analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Virtualization.zip

Full analysis: https://app.any.run/tasks/1f2dbf0e-a23d-4b7c-863b-1e98a5f56506
Verdict: Malicious activity
Analysis date: August 25, 2019, 09:32:42
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

78507E24FBC31B35ED6AE858C5970664

SHA1:

03DD50912DBB5AD52DF8B941BC6357B95C3B8C06

SHA256:

CE6C62A49B35A7CB7CA10A9B21F551EFF352DE58FF91C00144A9CA5D7F73BADE

SSDEEP:

98304:X8xMTR80VN8Echf73vuF9/r1OyZrHyyb+z+k4cdClh9qlKtk:sESG8EchfD8VgCrHyyK+k7dCz9ql2k

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Virtual-Service.exe (PID: 3296)
      • setup.exe (PID: 1920)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • Virtual-Service.exe (PID: 3296)

    • Starts SC.EXE for service management

      • setup.exe (PID: 1920)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3560)

  • INFO

    • Manual execution by user

      • Virtual-Service.exe (PID: 3296)
      • taskmgr.exe (PID: 2608)
      • setup.exe (PID: 1920)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: Virtualization/
ZipUncompressedSize: -
ZipCompressedSize: -
ZipCRC: 0x00000000
ZipModifyDate: 2019:08:18 16:24:28
ZipCompression: None
ZipBitFlag: -
ZipRequiredVersion: 10
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
8
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe virtual-service.exe cmd.exe no specs setup.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs taskmgr.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3560"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Virtualization.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3296"C:\Users\admin\Desktop\Virtualization\Virtual-Service.exe" C:\Users\admin\Desktop\Virtualization\Virtual-Service.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1063
2192C:\Windows\system32\cmd.exe /c start C:\Virtualization\Virtualization.exeC:\Windows\system32\cmd.exe—Virtual-Service.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1920"C:\Users\admin\Desktop\Virtualization\setup.exe" C:\Users\admin\Desktop\Virtualization\setup.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3208sc.exe create "Virtual Service" binPath= "C:\Virtualization\Virtual-Service.exe" start= auto C:\Windows\system32\sc.exe—setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
A tool to aid in developing services for WindowsNT
Exit code:
5
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2296sc.exe start "Virtual Service"C:\Windows\system32\sc.exe—setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
A tool to aid in developing services for WindowsNT
Exit code:
1060
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2908sc.exe description "Virtual Service" "Windows Client for Virtualization." C:\Windows\system32\sc.exe—setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
A tool to aid in developing services for WindowsNT
Exit code:
1060
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2608"C:\Windows\system32\taskmgr.exe" C:\Windows\system32\taskmgr.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Task Manager
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
437
Read events
429
Write events
8
Delete events
0

Modification events

(PID) Process:(3560) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3560) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3560) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\72\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3560) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Virtualization.zip
(PID) Process:(3560) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3560) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3560) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3560) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
4
Suspicious files
7
Text files
12
Unknown types
4

Dropped files

PID
Process
Filename
Type
3560WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3560.9612\Virtualization\setup.pdb —
MD5:—
SHA256:—
3560WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3560.9612\Virtualization\start.pdb —
MD5:—
SHA256:—
3560WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3560.9612\Virtualization\SampleService.logtext
MD5:FE1A35794E69416FFFB0253697CB4002
SHA256:B7EC31CAEA33AB1D5260AC8EA1E5022995C1D34D8E7506FB59BEAD6920551CF9
3560WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3560.9612\Virtualization\Virtual-Service.tlog\CL.command.1.tlogtext
MD5:9F5567BD55D247942F6C2A5019DE9D63
SHA256:ADCB87DFB181A583D49C6AF739D454EF86674BD7FDFF1106DDABCF4198ABAE90
3560WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3560.9612\Virtualization\start.exeexecutable
MD5:3C9F48117AC145DA4C3185462F435644
SHA256:5ACF1BF6A474135F076EF16479D3972B68CF5505FA19E04D8A4993E2B10E7F57
3560WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3560.9612\Virtualization\Virtual-Service.iobjbinary
MD5:D0A582DE033D603F2574BE2478066B48
SHA256:A50065BFB93E68A9DE8BA3E0F8233AE68BDA7FFC88358A7D03A1C4AD20C844A7
3560WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3560.9612\Virtualization\Virtual-Service.tlog\CL.write.1.tlogtext
MD5:0C12906F5C55C6470A82C8DB6D20D6F8
SHA256:283AFA3BB8D2530878FAEF3F98068C4752CF4CDB54019CAE26A67E252C3EBAAF
3560WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3560.9612\Virtualization\Virtual-Service.pdbpdb
MD5:A66266D0550697B56D8A61476BFEBF9C
SHA256:5AFE1809BBBA77F6430ECB8518CFD35E9FD65783EB5E435E40BCD8DC56B1C00F
3560WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3560.9612\Virtualization\config.txttext
MD5:015C03D051C20C62E34DBC3F647CFF6B
SHA256:623E0079C3C66167A43FACD5CC80348CF244443BE3A6636F3DF86C9D3CDA183E
3560WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3560.9612\Virtualization\Virtual-Service.exeexecutable
MD5:6216755D093A67139BB42C1146940057
SHA256:480E3C882FF749D2C31C182B1A26D5936F836994D00CA5CC640873B7D11AAE16
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
Process
Message
Virtual-Service.exe
Virtual Service: Main: Entry
Virtual-Service.exe
Virtual Service: Main: StartServiceCtrlDispatcher returned error
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Virtualization.zip