analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

счет-фактура.zip

Full analysis: https://app.any.run/tasks/00392f48-c6ed-4623-a0d0-b009fa86d06d
Verdict: Malicious activity
Analysis date: May 15, 2019, 10:35:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

D4488E2DD94998DED85BB1EEBACC0F4D

SHA1:

C3494C300128E5F6BC8C9DFA422FB58E93C1BE30

SHA256:

CE4F79971942C98DEBDA949CDAEFBA7B9163D7327613041C263A193EAE060195

SSDEEP:

24576:rdgq0KKtPQSxXqwHWl1DG2UQaSPI4LjS8BA/A1E9On0xpk:rdg5KKtWyWlMnTDyKx6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Scan0011.exe (PID: 2836)
      • Scan0011.exe (PID: 1560)

    • Actions looks like stealing of personal data

      • RegSvcs.exe (PID: 3444)
      • RegSvcs.exe (PID: 2524)

  • SUSPICIOUS

    • Creates files in the user directory

      • OUTLOOK.EXE (PID: 3548)

    • Reads Windows Product ID

      • RegSvcs.exe (PID: 3444)
      • RegSvcs.exe (PID: 2524)

    • Reads Internet Cache Settings

      • OUTLOOK.EXE (PID: 3548)
      • RegSvcs.exe (PID: 3444)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3812)

    • Reads Environment values

      • RegSvcs.exe (PID: 3444)
      • RegSvcs.exe (PID: 2524)

  • INFO

    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 3548)

    • Reads settings of System Certificates

      • RegSvcs.exe (PID: 3444)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: ????-䠪????.msg
ZipUncompressedSize: 824832
ZipCompressedSize: 796945
ZipCRC: 0xf68178b6
ZipModifyDate: 2019:05:13 16:04:05
ZipCompression: Deflated
ZipBitFlag: 0x0003
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
48
Monitored processes
8
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs outlook.exe winrar.exe no specs scan0011.exe no specs regsvcs.exe winrar.exe scan0011.exe no specs regsvcs.exe

Process information

PID
CMD
Path
Indicators
Parent process
3324"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\счет-фактура.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3548"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\Desktop\ßtÑG-Sá¬Gpaá.msg"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Version:
14.0.6025.1000
3208"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Scan0011.gz"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
2836"C:\Users\admin\Desktop\Scan0011.exe" C:\Users\admin\Desktop\Scan0011.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3444"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Scan0011.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Services Installation Utility
Exit code:
4294967295
Version:
4.6.1055.0 built by: NETFXREL2
3812"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Scan0011.gz"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
1560"C:\Users\admin\Desktop\Scan0011.exe" C:\Users\admin\Desktop\Scan0011.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2524"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Scan0011.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Services Installation Utility
Version:
4.6.1055.0 built by: NETFXREL2
Total events
2 455
Read events
1 982
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
1
Text files
25
Unknown types
1

Dropped files

PID
Process
Filename
Type
3324WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3324.9511\ßtÑG-Sá¬Gpaá.msg —
MD5:—
SHA256:—
3548OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVRE4AB.tmp.cvr —
MD5:—
SHA256:—
3208WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3208.12114\Scan0011.exe —
MD5:—
SHA256:—
3548OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:C60805BB8020608E036C97B6707E54B2
SHA256:DE9324A15AB6ED8EB2E4150F853403038869B87731255E80A99B77E0DC76A9BC
3548OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\U23Y2EJC\Scan0011.gzcompressed
MD5:D6B829B0204973C4D3825E05DB185F87
SHA256:FEE605B543D29A2461385BA437A46E6629816443286CC734884A69FD0718E8E2
3548OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\StructuredQuery.logtext
MD5:56301E6FF9DD44BD8125ECA978295C21
SHA256:F77891A9CFB88E0570E7247A474E837871D49185DECF6661D06DA33A9720B3CD
3812WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3812.16078\Scan0011.exeexecutable
MD5:018E00AB26BE8077BEDE3BC63BFD7EE5
SHA256:7BB0F68A1F1238E1DA371ED35FFF7DD5BA16E8AA25158D47B90A64924AF38857
3548OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_AvailabilityOptions_2_7FE98631FF5A7C4FB002641B85801062.datxml
MD5:EEAA832C12F20DE6AAAA9C7B77626E72
SHA256:C4C9A90F2C961D9EE79CF08FBEE647ED7DE0202288E876C7BAAD00F4CA29CA16
3548OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_ConversationPrefs_2_967C211D9D92A649AF7535AEC187F6F4.datxml
MD5:57F30B1BCA811C2FCB81F4C13F6A927B
SHA256:612BAD93621991CB09C347FF01EC600B46617247D5C041311FF459E247D8C2D3
3548OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_Calendar_2_D10C0FFD9AE91543865AA695ABFAC904.datxml
MD5:B21ED3BD946332FF6EBC41A87776C6BB
SHA256:B1AAC4E817CD10670B785EF8E5523C4A883F44138E50486987DC73054A46F6F4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
3
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3548
OUTLOOK.EXE
GET
—
64.4.26.155:80
http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig
US
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3444
RegSvcs.exe
164.138.222.99:587
mail.trade345.com
SuperHosting.BG Ltd.
BG
suspicious
3548
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
Microsoft Corporation
US
whitelisted
2524
RegSvcs.exe
164.138.222.99:587
mail.trade345.com
SuperHosting.BG Ltd.
BG
suspicious

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
mail.trade345.com
  • 164.138.222.99
suspicious

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
счет-фактура.zip