analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

ee947b7f12b3d58f07df70640d1f8a3d75874cc04ac207f740d1a33031d54003.bin.gz

Full analysis: https://app.any.run/tasks/205351f1-ecc3-4a9a-8636-18c2e49039ef
Verdict: Malicious activity
Analysis date: July 17, 2019, 09:31:39
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/gzip
File info: gzip compressed data, max compression, from Unix
MD5:

160A83C561A5E893D55122993678FC72

SHA1:

E9C61D00C7BF4E51B074873F6DA7B356E4D5FE2C

SHA256:

C80D5DA53E8DD0022B44B735F0C09BE5E624B991621A39236A84F333DC70F300

SSDEEP:

49152:GWufxo7Fn/RYgGr3Dd+Cm0qoahNYixEjk+E:GWu5WF/0bENYixqVE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • ee947b7f12b3d58f07df70640d1f8a3d75874cc04ac207f740d1a33031d54003.bin.exe (PID: 2888)
      • SearchProtocolHost.exe (PID: 2576)

    • Application was dropped or rewritten from another process

      • ee947b7f12b3d58f07df70640d1f8a3d75874cc04ac207f740d1a33031d54003.bin.exe (PID: 2684)
      • ee947b7f12b3d58f07df70640d1f8a3d75874cc04ac207f740d1a33031d54003.bin.exe (PID: 2888)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • ee947b7f12b3d58f07df70640d1f8a3d75874cc04ac207f740d1a33031d54003.bin.exe (PID: 2888)

  • INFO

    • Manual execution by user

      • ee947b7f12b3d58f07df70640d1f8a3d75874cc04ac207f740d1a33031d54003.bin.exe (PID: 2684)
      • ee947b7f12b3d58f07df70640d1f8a3d75874cc04ac207f740d1a33031d54003.bin.exe (PID: 2888)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.z/gz/gzip | GZipped data (100)

EXIF

ZIP

OperatingSystem: Unix
ExtraFlags: Maximum Compression
ModifyDate: 0000:00:00 00:00:00
Flags: (none)
Compression: Deflated
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
46
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs ee947b7f12b3d58f07df70640d1f8a3d75874cc04ac207f740d1a33031d54003.bin.exe no specs ee947b7f12b3d58f07df70640d1f8a3d75874cc04ac207f740d1a33031d54003.bin.exe searchprotocolhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3088"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\ee947b7f12b3d58f07df70640d1f8a3d75874cc04ac207f740d1a33031d54003.bin.gz.z"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
2684"C:\Users\admin\Desktop\ee947b7f12b3d58f07df70640d1f8a3d75874cc04ac207f740d1a33031d54003.bin.exe" C:\Users\admin\Desktop\ee947b7f12b3d58f07df70640d1f8a3d75874cc04ac207f740d1a33031d54003.bin.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Version:
1.0.0.0
2888"C:\Users\admin\Desktop\ee947b7f12b3d58f07df70640d1f8a3d75874cc04ac207f740d1a33031d54003.bin.exe" C:\Users\admin\Desktop\ee947b7f12b3d58f07df70640d1f8a3d75874cc04ac207f740d1a33031d54003.bin.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Version:
1.0.0.0
2576"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe8_ Global\UsGthrCtrlFltPipeMssGthrPipe8 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\system32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
Total events
406
Read events
398
Write events
8
Delete events
0

Modification events

(PID) Process:(3088) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3088) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3088) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\70\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3088) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\ee947b7f12b3d58f07df70640d1f8a3d75874cc04ac207f740d1a33031d54003.bin.gz.z
(PID) Process:(3088) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3088) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3088) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3088) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
7
Suspicious files
2
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
3088WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3088.43591\ee947b7f12b3d58f07df70640d1f8a3d75874cc04ac207f740d1a33031d54003.bin.gz —
MD5:—
SHA256:—
2888ee947b7f12b3d58f07df70640d1f8a3d75874cc04ac207f740d1a33031d54003.bin.exeC:\Users\admin\AppData\Local\Temp\DevID\tools\infinst.x64.exeexecutable
MD5:E98B260E1B6063FDFE4F6CB749EE48C4
SHA256:561E9CDF1609C13023DD3007CB0658F5C3CCF1C9BF1FFD67B4E943D80B6DBC09
2888ee947b7f12b3d58f07df70640d1f8a3d75874cc04ac207f740d1a33031d54003.bin.exeC:\Users\admin\AppData\Local\Temp\DevID\tools.7zcompressed
MD5:231EA994A841D5FAF98F4F30FE831864
SHA256:1FD549AAC9192066B5EB33F8BC2358D8B67849060BCC393745F164553C2E2FF4
2888ee947b7f12b3d58f07df70640d1f8a3d75874cc04ac207f740d1a33031d54003.bin.exeC:\Users\admin\AppData\Local\Temp\DevID\tools\infinst.exeexecutable
MD5:564B69B9DCEB878BE75E5C71920085AF
SHA256:215A1778D06B0820D06163343E6D41F56E317F39515768B95ACB15410F74B044
2888ee947b7f12b3d58f07df70640d1f8a3d75874cc04ac207f740d1a33031d54003.bin.exeC:\Users\admin\AppData\Local\Temp\DevID\data.7zcompressed
MD5:662D9CBD47F0FC7F222B68F527C59B62
SHA256:8EC09DE37CF694104595C1C5ABA354E0C0F53F8E02F5CEA630E94E3B72073BA4
2888ee947b7f12b3d58f07df70640d1f8a3d75874cc04ac207f740d1a33031d54003.bin.exeC:\Users\admin\AppData\Local\Temp\DevID\tools\winxp\x86\devcon.exeexecutable
MD5:C4B470269324517EE838789C7CF5E606
SHA256:5F9B898315AD8192E87E21A499FD87D31B886513BB39D368476174AAA89A2BF9
2888ee947b7f12b3d58f07df70640d1f8a3d75874cc04ac207f740d1a33031d54003.bin.exeC:\Users\admin\Desktop\7z.dllexecutable
MD5:CA41D56630191E61565A343C59695CA1
SHA256:6C80E3F49FCF561E6A0B52F9B4C81D1D07B22085F7864EE4CFD30DD10F6B3B12
2888ee947b7f12b3d58f07df70640d1f8a3d75874cc04ac207f740d1a33031d54003.bin.exeC:\Users\admin\AppData\Local\Temp\DevID\tools\winxp\x64\devcon.exeexecutable
MD5:3904D0698962E09DA946046020CBCB17
SHA256:A51E25ACC489948B31B1384E1DC29518D19B421D6BC0CED90587128899275289
2888ee947b7f12b3d58f07df70640d1f8a3d75874cc04ac207f740d1a33031d54003.bin.exeC:\Users\admin\AppData\Local\Temp\DevID\tools\win7-10\x86\devcon.exeexecutable
MD5:B141565B508C89FE8DC30B009EC2EFDA
SHA256:B6736028D4957A1DC385A3BE3C59F2578CF4F5E57E6976EE6EE705E407AB811F
2888ee947b7f12b3d58f07df70640d1f8a3d75874cc04ac207f740d1a33031d54003.bin.exeC:\Users\admin\AppData\Local\Temp\DevID\tools\win7-10\x64\devcon.exeexecutable
MD5:530DEDEFF00322BE5F5A0FBF341DB2CA
SHA256:97CFF42F8C0FE4FBDF991273159516BF78090625A933C3983EBD6F62284E329A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
ee947b7f12b3d58f07df70640d1f8a3d75874cc04ac207f740d1a33031d54003.bin.gz