analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

rdpscan.zip

Full analysis: https://app.any.run/tasks/a168ac08-c828-4b70-9434-1d85bbea2b44
Verdict: Malicious activity
Analysis date: June 12, 2019, 03:57:49
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

721CF22713A527C45E6E934D131AF6E9

SHA1:

F3246B461896148BBA483AB73D4CAAED82FB27E0

SHA256:

C3627D1233859FF655FE586F6D36417FD2897ACB13B139C9DAFB8AAF7E02A3A8

SSDEEP:

49152:/KzkEV/D2B8HW7/W7o3bBtMpov4hQcLF9B4n4d:/qkcqB8HcW7oVUwvCF9B4ni

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Loads dropped or rewritten executable

      • rdpscan.exe (PID: 2128)
      • SearchProtocolHost.exe (PID: 2920)
      • rdpscan.exe (PID: 1460)
    • Application was dropped or rewritten from another process

      • rdpscan.exe (PID: 2128)
      • rdpscan.exe (PID: 1460)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3636)
  • INFO

    • Manual execution by user

      • rdpscan.exe (PID: 1460)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: libcrypto-1_1.dll
ZipUncompressedSize: 2507264
ZipCompressedSize: 1056263
ZipCRC: 0x76c7fe2b
ZipModifyDate: 2019:05:28 22:35:25
ZipCompression: Deflated
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
4
Malicious processes
1
Suspicious processes
2

Behavior graph

Click at the process to see the details
drop and start start winrar.exe rdpscan.exe no specs searchprotocolhost.exe no specs rdpscan.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3636"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\rdpscan.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
2128"C:\Users\admin\AppData\Local\Temp\Rar$EXa3636.39756\rdpscan.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3636.39756\rdpscan.exeWinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
2920"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe5_ Global\UsGthrCtrlFltPipeMssGthrPipe5 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exeSearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
1460"C:\Users\admin\Desktop\rdpscan.exe" C:\Users\admin\Desktop\rdpscan.exeexplorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Total events
432
Read events
420
Write events
12
Delete events
0

Modification events

(PID) Process:(3636) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3636) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3636) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3636) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\rdpscan.zip
(PID) Process:(3636) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3636) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3636) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3636) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3636) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3636) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
4
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
3636WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3636.41323\libcrypto-1_1.dll
MD5:
SHA256:
3636WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3636.41323\libssl-1_1.dll
MD5:
SHA256:
3636WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3636.41323\msvcr120.dll
MD5:
SHA256:
3636WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3636.41323\rdpscan.exe
MD5:
SHA256:
3636WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3636.41323\ssleay32.dll
MD5:
SHA256:
3636WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3636.39756\ssleay32.dllbinary
MD5:27B0374083F46693DF15C0E3FFFAD070
SHA256:948E2DEF7339CF87071913148705BBBA3CD9A8279C6157251036D6FAC59983D5
3636WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3636.39756\rdpscan.exeexecutable
MD5:D0840AEB2642D718F325A07A4B7F6751
SHA256:9966826ADA8B1F366A9E7B9B1E7C430A2A49DDA60EB7025C7481295E3AB7F9E4
3636WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3636.39756\libssl-1_1.dllexecutable
MD5:0BC4DF79B2752DD03C2E04C0D3F4AEA1
SHA256:71B19452B5FD7A389CDE0C588B21F3F03EE443F57A1E42A7670671988BE908CF
3636WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3636.39756\msvcr120.dllexecutable
MD5:034CCADC1C073E4216E9466B720F9849
SHA256:86E39B5995AF0E042FCDAA85FE2AEFD7C9DDC7AD65E6327BD5E7058BC3AB615F
3636WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3636.39756\libcrypto-1_1.dllexecutable
MD5:D5A5E2B8E937E31C881DAFD4179F5536
SHA256:2E7C6AA4DAEA6E14D3D74E01A021A33E063CF60D34632E51B4730A2C3F0D46B3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info