analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

7-Zip.zip

Full analysis: https://app.any.run/tasks/309a605e-5961-4be2-aec1-c28bf2f80db1
Verdict: Malicious activity
Analysis date: July 18, 2019, 02:40:46
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

60EAB4909CEC35B2DA4DD083DF6AF6E6

SHA1:

EAFB46E4CAAC00AEB8DFF8465A12FDED4D52B6F5

SHA256:

CEAE1ACA80DE8DA382F0344EAA3F658883FEDA1150E2093085FAD47C4687E3C1

SSDEEP:

24576:FUQMdHKBEVdpavWFz20j7K6v8aS9hfaqVb4sT4JAquyFnlQiV4:FF4NavWFz20qS8T9hfxbVc+quHy4

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 292)

    • Application was dropped or rewritten from another process

      • 7zFMmgr.exe (PID: 2976)
      • 7zFM.exe (PID: 2376)

    • Writes to a start menu file

      • iexplore.exe (PID: 3832)

    • Changes the login/logoff helper path in the registry

      • iexplore.exe (PID: 3832)

  • SUSPICIOUS

    • Starts Internet Explorer

      • 7zFMmgr.exe (PID: 2976)

    • Executable content was dropped or overwritten

      • 7zFM.exe (PID: 2376)
      • iexplore.exe (PID: 3832)
      • WinRAR.exe (PID: 2752)

    • Creates files in the program directory

      • iexplore.exe (PID: 3832)

  • INFO

    • Creates files in the user directory

      • iexplore.exe (PID: 3832)

    • Manual execution by user

      • WinRAR.exe (PID: 2752)
      • 7zFM.exe (PID: 2376)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: 7zFM.exe
ZipUncompressedSize: 570389
ZipCompressedSize: 311952
ZipCRC: 0x1e66082b
ZipModifyDate: 2010:11:18 23:09:00
ZipCompression: Deflated
ZipBitFlag: 0x0009
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
6
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start winrar.exe no specs winrar.exe searchprotocolhost.exe no specs 7zfm.exe 7zfmmgr.exe no specs iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
3156"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\7-Zip.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
2752"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Desktop\7-Zip.zip" C:\Users\admin\Desktop\C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
292"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe6_ Global\UsGthrCtrlFltPipeMssGthrPipe6 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
2376"C:\Users\admin\Desktop\7zFM.exe" C:\Users\admin\Desktop\7zFM.exe
explorer.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
MEDIUM
Description:
7-Zip File Manager
Exit code:
0
Version:
9.20
2976C:\Users\admin\Desktop\7zFMmgr.exeC:\Users\admin\Desktop\7zFMmgr.exe—7zFM.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3832"C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe
7zFMmgr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Total events
426
Read events
364
Write events
0
Delete events
0

Modification events

No data
Executable files
6
Suspicious files
0
Text files
0
Unknown types
21

Dropped files

PID
Process
Filename
Type
29767zFMmgr.exeC:\Users\admin\AppData\Local\Temp\~TM37A5.tmp —
MD5:—
SHA256:—
29767zFMmgr.exeC:\Users\admin\AppData\Local\Temp\~TM37C5.tmp —
MD5:—
SHA256:—
3832iexplore.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat Reader DC\LeesMij.htmhtml
MD5:F2502CF07E3671FA025CDF3E3DAC1725
SHA256:E18C8B6445D2A8CD8AD49B198069316B35EE222209F546491E4F56381E55DA23
3832iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\enbfqohg.exeexecutable
MD5:303F491B9FC879064B210CB0B865D178
SHA256:15F7FB2EDC9B34E0DA2FC658DF38D8AEA52664F6BE1510DBA4636DC13F466F86
3832iexplore.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat Reader DC\IrakHau.htmhtml
MD5:942D68AED5E9205FED3157293341CBF0
SHA256:0E7924ABD1DCCD29ACC5E81F3577794045E483EA4A404D8E55B66687AF639B5C
3832iexplore.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat Reader DC\Leame.htmhtml
MD5:9F23285D5A3A2C0E6C5A094B57248DB7
SHA256:B91AFBC3B6EB5322D6D13309DFC7DD8F88125A66338BD93E6F0FA635E0789289
3832iexplore.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat Reader DC\Benioku.htmhtml
MD5:93EE125F265572448711C14136634E52
SHA256:E94958B1FDACE59FC1FE39C0D8DD1F86951CA2BF81E2AC7EDF435F846C76F341
23767zFM.exeC:\Users\admin\Desktop\7zFMmgr.exeexecutable
MD5:303F491B9FC879064B210CB0B865D178
SHA256:15F7FB2EDC9B34E0DA2FC658DF38D8AEA52664F6BE1510DBA4636DC13F466F86
3832iexplore.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat Reader DC\LeiaMe.htmhtml
MD5:8DC0A35F82AA02652E9CBC674215B8FF
SHA256:3078F6EEC05BF26C42525EF79E40EA994D65D5BE5FCE530629CC02C99AD2E139
2752WinRAR.exeC:\Users\admin\Desktop\7zFM.exeexecutable
MD5:E2B6C32D4ED3B253CA750B03B55ACAD1
SHA256:A0B92392ADE4AD7218239AC6A3E96EC6A626B71C187960CD077C92DC34D2330D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
11
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
172.217.21.238:80
google.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.21.238
whitelisted
stromoliks.com
  • —
malicious
promoliks.com
  • —
malicious

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
7-Zip.zip