analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

setup_files.zip

Full analysis: https://app.any.run/tasks/b684d7ce-aba6-4eef-bbb3-20408d623538
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: August 08, 2020, 15:48:53
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
stealer
trojan
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

6F00D81FC0DA3E9E885845F254AF1962

SHA1:

196A4925CFEBA7147B4F9C44BA9095EE61C20893

SHA256:

C90F80BE1532C220CFEFA0AE87CCEB564820CC3E9545D9F23346671B985AD9D0

SSDEEP:

98304:tt8/l7G7b/TOyaoRsP3qFThav8TtfKGFDNqw85tDIZCJa:tt8/lC7b/TPaoCPKtrTtZ/q5jDIo0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • setup_install.exe (PID: 2408)
      • setup_install.exe (PID: 544)
      • load.exe (PID: 1840)
      • kronk.exe (PID: 1260)
      • ns4B2E.tmp (PID: 2640)

    • Changes settings of System certificates

      • CScript.exe (PID: 896)

    • Loads dropped or rewritten executable

      • setup_install.exe (PID: 544)

    • Stealing of credential data

      • kronk.exe (PID: 1260)

    • Actions looks like stealing of personal data

      • kronk.exe (PID: 1260)

  • SUSPICIOUS

    • Starts application with an unusual extension

      • setup_install.exe (PID: 544)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2816)
      • setup_install.exe (PID: 544)

    • Reads Internet Cache Settings

      • CScript.exe (PID: 896)
      • kronk.exe (PID: 1260)

    • Executes scripts

      • ns4B2E.tmp (PID: 2640)

    • Creates files in the program directory

      • setup_install.exe (PID: 544)

    • Adds / modifies Windows certificates

      • CScript.exe (PID: 896)

    • Reads the cookies of Google Chrome

      • kronk.exe (PID: 1260)

    • Reads the cookies of Mozilla Firefox

      • kronk.exe (PID: 1260)

    • Starts CMD.EXE for self-deleting

      • kronk.exe (PID: 1260)

    • Starts CMD.EXE for commands execution

      • kronk.exe (PID: 1260)

    • Searches for installed software

      • kronk.exe (PID: 1260)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xpi | Mozilla Firefox browser extension (66.6)
.zip | ZIP compressed archive (33.3)

EXIF

ZIP

ZipFileName: setup_install.exe
ZipUncompressedSize: 3982086
ZipCompressedSize: 3949177
ZipCRC: 0xbbf38bf8
ZipModifyDate: 2020:08:08 11:35:02
ZipCompression: Deflated
ZipBitFlag: 0x0001
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
49
Monitored processes
9
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start drop and start start drop and start drop and start drop and start winrar.exe setup_install.exe no specs setup_install.exe kronk.exe ns4b2e.tmp no specs cscript.exe load.exe cmd.exe no specs timeout.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2816"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\setup_files.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
2408"C:\Users\admin\AppData\Local\Temp\Rar$EXb2816.9585\setup_install.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb2816.9585\setup_install.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Version:
11.7.2.0
544"C:\Users\admin\AppData\Local\Temp\Rar$EXb2816.9585\setup_install.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb2816.9585\setup_install.exe
WinRAR.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
11.7.2.0
1260"C:\Program Files\Mongofils\exe\kronk.exe"C:\Program Files\Mongofils\exe\kronk.exe
setup_install.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
2640"C:\Users\admin\AppData\Local\Temp\nsm4ACF.tmp\ns4B2E.tmp" "C:\Windows\system32\CScript.exe" "C:\Program Files\Mongofils\exe\1.vbs" //e:vbscript //B //NOLOGO C:\Users\admin\AppData\Local\Temp\nsm4ACF.tmp\ns4B2E.tmp—setup_install.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
896"C:\Windows\system32\CScript.exe" "C:\Program Files\Mongofils\exe\1.vbs" //e:vbscript //B //NOLOGO C:\Windows\system32\CScript.exe
ns4B2E.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.8.7600.16385
1840"C:\Program Files\Mongofils\exe\load.exe"C:\Program Files\Mongofils\exe\load.exe
setup_install.exe
User:
admin
Integrity Level:
HIGH
464"C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\admin\AppData\Local\Temp\N4I0Z2ILXzE & timeout 2 & del /f /q "C:\Program Files\Mongofils\exe\kronk.exe"C:\Windows\system32\cmd.exe—kronk.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2172timeout 2 C:\Windows\system32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
timeout - pauses command processing
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
1 495
Read events
1 452
Write events
0
Delete events
0

Modification events

No data
Executable files
6
Suspicious files
6
Text files
292
Unknown types
10

Dropped files

PID
Process
Filename
Type
896CScript.exeC:\Users\admin\AppData\Local\Temp\Cab4F33.tmp —
MD5:—
SHA256:—
896CScript.exeC:\Users\admin\AppData\Local\Temp\Tar4F34.tmp —
MD5:—
SHA256:—
896CScript.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C954CE05407CAD0B91F1461CBC854DCEbinary
MD5:62A557EDE679FE2CFC570243DD79453F
SHA256:5F58ECB32F14614980488A6F0FCCB6C6BCE050E4F04E55CE2220BB49D659DB5C
896CScript.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08der
MD5:9E1EB3DDA03ED5B39D68CB26399E3C2E
SHA256:161399C3C4D0942A0AFE35D59B26D984D24C6E502253CDBDAECCDD9A0B53380E
544setup_install.exeC:\Users\admin\AppData\Local\Temp\nsm4ACF.tmp\ns4B2E.tmpexecutable
MD5:30D31B3424FF6B7613EAAF79E9449E0F
SHA256:8F0F0E254113725B386FF4C6C2967D556ED4D568245FC8AF6F2DBEA697BA56BF
896CScript.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08binary
MD5:49A3E3CDD03FE915F172B75AF1202AE0
SHA256:217F4A154BD79E7F58989729B1E0878FD6CADCF5796F4E695994E8994DD278BB
544setup_install.exeC:\Program Files\Mongofils\exe\1.vbstext
MD5:4341A7E0DA324D8C0722D811F164760B
SHA256:969E7A18B763841660D36DEDCC44C05E53E76BE0A1988A065F103C53DCD199B6
1260kronk.exeC:\Users\admin\AppData\Local\Temp\N4I0Z2ILXzE\nAGM.tmpsqlite
MD5:D93B1B100AD95D3B99082E51AB2743B5
SHA256:7BEECC65CF8C96E2D90F9D9E222AD9227057B26BD2AD0C81E417DD60C0B707C6
1260kronk.exeC:\Users\admin\AppData\Local\Temp\N4I0Z2ILXzE\Dty6yD.tmpsqlite
MD5:B07445123C1156C138DBB2C09CA56381
SHA256:60EF4EEFAE5E163D3C38BBBF592B70453BE8C17D95537C84438DCA3DB7B150F5
1260kronk.exeC:\Users\admin\AppData\Local\Temp\N4I0Z2ILXzE\files_\passwords.txttext
MD5:9B3A9805F6BA0DDB15D330EB1703D8A5
SHA256:8F971C84EEB068E76A6025DFFEA0E6DF3019C098E29ED3711A89E5ACC3064E94
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
5
DNS requests
6
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
896
CScript.exe
GET
200
2.16.186.11:80
http://ocsp.int-x3.letsencrypt.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBR%2B5mrncpqz%2FPiiIGRsFqEtYHEIXQQUqEpqYwR93brm0Tm3pkVl7%2FOo7KECEgObfHHgHlsa0R7fVL2Sj72S7g%3D%3D
unknown
der
527 b
whitelisted
896
CScript.exe
GET
200
2.16.186.35:80
http://isrg.trustid.ocsp.identrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D
unknown
der
1.37 Kb
whitelisted
1260
kronk.exe
POST
200
185.180.231.139:80
http://otteppp11.top/index.php
RU
text
2 b
malicious
1260
kronk.exe
POST
200
2.57.184.163:80
http://doorres03.top/index.php
unknown
text
3 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
896
CScript.exe
2.16.186.11:80
isrg.trustid.ocsp.identrust.com
Akamai International B.V.
—
whitelisted
896
CScript.exe
2.16.186.35:80
isrg.trustid.ocsp.identrust.com
Akamai International B.V.
—
whitelisted
896
CScript.exe
88.99.66.31:443
iplogger.org
Hetzner Online GmbH
DE
malicious
1260
kronk.exe
185.180.231.139:80
otteppp11.top
MediaServicePlus LLC
RU
malicious
1260
kronk.exe
2.57.184.163:80
otteppp11.top
—
—
malicious

DNS requests

Domain
IP
Reputation
iplogger.org
  • 88.99.66.31
shared
isrg.trustid.ocsp.identrust.com
  • 2.16.186.35
  • 2.16.186.11
whitelisted
ocsp.int-x3.letsencrypt.org
  • 2.16.186.11
  • 2.16.186.27
whitelisted
otteppp11.top
  • 185.180.231.139
  • 2.57.184.163
malicious
doorres03.top
  • 2.57.184.163
  • 185.180.231.139
malicious

Threats

PID
Process
Class
Message
896
CScript.exe
Potential Corporate Privacy Violation
POLICY [PTsecurity] IP Check Domain SSL certificate
896
CScript.exe
Potential Corporate Privacy Violation
POLICY [PTsecurity] IP Check Domain SSL certificate
—
—
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
1260
kronk.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.top domain
1260
kronk.exe
A Network Trojan was detected
ET TROJAN Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
9 ETPRO signatures available at the full report
Process
Message
kronk.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
load.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
setup_files.zip