File name:

7z2404.exe

Full analysis: https://app.any.run/tasks/de525967-aacf-43fb-aafb-023c82304dd3
Verdict: Malicious activity
Analysis date: May 05, 2024, 04:44:59
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

3E738D0862A9DCC6CA3DEBFF8F0EFEC5

SHA1:

A366FC70EBB36EAAB0112EBE26DAD3499E36B0C7

SHA256:

D0C8FBF5D726E41D85E51559234B5B3945522E84208DF5239ED25F02EF63EFF3

SSDEEP:

49152:EqOHwb4UZGgWIXx5H/YMas0VVYqL1u5akFEALvTMd3oMcWim73gm1AJ+Q7kPskdz:Eqf4UcRIrH//2VfZu5akGALLMd3ojwL/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • 7z2404.exe (PID: 4080)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 7z2404.exe (PID: 4080)

    • Creates/Modifies COM task schedule object

      • 7z2404.exe (PID: 4080)

    • Drops 7-zip archiver for unpacking

      • 7z2404.exe (PID: 4080)

    • Creates a software uninstall entry

      • 7z2404.exe (PID: 4080)

    • Creates file in the systems drive root

      • 7zFM.exe (PID: 748)
      • 7zG.exe (PID: 2036)
      • 7zG.exe (PID: 372)

  • INFO

    • Checks supported languages

      • 7z2404.exe (PID: 4080)
      • 7zFM.exe (PID: 748)
      • 7zG.exe (PID: 2036)
      • 7zG.exe (PID: 372)

    • Manual execution by a user

      • 7zFM.exe (PID: 748)

    • Creates files in the program directory

      • 7z2404.exe (PID: 4080)

    • Reads the computer name

      • 7zFM.exe (PID: 748)
      • 7z2404.exe (PID: 4080)
      • 7zG.exe (PID: 2036)
      • 7zG.exe (PID: 372)

    • Creates files or folders in the user directory

      • 7zG.exe (PID: 2036)

    • Reads Microsoft Office registry keys

      • 7zG.exe (PID: 372)

    • Reads the machine GUID from the registry

      • 7zG.exe (PID: 372)

    • Reads Environment values

      • 7zG.exe (PID: 372)

    • Create files in a temporary directory

      • 7zG.exe (PID: 372)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:04:05 08:00:00+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26112
InitializedDataSize: 24064
UninitializedDataSize: -
EntryPoint: 0x7144
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 24.4.0.0
ProductVersionNumber: 24.4.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Igor Pavlov
FileDescription: 7-Zip Installer
FileVersion: 24.04
InternalName: 7zipInstall
LegalCopyright: Copyright (c) 1999-2024 Igor Pavlov
OriginalFileName: 7zipInstall.exe
ProductName: 7-Zip
ProductVersion: 24.04
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
6
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 7z2404.exe 7zfm.exe no specs 7zg.exe no specs 7zg.exe no specs outlook.exe no specs 7z2404.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
372"C:\Program Files\7-Zip\7zG.exe" a -i#7zMap6563:126:7zEvent22243 -seml. -ad -saa -- "C"C:\Program Files\7-Zip\7zG.exe—7zFM.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
MEDIUM
Description:
7-Zip GUI
Exit code:
1
Version:
24.04
Modules
Images
c:\program files\7-zip\7zg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
748"C:\Program Files\7-Zip\7zFM.exe" C:\Program Files\7-Zip\7zFM.exe—explorer.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
MEDIUM
Description:
7-Zip File Manager
Version:
24.04
Modules
Images
c:\program files\7-zip\7zfm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2036"C:\Program Files\7-Zip\7zG.exe" a -i#7zMap30923:126:7zEvent24035 -t7z -sae -- "C:\C.7z"C:\Program Files\7-Zip\7zG.exe—7zFM.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
MEDIUM
Description:
7-Zip GUI
Exit code:
1
Version:
24.04
Modules
Images
c:\program files\7-zip\7zg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2312C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE -EmbeddingC:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Version:
14.0.6025.1000
Modules
Images
c:\program files\microsoft office\office14\outlook.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3976"C:\Users\admin\AppData\Local\Temp\7z2404.exe" C:\Users\admin\AppData\Local\Temp\7z2404.exe—explorer.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
MEDIUM
Description:
7-Zip Installer
Exit code:
3221226540
Version:
24.04
Modules
Images
c:\users\admin\appdata\local\temp\7z2404.exe
c:\windows\system32\ntdll.dll
4080"C:\Users\admin\AppData\Local\Temp\7z2404.exe" C:\Users\admin\AppData\Local\Temp\7z2404.exe
explorer.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
HIGH
Description:
7-Zip Installer
Exit code:
0
Version:
24.04
Modules
Images
c:\users\admin\appdata\local\temp\7z2404.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
7 124
Read events
7 009
Write events
85
Delete events
30

Modification events

(PID) Process:(4080) 7z2404.exeKey:HKEY_CURRENT_USER\Software\7-Zip
Operation:writeName:Path32
Value:
C:\Program Files\7-Zip\
(PID) Process:(4080) 7z2404.exeKey:HKEY_CURRENT_USER\Software\7-Zip
Operation:writeName:Path
Value:
C:\Program Files\7-Zip\
(PID) Process:(4080) 7z2404.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\7-Zip
Operation:writeName:Path32
Value:
C:\Program Files\7-Zip\
(PID) Process:(4080) 7z2404.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\7-Zip
Operation:writeName:Path
Value:
C:\Program Files\7-Zip\
(PID) Process:(4080) 7z2404.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Apartment
(PID) Process:(4080) 7z2404.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
Operation:writeName:{23170F69-40C1-278A-1000-000100020000}
Value:
7-Zip Shell Extension
(PID) Process:(4080) 7z2404.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\7zFM.exe
Operation:writeName:Path
Value:
C:\Program Files\7-Zip\
(PID) Process:(4080) 7z2404.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip
Operation:writeName:DisplayName
Value:
7-Zip 24.04
(PID) Process:(4080) 7z2404.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip
Operation:writeName:DisplayVersion
Value:
24.04
(PID) Process:(4080) 7z2404.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip
Operation:writeName:DisplayIcon
Value:
C:\Program Files\7-Zip\7zFM.exe
Executable files
8
Suspicious files
6
Text files
97
Unknown types
1

Dropped files

PID
Process
Filename
Type
40807z2404.exeC:\Program Files\7-Zip\Lang\an.txttext
MD5:F16218139E027338A16C3199091D0600
SHA256:3AB9F7AACD38C4CDE814F86BC37EEC2B9DF8D0DDDB95FC1D09A5F5BCB11F0EEB
40807z2404.exeC:\Program Files\7-Zip\Lang\af.txttext
MD5:DF216FAE5B13D3C3AFE87E405FD34B97
SHA256:9CF684EA88EA5A479F510750E4089AEE60BBB2452AA85285312BAFCC02C10A34
40807z2404.exeC:\Program Files\7-Zip\Lang\br.txttext
MD5:07504A4EDAB058C2F67C8BCB95C605DD
SHA256:432BDB3EAA9953B084EE14EEE8FE0ABBC1B384CBDD984CCF35F0415D45AABBA8
40807z2404.exeC:\Program Files\7-Zip\Lang\bg.txttext
MD5:7E72DDDA5C9C36FF524237C6E9E04966
SHA256:E1459219F199F991D31BAAB97E8DC98DE86DD263062CC8968193211F24EEEC3B
40807z2404.exeC:\Program Files\7-Zip\Lang\bn.txttext
MD5:771C8B73A374CB30DF4DF682D9C40EDF
SHA256:3F55B2EC5033C39C159593C6F5ECE667B92F32938B38FCAF58B4B2A98176C1FC
40807z2404.exeC:\Program Files\7-Zip\Lang\az.txttext
MD5:3C297FBE9B1ED5582BEABFC112B55523
SHA256:055EC86AED86ABBDBD52D8E99FEC6E868D073A6DF92C60225ADD16676994C314
40807z2404.exeC:\Program Files\7-Zip\Lang\co.txttext
MD5:7DDB2AFB758FE102EF8D4D19C2C26219
SHA256:C18B8B5CCB88795EB92A4ED54B5DC66E8D8FF036ADFCF6D74E63317B304C408F
40807z2404.exeC:\Program Files\7-Zip\Lang\ba.txttext
MD5:387FF78CF5F524FC44640F3025746145
SHA256:8A85C3FCB5F81157490971EE4F5E6B9E4F80BE69A802EBED04E6724CE859713F
40807z2404.exeC:\Program Files\7-Zip\descript.iontext
MD5:EB7E322BDC62614E49DED60E0FB23845
SHA256:1DA513F5A4E8018B9AE143884EB3EAF72454B606FD51F2401B7CFD9BE4DBBF4F
40807z2404.exeC:\Program Files\7-Zip\Lang\ar.txttext
MD5:5747381DC970306051432B18FB2236F2
SHA256:85A26C7B59D6D9932F71518CCD03ECEEBA42043CB1707719B72BFC348C1C1D72
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
7z2404.exe