File name:

jcopenglish.exe_.zip

Full analysis: https://app.any.run/tasks/881107a7-8105-4b2d-85af-07c30880c1be
Verdict: Malicious activity
Analysis date: December 27, 2021, 13:55:34
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

4F48F9F0BFBA90A09B26BFEA8929F2AA

SHA1:

4EDEA29BF4E566D850303535AE03CF7C062235C1

SHA256:

C640BB564D7FCE81EDAD9427C0A99C1092FE268D62079C1F3E42C4B63B74F2F5

SSDEEP:

49152:NM3X+iCk5T2flm+8cd7yUX2Fpdxb7RFx51TvR8cZ6lZ0Ng:N6XoeWX2/bNHvOrZ0g

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • jcopenglish.exe (PID: 2204)
      • GPShell.exe (PID: 404)
      • GPShell.exe (PID: 1780)
      • GPShell.exe (PID: 3308)
      • GPShell.exe (PID: 3748)
      • GPShell.exe (PID: 2444)
      • GPShell.exe (PID: 2744)
      • GPShell.exe (PID: 3072)
      • GPShell.exe (PID: 3920)
      • GPShell.exe (PID: 3076)
      • GPShell.exe (PID: 692)
      • GPShell.exe (PID: 1068)
      • GPShell.exe (PID: 2232)
      • GPShell.exe (PID: 1516)
      • GPShell.exe (PID: 1988)

    • Drops executable file immediately after starts

      • jcopenglish.exe (PID: 2204)

    • Loads dropped or rewritten executable

      • GPShell.exe (PID: 404)
      • GPShell.exe (PID: 3308)
      • GPShell.exe (PID: 1780)
      • GPShell.exe (PID: 2444)
      • GPShell.exe (PID: 3748)
      • GPShell.exe (PID: 3072)
      • GPShell.exe (PID: 3076)
      • GPShell.exe (PID: 2744)
      • GPShell.exe (PID: 3920)
      • GPShell.exe (PID: 2232)
      • GPShell.exe (PID: 692)
      • GPShell.exe (PID: 1068)
      • GPShell.exe (PID: 1516)
      • GPShell.exe (PID: 1988)

  • SUSPICIOUS

    • Checks supported languages

      • jcopenglish.exe (PID: 2204)
      • WinRAR.exe (PID: 2896)
      • GPShell.exe (PID: 404)
      • GPShell.exe (PID: 3308)
      • GPShell.exe (PID: 1780)
      • GPShell.exe (PID: 3748)
      • GPShell.exe (PID: 2444)
      • GPShell.exe (PID: 3072)
      • GPShell.exe (PID: 3076)
      • GPShell.exe (PID: 2744)
      • GPShell.exe (PID: 3920)
      • GPShell.exe (PID: 692)
      • GPShell.exe (PID: 2232)
      • GPShell.exe (PID: 1988)
      • GPShell.exe (PID: 1068)
      • GPShell.exe (PID: 1516)

    • Reads the computer name

      • WinRAR.exe (PID: 2896)
      • jcopenglish.exe (PID: 2204)
      • GPShell.exe (PID: 404)
      • GPShell.exe (PID: 3308)
      • GPShell.exe (PID: 1780)
      • GPShell.exe (PID: 2444)
      • GPShell.exe (PID: 2744)
      • GPShell.exe (PID: 3920)
      • GPShell.exe (PID: 692)
      • GPShell.exe (PID: 1068)
      • GPShell.exe (PID: 1988)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2896)
      • jcopenglish.exe (PID: 2204)

    • Drops a file with too old compile date

      • jcopenglish.exe (PID: 2204)

  • INFO

    • Manual execution by user

      • jcopenglish.exe (PID: 2204)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0008
ZipCompression: Deflated
ZipModifyDate: 2021:04:20 12:02:06
ZipCRC: 0x40dbc5b0
ZipCompressedSize: 2544065
ZipUncompressedSize: 5131776
ZipFileName: jcopenglish.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
64
Monitored processes
16
Malicious processes
1
Suspicious processes
14

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start winrar.exe jcopenglish.exe gpshell.exe no specs gpshell.exe no specs gpshell.exe no specs gpshell.exe no specs gpshell.exe no specs gpshell.exe no specs gpshell.exe no specs gpshell.exe no specs gpshell.exe no specs gpshell.exe no specs gpshell.exe no specs gpshell.exe no specs gpshell.exe no specs gpshell.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2896"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\jcopenglish.exe_.zip"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2204"C:\Users\admin\Desktop\jcopenglish.exe" C:\Users\admin\Desktop\jcopenglish.exe
Explorer.EXE
User:
admin
Company:
EMV Writer Software by Paws
Integrity Level:
MEDIUM
Description:
EMV Chip Writer
Version:
10.0.0.0
Modules
Images
c:\users\admin\desktop\jcopenglish.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\user32.dll
404"C:\Windowr\GPShell.exe" form.dllC:\Windowr\GPShell.exe—jcopenglish.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Version:
1, 4, 4, 0
Modules
Images
c:\windowr\gpshell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windowr\globalplatform.dll
c:\windowr\zlib1.dll
c:\windowr\libeay32.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
3308"C:\Windowr\GPShell.exe" del.dllC:\Windowr\GPShell.exe—jcopenglish.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Version:
1, 4, 4, 0
Modules
Images
c:\windowr\gpshell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windowr\globalplatform.dll
c:\windowr\zlib1.dll
c:\windowr\libeay32.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
1780"C:\Windowr\GPShell.exe" del.dllC:\Windowr\GPShell.exe—jcopenglish.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Version:
1, 4, 4, 0
Modules
Images
c:\windowr\gpshell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windowr\globalplatform.dll
c:\windowr\zlib1.dll
c:\windowr\libeay32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\wsock32.dll
3748"C:\Windowr\GPShell.exe" apdu.dllC:\Windowr\GPShell.exe—jcopenglish.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Version:
1, 4, 4, 0
Modules
Images
c:\windowr\gpshell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windowr\globalplatform.dll
c:\windowr\zlib1.dll
c:\windowr\libeay32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\wsock32.dll
2444"C:\Windowr\GPShell.exe" form.dllC:\Windowr\GPShell.exe—jcopenglish.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Version:
1, 4, 4, 0
Modules
Images
c:\windowr\gpshell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windowr\globalplatform.dll
c:\windowr\zlib1.dll
c:\windowr\libeay32.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
2744"C:\Windowr\GPShell.exe" form.dllC:\Windowr\GPShell.exe—jcopenglish.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Version:
1, 4, 4, 0
Modules
Images
c:\windowr\gpshell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windowr\zlib1.dll
c:\windows\system32\msvcrt.dll
c:\windowr\globalplatform.dll
c:\windowr\libeay32.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
3076"C:\Windowr\GPShell.exe" apdu.dllC:\Windowr\GPShell.exe—jcopenglish.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Version:
1, 4, 4, 0
Modules
Images
c:\windowr\gpshell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windowr\globalplatform.dll
c:\windowr\zlib1.dll
c:\windowr\libeay32.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
3072"C:\Windowr\GPShell.exe" apdu.dllC:\Windowr\GPShell.exe—jcopenglish.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Version:
1, 4, 4, 0
Modules
Images
c:\windowr\gpshell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windowr\globalplatform.dll
c:\windowr\zlib1.dll
c:\windowr\libeay32.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
Total events
1 313
Read events
1 284
Write events
29
Delete events
0

Modification events

(PID) Process:(2896) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2896) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2896) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2896) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2896) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2896) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\jcopenglish.exe_.zip
(PID) Process:(2896) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2896) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2896) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2896) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
7
Suspicious files
2
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
2204jcopenglish.exeC:\Windowr\del.dlltext
MD5:39F489355AC6CCC48A810E2C867475FD
SHA256:71E16A8C9540CBEB6AFC80045A21F7C5954F9E54B5EC731C93AFCA6D67A61646
2204jcopenglish.exeC:\Windowr\GPShell.exeexecutable
MD5:50FCDD91AEE3EC8D7C54FEB63E324C03
SHA256:BA5E9041668257393AE28413F5099DB5D12D7F48C239E8D19E9BEDA2036B31BE
2204jcopenglish.exeC:\Windowr\MacGyver.capcompressed
MD5:3709E18B229E3DB113BF5C7863C59DB4
SHA256:9DC70002E82C78EE34C813597925C6CF8AA8D68B7E9CE5BCC70EA9BCAB9DBF4A
2204jcopenglish.exeC:\Windowr\Global.drvcompressed
MD5:418F4F42405CEC3252F0B952ED9A642C
SHA256:148B8755D228F174F4DBD0B8454E3825F34E6D6E055341D4C3981C2BB7664C07
2204jcopenglish.exeC:\Windowr\GPPcScConnectionPlugin.dllexecutable
MD5:2F99E012379E8C950B0BDE761C5CCA0F
SHA256:5D84EC3F8DEE7438B0049D5DC201A68A99F3E471A4C9ACAC48DD7F67F89FD178
2204jcopenglish.exeC:\Windowr\zlib1.dllexecutable
MD5:C7D4D685A0AF2A09CBC21CB474358595
SHA256:E96B397B499D9EAA3F52EAF496CA8941E80C0AD1544879CCADF02BF2C6A1ECFC
2204jcopenglish.exeC:\Windowr\ssleay32.dllexecutable
MD5:63D26ECAFCF3B2CEBD5E2F05BCAD553D
SHA256:4F1BAD1A6B9E00473D885BF4E7F3D9D0EC3D91CBDCE05B46F6C6CB2D1FCA8C2B
2896WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2896.49783\jcopenglish.exeexecutable
MD5:0828480F98ADB533104D42AD42601F80
SHA256:1ECFD3755EBA578108363C0705C6EC205972080739ED0FBD17439F8139BA7E08
2204jcopenglish.exeC:\Windowr\form.dlltext
MD5:20640673B59B3E298D00899F8EE77079
SHA256:58C92AE2DE19A77BEA6F8A934FC317310E33030C93A01205BB375CBAE3E5706D
2204jcopenglish.exeC:\Windowr\GlobalPlatform.dllexecutable
MD5:C035B189CCC0FA06E549CCABF7DFBA48
SHA256:DAC5A4213654CAE1AA622877E7E156C0EFD77C0601440DF7CE9995E280DF8694
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
jcopenglish.exe_.zip