analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

blackbox.zip

Full analysis: https://app.any.run/tasks/68ae6fed-4a0c-43ca-8797-70e218dffb5f
Verdict: Malicious activity
Analysis date: July 18, 2019, 02:00:40
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

D1A9A0266C96F7E7030359F8F844D46E

SHA1:

80328D4FF58145E934EF02788682770218AA4449

SHA256:

CFB1B2E554A5A65D71BFFCA9B0EA5D1A9E73D2C7ADE3937A8F5A912B6F13C4F6

SSDEEP:

98304:62txuClZyfdEYJjSvHDU8FJrjLEUf/74DmWOJwIjGHWxXLipVqQDyIMdXi/vJbF:6auSZL6W/g8XHLzTk80HACyIM9qvJ5

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • blackbox.exe (PID: 2772)

    • Loads dropped or rewritten executable

      • blackbox.exe (PID: 2772)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2168)
      • blackbox.exe (PID: 2772)

    • Reads CPU info

      • blackbox.exe (PID: 2772)

    • Reads the BIOS version

      • blackbox.exe (PID: 2772)

    • Creates files in the user directory

      • blackbox.exe (PID: 2772)

    • Reads the machine GUID from the registry

      • blackbox.exe (PID: 2772)

    • Reads Internet Cache Settings

      • blackbox.exe (PID: 2772)

  • INFO

    • Manual execution by user

      • blackbox.exe (PID: 2772)
      • WinRAR.exe (PID: 2168)
      • NOTEPAD.EXE (PID: 2548)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: Blackbox.txt
ZipUncompressedSize: 47
ZipCompressedSize: 47
ZipCRC: 0x22d7ecd1
ZipModifyDate: 2019:07:17 22:59:00
ZipCompression: Deflated
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs winrar.exe blackbox.exe notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
116"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\blackbox.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
2168"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Desktop\blackbox.zip" "?\"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
2772"C:\Users\admin\Desktop\blackbox\blackbox.exe" C:\Users\admin\Desktop\blackbox\blackbox.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
blackbox
Version:
0.1.0.0
2548"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\blackbox\Blackbox.txtC:\Windows\system32\NOTEPAD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
564
Read events
507
Write events
57
Delete events
0

Modification events

(PID) Process:—Key:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:—Key:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:—Key:HKEY_CLASSES_ROOT\Local Settings\MuiCache\70\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:—Key:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\blackbox.zip
(PID) Process:—Key:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:—Key:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:—Key:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:—Key:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:—Key:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
(PID) Process:—Key:HKEY_CURRENT_USER\Software\WinRAR\General
Operation:writeName:LastFolder
Value:
C:\Users\admin\Desktop
Executable files
5
Suspicious files
0
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
2772blackbox.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@blackbox[1].txt —
MD5:—
SHA256:—
2168WinRAR.exeC:\Users\admin\Desktop\blackbox\Blackbox.txttext
MD5:D7BC39438A044C0100591AFC3974774B
SHA256:5B545312CF8BAB8E174ADDABAFA1E33B604E5345E6CCB516A5D216AD8CAC9AE5
2772blackbox.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@blackbox[2].txttext
MD5:99306DA09228FFC3A9E3EB6D5A9EBF5A
SHA256:D5AC80552D20848075322BEC1DF6055FC63AE7F98D7885FBFF01DB95B21C14B3
2772blackbox.exeC:\Users\admin\AppData\Roaming\BlackBox Anticheat\login.initext
MD5:F5F5CAC3A67D7D04F7296A9460ED787F
SHA256:742F0105AD12DE061B2964A1109E8E3D4AE55B60B83E3EB850DCF298DD5B5506
2772blackbox.exeC:\Users\admin\AppData\Local\Temp\tmp69D2.tmpexecutable
MD5:86FEDF3C7B32B121AA72E171185699D5
SHA256:DD35DBA9AFB836F14306A31A90C712680DC901110BC5C5C29D38E30FD70C8B97
2772blackbox.exeC:\Users\admin\AppData\Local\Temp\tmp69D1.tmpexecutable
MD5:75848ACD43300F5C5BC6E84192C9D9E3
SHA256:ADA441770C67DBD9CC3FDC87BF00C354939F35BCA7696982327E1BC8457E7271
2168WinRAR.exeC:\Users\admin\Desktop\blackbox\blackbox.exeexecutable
MD5:A3B45CA464654717CC3C7D1046FB6165
SHA256:6F28A3B3B193AB0A3D94C3F0E7FB845988F2D01AA7BF29256B124BBAE867D6C4
2772blackbox.exeC:\Users\admin\AppData\Local\Temp\bbossl102q-944593\ssleay32.dllexecutable
MD5:284E004B654306F8DB1A63CFF0E73D91
SHA256:2D11228520402EF49443AADC5D0F02C9544A795A4AFC89FB0434B3B81EBDD28C
2772blackbox.exeC:\Users\admin\AppData\Local\Temp\bbossl102q-944593\libeay32.dllexecutable
MD5:DE484D5DAFE3C1208DA6E24AF40E0A97
SHA256:007342C6B9B956F416F556B4BD6F1077E25BD077CC4F4AC136E3FCCB803746E3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
5
DNS requests
3
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2772
blackbox.exe
POST
200
188.166.87.218:80
http://direct.blackbox.ac/backend
NL
binary
132 b
unknown
2772
blackbox.exe
GET
200
188.166.87.218:80
http://direct.blackbox.ac/update
NL
text
70 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2772
blackbox.exe
46.137.171.101:10000
data.logentries.com
Amazon.com, Inc.
IE
unknown
2772
blackbox.exe
188.166.87.218:80
direct.blackbox.ac
Digital Ocean, Inc.
NL
unknown
2772
blackbox.exe
104.27.156.50:443
blackbox.ac
Cloudflare Inc
US
shared

DNS requests

Domain
IP
Reputation
direct.blackbox.ac
  • 188.166.87.218
unknown
blackbox.ac
  • 104.27.156.50
  • 104.27.157.50
whitelisted
data.logentries.com
  • 46.137.171.101
  • 54.228.220.150
  • 34.253.108.119
  • 52.50.116.161
  • 46.137.78.79
  • 52.51.253.140
  • 54.217.225.23
  • 79.125.113.75
  • 54.246.89.117
  • 52.208.251.8
  • 52.210.85.8
  • 52.208.49.107
  • 52.50.115.228
  • 34.253.67.177
  • 52.51.161.239
  • 46.137.172.15
  • 46.137.172.57
  • 54.217.226.18
  • 46.51.172.0
  • 34.250.92.47
  • 54.217.226.8
  • 54.247.179.233
  • 54.77.214.200
  • 34.249.60.159
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
blackbox.zip