File name:

winzip24-downwz.exe

Full analysis: https://app.any.run/tasks/a06cac92-99be-45c5-846c-3760e0ab6634
Verdict: Malicious activity
Analysis date: December 20, 2019, 18:58:35
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

A4C7B661EC6AF289D200C308EF921CB5

SHA1:

BF8B2EA5ACACF6E015E227A90DF904A5771A946F

SHA256:

C7A4BADF4A5E2D72FCFE98BB9309C7EBCB3A839331EED9E23382D05D22E87A1E

SSDEEP:

24576:qZbDbHvHRCG+YF8JmiyeVnnZNXMICDmJ10pu3:+HvHn+YF8JmiyeVnnZNcIdJ+pu3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • winzip32.exe (PID: 3460)
      • svchost.exe (PID: 864)
      • WzCABCacheSyncHelper32.exe (PID: 3060)

    • Writes to a start menu file

      • msiexec.exe (PID: 1852)

    • Application was injected by another process

      • explorer.exe (PID: 352)

    • Runs injected code in another process

      • FAHWindow32.exe (PID: 1820)

    • Application was dropped or rewritten from another process

      • WzCABCacheSyncHelper32.exe (PID: 3060)

  • SUSPICIOUS

    • Changes the autorun value in the registry

      • msiexec.exe (PID: 1852)

    • Reads Internet Cache Settings

      • winzip24-downwz.exe (PID: 940)

    • Reads internet explorer settings

      • winzip24-downwz.exe (PID: 940)

    • Executable content was dropped or overwritten

      • winzip24-downwz.exe (PID: 3344)
      • msiexec.exe (PID: 1852)

    • Creates files in the program directory

      • winzip24-downwz.exe (PID: 940)
      • winzip32.exe (PID: 3460)

    • Changes IE settings (feature browser emulation)

      • MsiExec.exe (PID: 3424)
      • msiexec.exe (PID: 1852)

    • Creates files in the user directory

      • winzip32.exe (PID: 3460)

    • Modifies the open verb of a shell class

      • winzip32.exe (PID: 3460)
      • msiexec.exe (PID: 1852)

    • Creates a software uninstall entry

      • winzip32.exe (PID: 3460)

    • Creates COM task schedule object

      • adxregistrator.exe (PID: 3300)
      • adxregistrator.exe (PID: 2444)
      • winzip32.exe (PID: 3460)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • msiexec.exe (PID: 1852)

    • Application launched itself

      • msiexec.exe (PID: 1852)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 1852)

    • Loads dropped or rewritten executable

      • msiexec.exe (PID: 1852)

    • Creates files in the program directory

      • MsiExec.exe (PID: 3424)
      • msiexec.exe (PID: 1852)

    • Reads Microsoft Office registry keys

      • adxregistrator.exe (PID: 3300)
      • adxregistrator.exe (PID: 2444)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:08:15 14:48:12+02:00
PEType: PE32
LinkerVersion: 14
CodeSize: 519168
InitializedDataSize: 196096
UninitializedDataSize: -
EntryPoint: 0x4ece0
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 24.0.13543.0
ProductVersionNumber: 24.0.13543.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: WinZip Computing
FileDescription: WinZipStub Installer
FileVersion: 24.0.13543.0
InternalName: WinZipStubInstaller.exe
LegalCopyright: (c) 2015-2019 Corel Corporation All rights reserved.
ProductName: WinZipStub
ProductVersion: 24.0.13543.0

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 15-Aug-2019 12:48:12
Detected languages:
  • English - United States
CompanyName: WinZip Computing
FileDescription: WinZipStub Installer
FileVersion: 24.0.13543.0
InternalName: WinZipStubInstaller.exe
LegalCopyright: (c) 2015-2019 Corel Corporation All rights reserved.
ProductName: WinZipStub
ProductVersion: 24.0.13543.0

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000118

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 7
Time date stamp: 15-Aug-2019 12:48:12
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0007EB3C
0x0007EC00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.61195
.rdata
0x00080000
0x0002005A
0x00020200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.97357
.data
0x000A1000
0x00003BCC
0x00002E00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.69667
.gfids
0x000A5000
0x000007CC
0x00000800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
3.97267
.tls
0x000A6000
0x00000009
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0.0203931
.rsrc
0x000A7000
0x00004E58
0x00005000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.53812
.reloc
0x000AC000
0x000065F4
0x00006600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.62785

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.16947
2013
UNKNOWN
English - United States
RT_MANIFEST
101
1.91924
20
UNKNOWN
English - United States
RT_GROUP_ICON

Imports

ADVAPI32.dll
KERNEL32.dll
RPCRT4.dll
USER32.dll (delay-loaded)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
54
Monitored processes
17
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start inject winzip24-downwz.exe winzip24-downwz.exe msiexec.exe msiexec.exe no specs closefah.exe no specs msiexec.exe no specs wzpreviewer32.exe no specs wzpreloader.exe no specs winzip32.exe no specs wzcabcachesynchelper32.exe svchost.exe fahconsole.exe no specs fahwindow32.exe no specs adxregistrator.exe no specs adxregistrator.exe no specs explorer.exe winzip24-downwz.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
352C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\winanr.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
504"C:\Users\admin\Desktop\winzip24-downwz.exe" C:\Users\admin\Desktop\winzip24-downwz.exe—explorer.exe
User:
admin
Company:
WinZip Computing
Integrity Level:
MEDIUM
Description:
WinZipStub Installer
Exit code:
3221226540
Version:
24.0.13543.0
Modules
Images
c:\users\admin\desktop\winzip24-downwz.exe
c:\systemroot\system32\ntdll.dll
864C:\Windows\system32\svchost.exe -k netsvcsC:\Windows\System32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
940 run=1 shortcut="C:\Users\admin\Desktop\winzip24-downwz.exe"C:\Users\admin\AppData\Local\Temp\38e6e5\winzip24-downwz.exe
winzip24-downwz.exe
User:
admin
Company:
WinZip Computing
Integrity Level:
HIGH
Description:
WinZipStub Installer
Exit code:
0
Version:
24.0.13543.0
Modules
Images
c:\users\admin\appdata\local\temp\38e6e5\winzip24-downwz.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\lpk.dll
1268"C:\Program Files\WinZip\WzPreloader.exe"C:\Program Files\WinZip\WzPreloader.exe—msiexec.exe
User:
admin
Company:
WinZip Computing
Integrity Level:
HIGH
Description:
WinZip Preloader
Exit code:
0
Version:
24.0.13573.0
Modules
Images
c:\program files\winzip\wzpreloader.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1820"C:\Program Files\WinZip\FAHWindow32.exe" registerC:\Program Files\WinZip\FAHWindow32.exe—FAHConsole.exe
User:
SYSTEM
Company:
WinZip Computing, S.L.
Integrity Level:
SYSTEM
Description:
File Association Helper
Exit code:
0
Version:
3.0.0.11
Modules
Images
c:\program files\winzip\fahwindow32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\winzip\fahdll32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1852C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1936C:\Windows\system32\MsiExec.exe -Embedding 43D017FC5EB68696DDDF85AD54270057C:\Windows\system32\MsiExec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2444"C:\Program Files\WinZip\adxregistrator.exe" /install="C:\Program Files\WinZip\WinZipExpressForOffice.dll" /privileges=admin /GenerateLogFile=falseC:\Program Files\WinZip\adxregistrator.exe—MsiExec.exe
User:
SYSTEM
Company:
Add-in Express Ltd.
Integrity Level:
SYSTEM
Description:
Add-in Express .NET Registrator
Exit code:
0
Version:
9.2.4635.0
Modules
Images
c:\program files\winzip\adxregistrator.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2732"C:\Users\admin\AppData\Local\Temp\CloseFAH.exe" C:\Users\admin\AppData\Local\Temp\CloseFAH.exe—MsiExec.exe
User:
admin
Company:
WinZip Computing
Integrity Level:
HIGH
Description:
WinZip CloseFAH
Exit code:
0
Version:
24.0.13650
Modules
Images
c:\users\admin\appdata\local\temp\closefah.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
Total events
6 789
Read events
5 197
Write events
1 585
Delete events
7

Modification events

(PID) Process:(940) winzip24-downwz.exeKey:HKEY_CURRENT_USER\Software\Corel\stubframework\WNZP\24
Operation:writeName:install_language
Value:
English
(PID) Process:(940) winzip24-downwz.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(940) winzip24-downwz.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(940) winzip24-downwz.exeKey:HKEY_CURRENT_USER\Software\Corel\stubframework\WNZP\24
Operation:writeName:status
Value:
0
(PID) Process:(940) winzip24-downwz.exeKey:HKEY_CURRENT_USER\Software\Corel\stubframework\WNZP\24
Operation:writeName:channel
Value:
nkln24-downwz
(PID) Process:(940) winzip24-downwz.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\winzip24-downwz_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(940) winzip24-downwz.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\winzip24-downwz_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(940) winzip24-downwz.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\winzip24-downwz_RASAPI32
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(940) winzip24-downwz.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\winzip24-downwz_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
4294901760
(PID) Process:(940) winzip24-downwz.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\winzip24-downwz_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
Executable files
78
Suspicious files
5
Text files
62
Unknown types
13

Dropped files

PID
Process
Filename
Type
864svchost.exeC:\Windows\appcompat\programs\RecentFileCache.bcftxt
MD5:—
SHA256:—
940winzip24-downwz.exeC:\ProgramData\UniqueId\databinary
MD5:—
SHA256:—
3344winzip24-downwz.exeC:\Users\admin\AppData\Local\Temp\38e6e5\winzip24-downwz.exeexecutable
MD5:—
SHA256:—
940winzip24-downwz.exeC:\Users\admin\AppData\Local\Temp\38e8b9\common\img\button-hover.pngimage
MD5:7D3A382C149EE7588958281A816918BF
SHA256:97E35A7F7DC87983E8D1DDAA120BBA9D81BFE3AE4A6F99301A4749224CFBDD02
940winzip24-downwz.exeC:\Users\admin\AppData\Local\Temp\38e8b9\common\css\common.csstext
MD5:59D687B8DFA4E3169F5D15BF6F835AD3
SHA256:B6B15AC44F1E07FBB46CBAE0BD2B34293BAA5766DD8263E4AC58993CD9F71304
940winzip24-downwz.exeC:\Users\admin\AppData\Local\Temp\38e8b9\common\js\common.jstext
MD5:—
SHA256:—
940winzip24-downwz.exeC:\Users\admin\AppData\Local\Temp\38e8b9\common\css\jquery-ui.csstext
MD5:1CE4EB3E5153F4C9B93A3CFDF3EF2E77
SHA256:95F4C300D84EEDD0C43A30A1B6F0DFBBF7B8C47725511981E4CFE12DFAEB0E93
940winzip24-downwz.exeC:\Users\admin\AppData\Local\Temp\38e8b9\common\img\button-normal.pngimage
MD5:7C7DBDEE45987EADA0D0DC0D126B4239
SHA256:0A649E9E86D9379792B44DC80D9C9C9A7F134DA4DA03F7B422C51CDCF7849A5C
940winzip24-downwz.exeC:\Users\admin\AppData\Local\Temp\38e8b9\common\img\arrow.pngimage
MD5:407F46749E54353D1EDA4E776A7AE505
SHA256:56F5FCC00CD244C8D7EEA8A03F627DB1DBC74CBF48553CCC0F10AB33FC09AA05
940winzip24-downwz.exeC:\Users\admin\AppData\Local\Temp\38e8b9\common\img\centerImg.pngimage
MD5:F1F71117A2C77649963C8B4CCF4B5CF8
SHA256:44C4E7A6E7293B855830F94496D7ADDC6916BFE62E36AC8142CDA1919745950E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
4
DNS requests
3
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
940
winzip24-downwz.exe
POST
200
18.236.15.144:80
http://i.installportal.com/v1/logUserActivity
US
xml
186 b
malicious
940
winzip24-downwz.exe
POST
200
18.236.15.144:80
http://i.installportal.com/v1/logUserActivity
US
xml
186 b
malicious
940
winzip24-downwz.exe
POST
200
18.236.15.144:80
http://i.installportal.com/v1/logAnalytics
US
xml
204 b
malicious
940
winzip24-downwz.exe
POST
200
54.68.21.135:80
http://www.installportal.com/v1/token
US
text
196 b
malicious
940
winzip24-downwz.exe
POST
200
54.68.21.135:80
http://www.installportal.com/v1/token
US
text
202 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
940
winzip24-downwz.exe
54.68.21.135:80
i.installportal.com
Amazon.com, Inc.
US
malicious
940
winzip24-downwz.exe
23.210.248.134:443
download.winzip.com
Akamai International B.V.
NL
whitelisted
940
winzip24-downwz.exe
18.236.15.144:80
i.installportal.com
—
US
malicious

DNS requests

Domain
IP
Reputation
i.installportal.com
  • 18.236.15.144
  • 54.68.21.135
unknown
www.installportal.com
  • 54.68.21.135
  • 18.236.15.144
unknown
download.winzip.com
  • 23.210.248.134
whitelisted

Threats

Found threats are available for the paid subscriptions
3 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
winzip24-downwz.exe