analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

any run.zip

Full analysis: https://app.any.run/tasks/94667e6f-672f-4ee9-97d5-8e6dbef620cc
Verdict: Malicious activity
Analysis date: May 20, 2022, 22:16:41
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

D5580C9560F5FF87A09FC6100654D4E4

SHA1:

5F42337E5F30A7D73546BFBB399453D2328E5A8D

SHA256:

C33C4CC5639886BFF516F52872C773EC9D7D15B6CAAE3530753A0458B334C60B

SSDEEP:

196608:XH/djrRJhxwSAGm7eGfp4mFWjsa0e1y8ky+q:XVvfH2lpbafT+q

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • WinRAR.exe (PID: 2944)
      • quantizer.exe (PID: 1932)
      • Sclerosis.exe (PID: 2852)

    • Application was dropped or rewritten from another process

      • Holzer.exe (PID: 2820)
      • Losinium.exe (PID: 3608)
      • Holzer.exe (PID: 2608)
      • Losinium.exe (PID: 2092)
      • Phsyletric.exe (PID: 2940)
      • Phsyletric.exe (PID: 2480)
      • quantizer.exe (PID: 4060)
      • aramaware.exe (PID: 1208)
      • quantizer.exe (PID: 1932)
      • 一一一一一一一一一一一一一一一一.exe (PID: 2980)
      • Mythlas.exe (PID: 3984)
      • Sclerosis.exe (PID: 2336)
      • Sclerosis.exe (PID: 2852)
      • first.exe (PID: 4080)
      • glit.exe (PID: 1812)
      • mbr.exe (PID: 3048)
      • invpaint.exe (PID: 4088)

    • Task Manager has been disabled (taskmgr)

      • reg.exe (PID: 1868)
      • Holzer.exe (PID: 2820)
      • 一一一一一一一一一一一一一一一一.exe (PID: 2980)

    • Disables registry editing tools (regedit)

      • Holzer.exe (PID: 2820)
      • 一一一一一一一一一一一一一一一一.exe (PID: 2980)

    • Disables the Command Prompt (cmd)

      • Holzer.exe (PID: 2820)

    • Loads dropped or rewritten executable

      • glit.exe (PID: 1812)

  • SUSPICIOUS

    • Reads the computer name

      • WinRAR.exe (PID: 2944)
      • Sclerosis.exe (PID: 2852)
      • WScript.exe (PID: 3136)
      • glit.exe (PID: 1812)
      • 一一一一一一一一一一一一一一一一.exe (PID: 2980)
      • Losinium.exe (PID: 2092)
      • Mythlas.exe (PID: 3984)
      • Holzer.exe (PID: 2820)

    • Checks supported languages

      • WinRAR.exe (PID: 2944)
      • Holzer.exe (PID: 2820)
      • Losinium.exe (PID: 2092)
      • Phsyletric.exe (PID: 2940)
      • aramaware.exe (PID: 1208)
      • quantizer.exe (PID: 1932)
      • Mythlas.exe (PID: 3984)
      • 一一一一一一一一一一一一一一一一.exe (PID: 2980)
      • Sclerosis.exe (PID: 2852)
      • WScript.exe (PID: 3136)
      • cmd.exe (PID: 3548)
      • mbr.exe (PID: 3048)
      • glit.exe (PID: 1812)
      • first.exe (PID: 4080)
      • invpaint.exe (PID: 4088)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2944)
      • quantizer.exe (PID: 1932)
      • Sclerosis.exe (PID: 2852)

    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 2944)
      • quantizer.exe (PID: 1932)
      • Sclerosis.exe (PID: 2852)

    • Starts itself from another location

      • quantizer.exe (PID: 1932)

    • Removes files from Windows directory

      • Sclerosis.exe (PID: 2852)

    • Creates files in the Windows directory

      • Sclerosis.exe (PID: 2852)

    • Executes scripts

      • Sclerosis.exe (PID: 2852)

    • Uses REG.EXE to modify Windows registry

      • cmd.exe (PID: 3548)

    • Starts CMD.EXE for commands execution

      • WScript.exe (PID: 3136)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 3548)

  • INFO

    • Manual execution by user

      • Holzer.exe (PID: 2608)
      • Holzer.exe (PID: 2820)
      • Losinium.exe (PID: 2092)
      • Losinium.exe (PID: 3608)
      • Phsyletric.exe (PID: 2480)
      • Phsyletric.exe (PID: 2940)
      • aramaware.exe (PID: 1208)
      • quantizer.exe (PID: 1932)
      • quantizer.exe (PID: 4060)
      • Mythlas.exe (PID: 3984)
      • Sclerosis.exe (PID: 2336)
      • Sclerosis.exe (PID: 2852)

    • Checks Windows Trust Settings

      • WScript.exe (PID: 3136)

    • Checks supported languages

      • reg.exe (PID: 1868)
      • timeout.exe (PID: 3868)
      • timeout.exe (PID: 2532)
      • taskkill.exe (PID: 3740)
      • timeout.exe (PID: 2780)

    • Reads the computer name

      • taskkill.exe (PID: 3740)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: aramaware.exe
ZipUncompressedSize: 616717
ZipCompressedSize: 186036
ZipCRC: 0x75455c4d
ZipModifyDate: 2022:05:12 13:09:21
ZipCompression: Deflated
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
76
Monitored processes
25
Malicious processes
10
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start winrar.exe holzer.exe no specs holzer.exe losinium.exe no specs losinium.exe phsyletric.exe no specs phsyletric.exe aramaware.exe no specs quantizer.exe no specs quantizer.exe 一一一一一一一一一一一一一一一一.exe no specs mythlas.exe no specs sclerosis.exe no specs sclerosis.exe wscript.exe no specs cmd.exe no specs reg.exe no specs mbr.exe no specs glit.exe no specs timeout.exe no specs first.exe no specs timeout.exe no specs taskkill.exe no specs invpaint.exe no specs timeout.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2944"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\any run.zip"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
2608"C:\Users\admin\Desktop\Holzer.exe" C:\Users\admin\Desktop\Holzer.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\holzer.exe
c:\windows\system32\ntdll.dll
2820"C:\Users\admin\Desktop\Holzer.exe" C:\Users\admin\Desktop\Holzer.exe
Explorer.EXE
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\desktop\holzer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3608"C:\Users\admin\Desktop\Losinium.exe" C:\Users\admin\Desktop\Losinium.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\desktop\losinium.exe
2092"C:\Users\admin\Desktop\Losinium.exe" C:\Users\admin\Desktop\Losinium.exe
Explorer.EXE
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\desktop\losinium.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2480"C:\Users\admin\Desktop\Phsyletric.exe" C:\Users\admin\Desktop\Phsyletric.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\phsyletric.exe
c:\windows\system32\ntdll.dll
2940"C:\Users\admin\Desktop\Phsyletric.exe" C:\Users\admin\Desktop\Phsyletric.exe
Explorer.EXE
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\desktop\phsyletric.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
1208"C:\Users\admin\Desktop\aramaware.exe" C:\Users\admin\Desktop\aramaware.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\aramaware.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
4060"C:\Users\admin\Desktop\quantizer.exe" C:\Users\admin\Desktop\quantizer.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\quantizer.exe
c:\windows\system32\ntdll.dll
1932"C:\Users\admin\Desktop\quantizer.exe" C:\Users\admin\Desktop\quantizer.exe
Explorer.EXE
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\quantizer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msimg32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
Total events
2 821
Read events
2 766
Write events
55
Delete events
0

Modification events

(PID) Process:(2944) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2944) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2944) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2944) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2944) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2944) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\any run.zip
(PID) Process:(2944) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2944) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2944) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2944) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
22
Suspicious files
1
Text files
3
Unknown types
1

Dropped files

PID
Process
Filename
Type
2852Sclerosis.exeC:\Windows\Sclerosis\sqmove.exeexecutable
MD5:8AD1DA4C2B678FFBC0F5D95ADFEB5C9B
SHA256:6CAAD2810E0D398EF80F5AA63F8F9ED09DBC5B6BB169E43B7319FE9A1EEA85F2
2852Sclerosis.exeC:\Windows\Sclerosis\glit.mp3mp3
MD5:B5C22B91DCEEA36338D08956E34B8821
SHA256:042BF6B432E5D5EAEC5FC603925D7AAB5D79D584C6AEDB987D2DDACE68EB107F
1932quantizer.exeC:\Users\admin\AppData\Local\Temp\一一一一一一一一一一一一一一一一.exeexecutable
MD5:1458480CF8803569195F934D47AC7481
SHA256:68D528F9AC891E920449188198A233B71B2860838AF4FB970B9966F941CE82CA
2852Sclerosis.exeC:\Windows\Sclerosis\unic2.exeexecutable
MD5:82F2E145AFE720A02716B1AC3C4E9C45
SHA256:6B7233F751D25AD88D46CB2D53EC12237741E69FA3DA4A4BAB1359A69A0BF3E4
2944WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2944.17066\Sclerosis.exeexecutable
MD5:1AD7F52A5B59C3D3F7FBA2F72ECE6FF1
SHA256:D76F8F1C1B52D353712AD0A74808EBB8B13F513E89C5A58803211CDCB3EDCFD0
2944WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2944.17066\quantizer.exeexecutable
MD5:1458480CF8803569195F934D47AC7481
SHA256:68D528F9AC891E920449188198A233B71B2860838AF4FB970B9966F941CE82CA
2944WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2944.17066\MEMZ.exeexecutable
MD5:A7BCF7EA8E9F3F36EBFB85B823E39D91
SHA256:3FF64F10603F0330FA2386FF99471CA789391ACE969BD0EC1C1B8CE1B4A6DB42
2852Sclerosis.exeC:\Windows\Sclerosis\run.vbstext
MD5:2B087BB9DEE64442247BB69DA8FBCAF0
SHA256:A2F3B7C3E0BF6690A243E9088F925396F063549B42568B92D00EBADDC618C3AD
2852Sclerosis.exeC:\Windows\Sclerosis\first.exeexecutable
MD5:ABEA08A9DC66B456B81195F60EF1E1EA
SHA256:097C392A453D809F098E19B24A5BDB574E92C392B2FE04458B841774621D5F74
2852Sclerosis.exeC:\Windows\Sclerosis\glit.exeexecutable
MD5:BB39B6540FE96C20EFD48FCA4915809D
SHA256:6A3A313A69AFE02529FC57FCE2BFA8E8ED2109233909E8E4DCF6856FD2233C19
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
any run.zip