SoftPerfectNetworkScannerPortable_8.2.0.zip
(PID) Process:(3980) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3980) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3980) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
12
Suspicious files
0
Text files
13
Unknown types
0

Dropped files

PID
Process
Filename
Type
3980WinRAR.exeC:\Users\admin\AppData\Local\Temp\SoftPerfectNetworkScannerPortable_8.2.0\SoftPerfectNetworkScannerPortable_8.2.0\App\64-bit\libsmb2.dllexecutable
MD5:E2AF3D9919D32F21E4C538D948EA0C9C
SHA256:548ED838E23F75C47E05B7EF00FC27DDFE1022E96D20837B8C7CE1BCD69DD64F
3980WinRAR.exeC:\Users\admin\AppData\Local\Temp\SoftPerfectNetworkScannerPortable_8.2.0\SoftPerfectNetworkScannerPortable_8.2.0\App\32-bit\netscan.exeexecutable
MD5:A29D5181017BCF8BF6CC1000806D02E8
SHA256:B3EB283C2C18CBD61E2059F0AA1C52ECC395F3FE492196661018337E982BB1D5
3980WinRAR.exeC:\Users\admin\AppData\Local\Temp\SoftPerfectNetworkScannerPortable_8.2.0\SoftPerfectNetworkScannerPortable_8.2.0\App\64-bit\netscan.exeexecutable
MD5:87F1184C3BA77B8DFE156113D432D7AD
SHA256:8ECEA5E10FE8A23CAE5B3A7A21706B5FDD6C3042F549D773D7E4D8CF13408032
3980WinRAR.exeC:\Users\admin\AppData\Local\Temp\SoftPerfectNetworkScannerPortable_8.2.0\SoftPerfectNetworkScannerPortable_8.2.0\App\64-bit\libsmi2.dllexecutable
MD5:CF93B5C3CFA0319949F32A3B44546671
SHA256:045353527D7454FC43D692125A00AD8E68EEB247724AB80310FC8DF3E74C5B8F
3980WinRAR.exeC:\Users\admin\AppData\Local\Temp\SoftPerfectNetworkScannerPortable_8.2.0\SoftPerfectNetworkScannerPortable_8.2.0\App\32-bit\libsmi2.dllexecutable
MD5:5DAEFBB8B68A54AE9FBB523277174E14
SHA256:06910174BF00D4C16A99F5F70DE45EADFB470F43261D32856A68D05DDC1BB02C
3980WinRAR.exeC:\Users\admin\AppData\Local\Temp\SoftPerfectNetworkScannerPortable_8.2.0\SoftPerfectNetworkScannerPortable_8.2.0\App\AppInfo\appicon_128.pngimage
MD5:B30C8929DE063BFB6E562EA40BCEB2B1
SHA256:CA666B0809556F5BC02507EB8A0BE9453465FD8ABB397238274AE706D38C76B3
3980WinRAR.exeC:\Users\admin\AppData\Local\Temp\SoftPerfectNetworkScannerPortable_8.2.0\SoftPerfectNetworkScannerPortable_8.2.0\App\AppInfo\appicon_16.pngimage
MD5:5FB3E560516C7A77306A6DF66F96192A
SHA256:9690DBD555C38E4637A94B04F4A49DD6401943030580436F63E14D889D6194EE
3980WinRAR.exeC:\Users\admin\AppData\Local\Temp\SoftPerfectNetworkScannerPortable_8.2.0\SoftPerfectNetworkScannerPortable_8.2.0\App\AppInfo\appicon.icoimage
MD5:8EA729A05B44D186C3FEBC5ED9E454DF
SHA256:FF4D779E34D5A889522FB573632E88A348A38F7C9C1F053C00C84BF8CB0F103E
3980WinRAR.exeC:\Users\admin\AppData\Local\Temp\SoftPerfectNetworkScannerPortable_8.2.0\SoftPerfectNetworkScannerPortable_8.2.0\App\32-bit\libsmb2.dllexecutable
MD5:8F42E9739F7EE983C4E1DB8E480A3EDD
SHA256:2358A4FFEE11AFDD7F4A955546BDE3B0724217B44283E3C02B3420ED8E1D9F4E
524SoftPerfectNetworkScannerPortable.exeC:\Users\admin\AppData\Local\Temp\nsp7785.tmp\UAC.dllexecutable
MD5:7F56C0D6A8733DEC142814ED5A58B0EE
SHA256:86445396775370AFF5834F10BDA25E505B6F89EFC69A04FE1CE46F5D128BE73F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
19
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
1236
netscan.exe
192.168.1.2:137
—
—
—
unknown
1236
netscan.exe
192.168.1.2:445
—
—
—
unknown
1236
netscan.exe
192.168.1.2:161
—
—
—
unknown
1236
netscan.exe
192.168.1.2:5353
—
—
—
unknown
4
System
192.168.1.2:445
—
—
—
unknown
4
System
192.168.1.2:139
—
—
—
unknown

DNS requests

Domain
IP
Reputation
2.1.168.192.in-addr.arpa
  • —
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SoftPerfectNetworkScannerPortable_8.2.0.zip