analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

MBX_420_SP2.7z

Full analysis: https://app.any.run/tasks/d4c6a0e4-ac08-4c05-8da7-f6c39d6573f3
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: July 18, 2019, 01:27:59
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ransomware
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

90A954FD19B6A1E2AE03E9E74416B00F

SHA1:

8AE11869B195962699793212D644272EDF075A80

SHA256:

D4B29E56D1B21467D9BD994F843AA6BB57BC0AE81A01B05CDCC546FF0C6655C9

SSDEEP:

98304:gQZ1BWZ+kK5/qhsScxOuR9QQuklzOKGeVfW/vbLorMpBJYkzpivBdZ4Bfi9I62fG:/zwzg/QsSIOurQQNlSleVfQvb7Y3pb4s

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • MBX_420_SP2.exe (PID: 2672)
      • Setup.exe (PID: 3376)
      • Setup.exe (PID: 3000)
      • _INS5176._MP (PID: 3616)

    • Loads dropped or rewritten executable

      • ntvdm.exe (PID: 2200)
      • _INS5176._MP (PID: 3616)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • MBX_420_SP2.exe (PID: 2672)
      • WinRAR.exe (PID: 3028)
      • _INS5176._MP (PID: 3616)
      • ntvdm.exe (PID: 2200)

    • Creates files like Ransomware instruction

      • MBX_420_SP2.exe (PID: 2672)

    • Starts application with an unusual extension

      • ntvdm.exe (PID: 2200)

    • Executes application which crashes

      • Setup.exe (PID: 3000)

    • Removes files from Windows directory

      • _INS5176._MP (PID: 3616)
      • ntvdm.exe (PID: 2200)

    • Creates files in the Windows directory

      • ntvdm.exe (PID: 2200)
      • _INS5176._MP (PID: 3616)

  • INFO

    • Manual execution by user

      • MBX_420_SP2.exe (PID: 2672)

    • Dropped object may contain Bitcoin addresses

      • _INS5176._MP (PID: 3616)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
6
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start winrar.exe mbx_420_sp2.exe setup.exe no specs setup.exe ntvdm.exe _ins5176._mp

Process information

PID
CMD
Path
Indicators
Parent process
3028"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\MBX_420_SP2.7z"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
2672"C:\Users\admin\Desktop\MBX_420_SP2.exe" C:\Users\admin\Desktop\MBX_420_SP2.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3376"C:\Users\admin\Desktop\Setup.exe" C:\Users\admin\Desktop\Setup.exe—MBX_420_SP2.exe
User:
admin
Company:
Cyberlogic Technologies, Inc.
Integrity Level:
MEDIUM
Description:
Setup
Exit code:
3221226540
Version:
1, 0, 0, 1
3000"C:\Users\admin\Desktop\Setup.exe" C:\Users\admin\Desktop\Setup.exe
MBX_420_SP2.exe
User:
admin
Company:
Cyberlogic Technologies, Inc.
Integrity Level:
HIGH
Description:
Setup
Exit code:
0
Version:
1, 0, 0, 1
2200"C:\Windows\system32\ntvdm.exe" -i1 -wsC:\Windows\system32\ntvdm.exe
Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
NTVDM.EXE
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3616C:\Users\admin\AppData\Local\Temp\_INS5176._MP C:\Users\admin\AppData\Local\Temp\_INS5176._MP
ntvdm.exe
User:
admin
Company:
InstallShield Software Corporation
Integrity Level:
HIGH
Description:
InstallShield Engine
Exit code:
0
Version:
5.10.145.0
Total events
705
Read events
675
Write events
30
Delete events
0

Modification events

(PID) Process:(3028) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3028) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3028) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\70\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3028) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(3028) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\MBX_420_SP2.7z
(PID) Process:(3028) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3028) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3028) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3028) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3028) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\DialogEditHistory\ExtrPath
Operation:writeName:0
Value:
C:\Users\admin\Desktop
Executable files
13
Suspicious files
4
Text files
19
Unknown types
4

Dropped files

PID
Process
Filename
Type
2672MBX_420_SP2.exeC:\Users\admin\Desktop\data1.cab —
MD5:—
SHA256:—
2200ntvdm.exeC:\Users\admin\AppData\Local\Temp\scs5167.tmp —
MD5:—
SHA256:—
2200ntvdm.exeC:\Users\admin\AppData\Local\Temp\scs5168.tmp —
MD5:—
SHA256:—
2672MBX_420_SP2.exeC:\Users\admin\Desktop\_sys1.cabcompressed
MD5:1247C0BC1402EB6BFD7811FABDF6EBED
SHA256:227BB51DEA4A9D838BED28F03DFFFC5E6BB56CACF4C86FA972CA4BB0D33A4EDF
3028WinRAR.exeC:\Users\admin\Desktop\MBX_420_SP2.exeexecutable
MD5:790F6B9AD8FFA0FC7031900B9E78BC09
SHA256:56F4A5674E1F96F04FC2BA5FB41D9F8AE047D7ADE4A6149E92CBE07BA6200018
2672MBX_420_SP2.exeC:\Users\admin\Desktop\DATA.TAGtext
MD5:B8176FE06945A76E0C887D52F33B61D5
SHA256:DCCBDDED48815E0908B205CC2167D4430DA875C22C83C958D035D32355F92F03
2672MBX_420_SP2.exeC:\Users\admin\Desktop\layout.binbinary
MD5:6EB96DCA292C34B6B7FA77E796FB090F
SHA256:6829349D72831A00E8A65F60BA3BF2DB50620CC1567970B675CBF6FA5F76680E
2672MBX_420_SP2.exeC:\Users\admin\Desktop\Setup.exeexecutable
MD5:959ABC728F48379E225755CFB0C6D793
SHA256:475193023042D61FA6F5E84F0A879C140408DEAFC2FB04CA90AEB8BF4391663A
2672MBX_420_SP2.exeC:\Users\admin\Desktop\setup.insins
MD5:3BEEC90212E7AD37B543C30B7F3B21A6
SHA256:548B56B950F39634410C057C2CB6AF2FF79E68F8813DD5121A3CD812CA3C5761
2672MBX_420_SP2.exeC:\Users\admin\Desktop\Setup.cybtext
MD5:8266E27AFD7AAAA392979230C7F17B9C
SHA256:813FB6D9BFE1286ADE25BC61CB4B42ADEC5CA0BF41FA56270797B246E763F985
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
MBX_420_SP2.7z