analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

7444356179.zip

Full analysis: https://app.any.run/tasks/d76bcdb9-3053-4cd0-b063-cd968decaf5a
Verdict: Malicious activity
Analysis date: May 20, 2022, 17:29:46
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

76D1691B399ED2AB9D341AA0C0CE51CF

SHA1:

A1A207393392D90DB677B49E2A691A31A8FA0DAC

SHA256:

D479B090F30DF8B07E24E680025ECE9AA37025DAFDDD3DEC031C9243DD43B087

SSDEEP:

24576:RjxUGI18tJdRByljeVkpp2NbsqGzHyReGrC44MN+xwgymlj6nvgJ8XFOd:Rjd1vtgeVkpLzHYeGr48+2rMik

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • WinRAR.exe (PID: 2908)
      • 4210369966055c8bbb73507c1d44c35099d5bc0630c6fd50e6cca0f3de99aab0.exe (PID: 564)
      • 4210369966055c8bbb73507c1d44c35099d5bc0630c6fd50e6cca0f3de99aab0.exe (PID: 3576)
      • 4210369966055c8bbb73507c1d44c35099d5bc0630c6fd50e6cca0f3de99aab0.tmp (PID: 1664)

    • Application was dropped or rewritten from another process

      • 4210369966055c8bbb73507c1d44c35099d5bc0630c6fd50e6cca0f3de99aab0.exe (PID: 3576)
      • 4210369966055c8bbb73507c1d44c35099d5bc0630c6fd50e6cca0f3de99aab0.exe (PID: 564)

  • SUSPICIOUS

    • Reads the computer name

      • WinRAR.exe (PID: 2908)
      • 4210369966055c8bbb73507c1d44c35099d5bc0630c6fd50e6cca0f3de99aab0.tmp (PID: 2616)
      • 4210369966055c8bbb73507c1d44c35099d5bc0630c6fd50e6cca0f3de99aab0.tmp (PID: 1664)

    • Checks supported languages

      • WinRAR.exe (PID: 2908)
      • 4210369966055c8bbb73507c1d44c35099d5bc0630c6fd50e6cca0f3de99aab0.exe (PID: 564)
      • 4210369966055c8bbb73507c1d44c35099d5bc0630c6fd50e6cca0f3de99aab0.tmp (PID: 2616)
      • 4210369966055c8bbb73507c1d44c35099d5bc0630c6fd50e6cca0f3de99aab0.exe (PID: 3576)
      • 4210369966055c8bbb73507c1d44c35099d5bc0630c6fd50e6cca0f3de99aab0.tmp (PID: 1664)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2908)
      • 4210369966055c8bbb73507c1d44c35099d5bc0630c6fd50e6cca0f3de99aab0.exe (PID: 564)
      • 4210369966055c8bbb73507c1d44c35099d5bc0630c6fd50e6cca0f3de99aab0.exe (PID: 3576)
      • 4210369966055c8bbb73507c1d44c35099d5bc0630c6fd50e6cca0f3de99aab0.tmp (PID: 1664)

    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 2908)
      • 4210369966055c8bbb73507c1d44c35099d5bc0630c6fd50e6cca0f3de99aab0.exe (PID: 564)
      • 4210369966055c8bbb73507c1d44c35099d5bc0630c6fd50e6cca0f3de99aab0.exe (PID: 3576)
      • 4210369966055c8bbb73507c1d44c35099d5bc0630c6fd50e6cca0f3de99aab0.tmp (PID: 1664)

    • Reads the Windows organization settings

      • 4210369966055c8bbb73507c1d44c35099d5bc0630c6fd50e6cca0f3de99aab0.tmp (PID: 1664)

    • Reads Windows owner or organization settings

      • 4210369966055c8bbb73507c1d44c35099d5bc0630c6fd50e6cca0f3de99aab0.tmp (PID: 1664)

  • INFO

    • Application was dropped or rewritten from another process

      • 4210369966055c8bbb73507c1d44c35099d5bc0630c6fd50e6cca0f3de99aab0.tmp (PID: 1664)
      • 4210369966055c8bbb73507c1d44c35099d5bc0630c6fd50e6cca0f3de99aab0.tmp (PID: 2616)

    • Loads dropped or rewritten executable

      • 4210369966055c8bbb73507c1d44c35099d5bc0630c6fd50e6cca0f3de99aab0.tmp (PID: 1664)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: 4210369966055c8bbb73507c1d44c35099d5bc0630c6fd50e6cca0f3de99aab0
ZipUncompressedSize: 1287179
ZipCompressedSize: 1217084
ZipCRC: 0x8f7d9378
ZipModifyDate: 1980:00:00 00:00:00
ZipCompression: Deflated
ZipBitFlag: 0x0009
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
5
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start winrar.exe 4210369966055c8bbb73507c1d44c35099d5bc0630c6fd50e6cca0f3de99aab0.exe 4210369966055c8bbb73507c1d44c35099d5bc0630c6fd50e6cca0f3de99aab0.tmp no specs 4210369966055c8bbb73507c1d44c35099d5bc0630c6fd50e6cca0f3de99aab0.exe 4210369966055c8bbb73507c1d44c35099d5bc0630c6fd50e6cca0f3de99aab0.tmp

Process information

PID
CMD
Path
Indicators
Parent process
2908"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\7444356179.zip"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
564"C:\Users\admin\AppData\Local\Temp\Rar$EXb2908.46657\4210369966055c8bbb73507c1d44c35099d5bc0630c6fd50e6cca0f3de99aab0.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb2908.46657\4210369966055c8bbb73507c1d44c35099d5bc0630c6fd50e6cca0f3de99aab0.exe
WinRAR.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
KBStarter LangPack BG Setup
Exit code:
1
Version:
2.3.7.2000
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb2908.46657\4210369966055c8bbb73507c1d44c35099d5bc0630c6fd50e6cca0f3de99aab0.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2616"C:\Users\admin\AppData\Local\Temp\is-OLJFA.tmp\4210369966055c8bbb73507c1d44c35099d5bc0630c6fd50e6cca0f3de99aab0.tmp" /SL5="$7015A,816068,119296,C:\Users\admin\AppData\Local\Temp\Rar$EXb2908.46657\4210369966055c8bbb73507c1d44c35099d5bc0630c6fd50e6cca0f3de99aab0.exe" C:\Users\admin\AppData\Local\Temp\is-OLJFA.tmp\4210369966055c8bbb73507c1d44c35099d5bc0630c6fd50e6cca0f3de99aab0.tmp—4210369966055c8bbb73507c1d44c35099d5bc0630c6fd50e6cca0f3de99aab0.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
1
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-oljfa.tmp\4210369966055c8bbb73507c1d44c35099d5bc0630c6fd50e6cca0f3de99aab0.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3576"C:\Users\admin\AppData\Local\Temp\Rar$EXb2908.46657\4210369966055c8bbb73507c1d44c35099d5bc0630c6fd50e6cca0f3de99aab0.exe" /SPAWNWND=$20178 /NOTIFYWND=$7015A C:\Users\admin\AppData\Local\Temp\Rar$EXb2908.46657\4210369966055c8bbb73507c1d44c35099d5bc0630c6fd50e6cca0f3de99aab0.exe
4210369966055c8bbb73507c1d44c35099d5bc0630c6fd50e6cca0f3de99aab0.tmp
User:
admin
Company:
Integrity Level:
HIGH
Description:
KBStarter LangPack BG Setup
Exit code:
1
Version:
2.3.7.2000
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb2908.46657\4210369966055c8bbb73507c1d44c35099d5bc0630c6fd50e6cca0f3de99aab0.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1664"C:\Users\admin\AppData\Local\Temp\is-3I2OK.tmp\4210369966055c8bbb73507c1d44c35099d5bc0630c6fd50e6cca0f3de99aab0.tmp" /SL5="$30176,816068,119296,C:\Users\admin\AppData\Local\Temp\Rar$EXb2908.46657\4210369966055c8bbb73507c1d44c35099d5bc0630c6fd50e6cca0f3de99aab0.exe" /SPAWNWND=$20178 /NOTIFYWND=$7015A C:\Users\admin\AppData\Local\Temp\is-3I2OK.tmp\4210369966055c8bbb73507c1d44c35099d5bc0630c6fd50e6cca0f3de99aab0.tmp
4210369966055c8bbb73507c1d44c35099d5bc0630c6fd50e6cca0f3de99aab0.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
1
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-3i2ok.tmp\4210369966055c8bbb73507c1d44c35099d5bc0630c6fd50e6cca0f3de99aab0.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
Total events
1 993
Read events
1 960
Write events
0
Delete events
0

Modification events

No data
Executable files
5
Suspicious files
2
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2908WinRAR.exeC:\Users\admin\AppData\Local\Temp\__rzi_2908.46435compressed
MD5:C5B84A5C470279C9A55358BDF8AE6821
SHA256:271B6C700A7E6023418A068C4099F0121B8C454110833EB7AF58CB5CF439C35B
2908WinRAR.exeC:\Users\admin\AppData\Local\Temp\7444356179.zipcompressed
MD5:C5B84A5C470279C9A55358BDF8AE6821
SHA256:271B6C700A7E6023418A068C4099F0121B8C454110833EB7AF58CB5CF439C35B
2908WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2908.46657\4210369966055c8bbb73507c1d44c35099d5bc0630c6fd50e6cca0f3de99aab0.exeexecutable
MD5:51AED94F8CFCBBC66E0A5B9C74F91144
SHA256:4210369966055C8BBB73507C1D44C35099D5BC0630C6FD50E6CCA0F3DE99AAB0
16644210369966055c8bbb73507c1d44c35099d5bc0630c6fd50e6cca0f3de99aab0.tmpC:\Users\admin\AppData\Local\Temp\is-D2TSN.tmp\_isetup\_shfoldr.dllexecutable
MD5:92DC6EF532FBB4A5C3201469A5B5EB63
SHA256:9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
16644210369966055c8bbb73507c1d44c35099d5bc0630c6fd50e6cca0f3de99aab0.tmpC:\Users\admin\AppData\Local\Temp\is-D2TSN.tmp\psvince.dllexecutable
MD5:A4E5C512B047A6D9DC38549161CAC4DE
SHA256:C7F1E7E866834D9024F97C2B145C09D106E447E8ABD65A10A1732116D178E44E
35764210369966055c8bbb73507c1d44c35099d5bc0630c6fd50e6cca0f3de99aab0.exeC:\Users\admin\AppData\Local\Temp\is-3I2OK.tmp\4210369966055c8bbb73507c1d44c35099d5bc0630c6fd50e6cca0f3de99aab0.tmpexecutable
MD5:E4A2856522E6A817E3F0EDD2677FA647
SHA256:E11132CA9FB98307830147446F5F731E19E308949E1A473D177D5A9F7DDF9C7E
5644210369966055c8bbb73507c1d44c35099d5bc0630c6fd50e6cca0f3de99aab0.exeC:\Users\admin\AppData\Local\Temp\is-OLJFA.tmp\4210369966055c8bbb73507c1d44c35099d5bc0630c6fd50e6cca0f3de99aab0.tmpexecutable
MD5:E4A2856522E6A817E3F0EDD2677FA647
SHA256:E11132CA9FB98307830147446F5F731E19E308949E1A473D177D5A9F7DDF9C7E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
7444356179.zip