File name:

MBX_420_SP2.7z

Full analysis: https://app.any.run/tasks/d4c6a0e4-ac08-4c05-8da7-f6c39d6573f3
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: July 18, 2019, 01:27:59
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ransomware
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

90A954FD19B6A1E2AE03E9E74416B00F

SHA1:

8AE11869B195962699793212D644272EDF075A80

SHA256:

D4B29E56D1B21467D9BD994F843AA6BB57BC0AE81A01B05CDCC546FF0C6655C9

SSDEEP:

98304:gQZ1BWZ+kK5/qhsScxOuR9QQuklzOKGeVfW/vbLorMpBJYkzpivBdZ4Bfi9I62fG:/zwzg/QsSIOurQQNlSleVfQvb7Y3pb4s

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Setup.exe (PID: 3376)
      • MBX_420_SP2.exe (PID: 2672)
      • Setup.exe (PID: 3000)
      • _INS5176._MP (PID: 3616)

    • Loads dropped or rewritten executable

      • _INS5176._MP (PID: 3616)
      • ntvdm.exe (PID: 2200)

  • SUSPICIOUS

    • Creates files like Ransomware instruction

      • MBX_420_SP2.exe (PID: 2672)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3028)
      • MBX_420_SP2.exe (PID: 2672)
      • ntvdm.exe (PID: 2200)
      • _INS5176._MP (PID: 3616)

    • Executes application which crashes

      • Setup.exe (PID: 3000)

    • Creates files in the Windows directory

      • ntvdm.exe (PID: 2200)
      • _INS5176._MP (PID: 3616)

    • Starts application with an unusual extension

      • ntvdm.exe (PID: 2200)

    • Removes files from Windows directory

      • ntvdm.exe (PID: 2200)
      • _INS5176._MP (PID: 3616)

  • INFO

    • Manual execution by user

      • MBX_420_SP2.exe (PID: 2672)

    • Dropped object may contain Bitcoin addresses

      • _INS5176._MP (PID: 3616)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
6
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start winrar.exe mbx_420_sp2.exe setup.exe no specs setup.exe ntvdm.exe _ins5176._mp

Process information

PID
CMD
Path
Indicators
Parent process
2200"C:\Windows\system32\ntvdm.exe" -i1 -wsC:\Windows\system32\ntvdm.exe
Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
NTVDM.EXE
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntvdm.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2672"C:\Users\admin\Desktop\MBX_420_SP2.exe" C:\Users\admin\Desktop\MBX_420_SP2.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\mbx_420_sp2.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
3000"C:\Users\admin\Desktop\Setup.exe" C:\Users\admin\Desktop\Setup.exe
MBX_420_SP2.exe
User:
admin
Company:
Cyberlogic Technologies, Inc.
Integrity Level:
HIGH
Description:
Setup
Exit code:
0
Version:
1, 0, 0, 1
Modules
Images
c:\users\admin\desktop\setup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\apphelp.dll
3028"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\MBX_420_SP2.7z"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3376"C:\Users\admin\Desktop\Setup.exe" C:\Users\admin\Desktop\Setup.exe—MBX_420_SP2.exe
User:
admin
Company:
Cyberlogic Technologies, Inc.
Integrity Level:
MEDIUM
Description:
Setup
Exit code:
3221226540
Version:
1, 0, 0, 1
Modules
Images
c:\users\admin\desktop\setup.exe
c:\systemroot\system32\ntdll.dll
3616C:\Users\admin\AppData\Local\Temp\_INS5176._MP C:\Users\admin\AppData\Local\Temp\_INS5176._MP
ntvdm.exe
User:
admin
Company:
InstallShield Software Corporation
Integrity Level:
HIGH
Description:
InstallShield Engine
Exit code:
0
Version:
5.10.145.0
Modules
Images
c:\users\admin\appdata\local\temp\_ins5176._mp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\version.dll
Total events
705
Read events
675
Write events
30
Delete events
0

Modification events

(PID) Process:(3028) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3028) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3028) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\70\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3028) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(3028) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\MBX_420_SP2.7z
(PID) Process:(3028) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3028) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3028) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3028) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3028) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\DialogEditHistory\ExtrPath
Operation:writeName:0
Value:
C:\Users\admin\Desktop
Executable files
13
Suspicious files
4
Text files
19
Unknown types
4

Dropped files

PID
Process
Filename
Type
2672MBX_420_SP2.exeC:\Users\admin\Desktop\data1.cab —
MD5:—
SHA256:—
2200ntvdm.exeC:\Users\admin\AppData\Local\Temp\scs5167.tmp —
MD5:—
SHA256:—
2200ntvdm.exeC:\Users\admin\AppData\Local\Temp\scs5168.tmp —
MD5:—
SHA256:—
2672MBX_420_SP2.exeC:\Users\admin\Desktop\DATA.TAGtext
MD5:—
SHA256:—
2672MBX_420_SP2.exeC:\Users\admin\Desktop\Setup.cybtext
MD5:—
SHA256:—
2672MBX_420_SP2.exeC:\Users\admin\Desktop\_sys1.cabcompressed
MD5:—
SHA256:—
2200ntvdm.exeC:\Windows\_delis43.initext
MD5:—
SHA256:—
2672MBX_420_SP2.exeC:\Users\admin\Desktop\SETUP.INItext
MD5:—
SHA256:—
2672MBX_420_SP2.exeC:\Users\admin\Desktop\SETUP.EX_executable
MD5:AFE10D250B2C1850B37827C1D4E01EEF
SHA256:26ADEA53490125FD31E300DA97EF48B9DDC583753789051746B9A31406B418CF
2672MBX_420_SP2.exeC:\Users\admin\Desktop\layout.binbinary
MD5:6EB96DCA292C34B6B7FA77E796FB090F
SHA256:40C60ABC0907985800B091E52E9F6D6ED8F7ED41680EFC5661AC1F7E52E50BD6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
MBX_420_SP2.7z