File name:

mass exe 1.4.0.0 [last version].zip

Full analysis: https://app.any.run/tasks/c7039ca9-4de1-4235-851e-8841cc4f6861
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Malware Trends Tracker     >>>
Analysis date: November 04, 2018, 01:36:11
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
opendir
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

8BBE71890DC2A878C92F08B88FE4F9F8

SHA1:

0B0D555FC7B298FA6FED4F7EC326B46D2C172E0E

SHA256:

C8B7CF2A985FE720D66E985375C578EFDCE3498CA340BAF582BEA0721A2B33D2

SSDEEP:

12288:cAQnPyLZdddjqMiKuuK7WHAieWY90YxVr0BgaLSrCiJynDJE69jIJRWg9PwFOm7d:cAQPyLZ5FvFHj60YwyyDJy/wR7d

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Massscan_GUI.exe (PID: 312)
      • masscan.exe (PID: 4056)
      • masscan.exe (PID: 3896)
      • WinPcap_4_1_3.exe (PID: 504)
      • WinPcap_4_1_3.exe (PID: 128)
      • masscan.exe (PID: 1600)
      • masscan.exe (PID: 2780)
      • masscan.exe (PID: 1620)

    • Loads dropped or rewritten executable

      • masscan.exe (PID: 4056)
      • masscan.exe (PID: 3896)
      • SearchProtocolHost.exe (PID: 716)
      • masscan.exe (PID: 2780)
      • WinPcap_4_1_3.exe (PID: 504)
      • masscan.exe (PID: 1600)
      • masscan.exe (PID: 1620)

    • Starts NET.EXE for service management

      • WinPcap_4_1_3.exe (PID: 504)

  • SUSPICIOUS

    • Starts Internet Explorer

      • Massscan_GUI.exe (PID: 312)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3112)
      • iexplore.exe (PID: 2344)
      • iexplore.exe (PID: 2796)
      • WinPcap_4_1_3.exe (PID: 504)

    • Creates files in the Windows directory

      • WinPcap_4_1_3.exe (PID: 504)

    • Creates or modifies windows services

      • WinPcap_4_1_3.exe (PID: 504)

    • Creates a software uninstall entry

      • WinPcap_4_1_3.exe (PID: 504)

    • Creates files in the program directory

      • WinPcap_4_1_3.exe (PID: 504)

    • Creates files in the driver directory

      • WinPcap_4_1_3.exe (PID: 504)

  • INFO

    • Creates files in the user directory

      • iexplore.exe (PID: 2344)
      • iexplore.exe (PID: 2796)
      • FlashUtil32_26_0_0_131_ActiveX.exe (PID: 3996)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2344)
      • iexplore.exe (PID: 2796)

    • Changes internet zones settings

      • iexplore.exe (PID: 2796)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2344)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2796)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2012:08:17 10:38:22
ZipCRC: 0x4623cd62
ZipCompressedSize: 413574
ZipUncompressedSize: 773968
ZipFileName: msvcr100.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
58
Monitored processes
15
Malicious processes
4
Suspicious processes
5

Behavior graph

Click at the process to see the details
start drop and start drop and start winrar.exe searchprotocolhost.exe no specs massscan_gui.exe masscan.exe no specs masscan.exe no specs iexplore.exe iexplore.exe flashutil32_26_0_0_131_activex.exe no specs winpcap_4_1_3.exe no specs winpcap_4_1_3.exe net.exe no specs net1.exe no specs masscan.exe no specs masscan.exe no specs masscan.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
128"C:\Users\admin\Desktop\WinPcap_4_1_3.exe" C:\Users\admin\Desktop\WinPcap_4_1_3.exe—iexplore.exe
User:
admin
Company:
Riverbed Technology, Inc.
Integrity Level:
MEDIUM
Description:
WinPcap 4.1.3 installer
Exit code:
3221226540
Version:
4.1.0.2980
Modules
Images
c:\users\admin\desktop\winpcap_4_1_3.exe
c:\systemroot\system32\ntdll.dll
312"C:\Users\admin\Desktop\mass exe 1.4.0.0 [last version]\Massscan_GUI.exe" C:\Users\admin\Desktop\mass exe 1.4.0.0 [last version]\Massscan_GUI.exe
explorer.exe
User:
admin
Company:
1047@exploit.im
Integrity Level:
MEDIUM
Description:
Masscan_GUI
Exit code:
0
Version:
1.4.0.0
Modules
Images
c:\users\admin\desktop\mass exe 1.4.0.0 [last version]\massscan_gui.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
504"C:\Users\admin\Desktop\WinPcap_4_1_3.exe" C:\Users\admin\Desktop\WinPcap_4_1_3.exe
iexplore.exe
User:
admin
Company:
Riverbed Technology, Inc.
Integrity Level:
HIGH
Description:
WinPcap 4.1.3 installer
Exit code:
0
Version:
4.1.0.2980
Modules
Images
c:\users\admin\desktop\winpcap_4_1_3.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
716"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe14_ Global\UsGthrCtrlFltPipeMssGthrPipe14 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1228C:\Windows\system32\net1 start npfC:\Windows\system32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\net1.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dsrole.dll
c:\windows\system32\netutils.dll
1600"C:\Users\admin\Desktop\mass exe 1.4.0.0 [last version]\masscan.exe" --resume paused.confC:\Users\admin\Desktop\mass exe 1.4.0.0 [last version]\masscan.exe—Massscan_GUI.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\users\admin\desktop\mass exe 1.4.0.0 [last version]\masscan.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\desktop\mass exe 1.4.0.0 [last version]\msvcr100.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\iphlpapi.dll
1620"C:\Users\admin\Desktop\mass exe 1.4.0.0 [last version]\masscan.exe" -iL Input.txt -oL Output.txt --open --rate 50000 -p80 --exclude 255.255.255.255 -vv --banners --open-onlyC:\Users\admin\Desktop\mass exe 1.4.0.0 [last version]\masscan.exe—Massscan_GUI.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\mass exe 1.4.0.0 [last version]\masscan.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\desktop\mass exe 1.4.0.0 [last version]\msvcr100.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\iphlpapi.dll
2344"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2796 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2780"C:\Users\admin\Desktop\mass exe 1.4.0.0 [last version]\masscan.exe" -iL Input.txt -oL Output.txt --open --rate 50000 -p80 --exclude 255.255.255.255 --open-onlyC:\Users\admin\Desktop\mass exe 1.4.0.0 [last version]\masscan.exe—Massscan_GUI.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
4294967295
Modules
Images
c:\users\admin\desktop\mass exe 1.4.0.0 [last version]\masscan.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\desktop\mass exe 1.4.0.0 [last version]\msvcr100.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\iphlpapi.dll
2796"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
Massscan_GUI.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
2 175
Read events
1 978
Write events
191
Delete events
6

Modification events

(PID) Process:(3112) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3112) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3112) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3112) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\mass exe 1.4.0.0 [last version].zip
(PID) Process:(3112) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3112) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3112) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3112) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3112) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\DialogEditHistory\ExtrPath
Operation:writeName:0
Value:
C:\Users\admin\Desktop\mass exe 1.4.0.0 [last version]
(PID) Process:(716) SearchProtocolHost.exeKey:HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\5F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
18
Suspicious files
5
Text files
72
Unknown types
4

Dropped files

PID
Process
Filename
Type
2796iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\favicon[1].ico —
MD5:—
SHA256:—
2796iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
2344iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\install[1].txt —
MD5:—
SHA256:—
312Massscan_GUI.exeC:\Users\admin\Desktop\mass exe 1.4.0.0 [last version]\Input.txttext
MD5:—
SHA256:—
2344iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\superfish+hoverintent[1].jstext
MD5:—
SHA256:—
2344iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PP6KS563\superfish[1].csstext
MD5:—
SHA256:—
2344iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\install[1].htmhtml
MD5:—
SHA256:—
2344iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@winpcap[1].txttext
MD5:—
SHA256:—
3112WinRAR.exeC:\Users\admin\Desktop\mass exe 1.4.0.0 [last version]\msvcr100.dllexecutable
MD5:0E37FBFA79D349D672456923EC5FBBE3
SHA256:8793353461826FBD48F25EA8B835BE204B758CE7510DB2AF631B28850355BD18
2344iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BWPPCY0O\base_style[1].csstext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
230
DNS requests
6
Threats
22

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
312
Massscan_GUI.exe
GET
200
192.241.240.22:80
http://www.ipdeny.com/ipblocks/data/countries/as.zone
US
text
50 b
suspicious
312
Massscan_GUI.exe
GET
200
192.241.240.22:80
http://www.ipdeny.com/ipblocks/
US
html
57.0 Kb
suspicious
312
Massscan_GUI.exe
GET
200
192.241.240.22:80
http://www.ipdeny.com/ipblocks/data/countries/au.zone
US
text
117 Kb
suspicious
2344
iexplore.exe
GET
302
216.58.215.228:80
http://www.google.com/cse/brand?form=cse-search-box&lang=en
US
html
261 b
malicious
2796
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
152.91.198.68:80
—
Verizon Australia PTY Limited
AU
unknown
312
Massscan_GUI.exe
192.241.240.22:80
www.ipdeny.com
Digital Ocean, Inc.
US
malicious
2796
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
2344
iexplore.exe
104.25.218.21:443
www.winpcap.org
Cloudflare Inc
US
shared
2344
iexplore.exe
216.58.215.228:80
www.google.com
Google Inc.
US
whitelisted
2344
iexplore.exe
172.217.168.78:443
cse.google.com
Google Inc.
US
whitelisted
2796
iexplore.exe
104.25.218.21:443
www.winpcap.org
Cloudflare Inc
US
shared
—
—
101.112.4.208:80
—
Vodafone Australia Pty Ltd
AU
unknown
—
—
155.71.223.226:80
—
—
AU
suspicious
—
—
149.167.56.134:80
—
TELCOINABOX PTY LTD
AU
unknown

DNS requests

Domain
IP
Reputation
www.ipdeny.com
  • 192.241.240.22
suspicious
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
www.winpcap.org
  • 104.25.218.21
  • 104.25.219.21
unknown
www.google.com
  • 216.58.215.228
malicious
cse.google.com
  • 172.217.168.78
whitelisted
ssl.google-analytics.com
  • 172.217.168.8
whitelisted

Threats

PID
Process
Class
Message
312
Massscan_GUI.exe
A Network Trojan was detected
SC TROJAN_DOWNLOADER MSOffice VBA Trojan-Downloader Generic
312
Massscan_GUI.exe
A Network Trojan was detected
SC TROJAN_DOWNLOADER Generic Trojan Emotet downloader
—
—
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 11
—
—
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 11
—
—
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 11
—
—
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 9
—
—
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 11
—
—
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 11
—
—
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 11
—
—
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 14
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
mass exe 1.4.0.0 [last version].zip