File name:

certhelp.zip

Full analysis: https://app.any.run/tasks/441bd09a-309c-46ec-aae4-27164b4d4485
Verdict: Malicious activity
Threats:

Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns.

Analysis date: December 05, 2022, 19:21:53
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
emotet
trojan
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

1D5CAD2096C09AEA5C4CB11036B3B17C

SHA1:

64828AE50EEC356DF33AB12D7CB0870B748AAAFE

SHA256:

D4BBF164725162EAF80A3D7871B4ED7ADF4A9FEE8022EE957D642F52547FA5B3

SSDEEP:

1536:dOH0JfMbJ3te1uKydb2bVOFswRk7Ukkzde8Gq01Zt4fvvRF:SQ+kzydqbgFtXnRstQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • secmsi.exe (PID: 3120)
      • secmsi.exe (PID: 2008)
      • certhelp.exe (PID: 3388)
      • certhelp.exe (PID: 560)
    • Emotet process is detected

      • secmsi.exe (PID: 3120)
    • EMOTET was detected

      • secmsi.exe (PID: 2008)
    • EMOTET detected by memory dumps

      • secmsi.exe (PID: 2008)
  • SUSPICIOUS

    • Reads the Internet Settings

      • secmsi.exe (PID: 2008)
    • Detected use of alternative data streams (AltDS)

      • certhelp.exe (PID: 3388)
    • Starts itself from another location

      • certhelp.exe (PID: 3388)
    • Application launched itself

      • certhelp.exe (PID: 560)
      • secmsi.exe (PID: 3120)
  • INFO

    • Checks proxy server information

      • secmsi.exe (PID: 2008)
    • Checks supported languages

      • certhelp.exe (PID: 560)
      • secmsi.exe (PID: 2008)
      • secmsi.exe (PID: 3120)
      • certhelp.exe (PID: 3388)
    • Reads the computer name

      • certhelp.exe (PID: 3388)
      • secmsi.exe (PID: 2008)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
5
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start drop and start winrar.exe no specs certhelp.exe no specs certhelp.exe no specs #EMOTET secmsi.exe no specs #EMOTET secmsi.exe

Process information

PID
CMD
Path
Indicators
Parent process
1328"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\certhelp.zip"C:\Program Files\WinRAR\WinRAR.exeExplorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
560"C:\Users\admin\AppData\Local\Temp\Rar$EXb1328.10776\certhelp.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb1328.10776\certhelp.exeWinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb1328.10776\certhelp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
3388"C:\Users\admin\AppData\Local\Temp\Rar$EXb1328.10776\certhelp.exe"C:\Users\admin\AppData\Local\Temp\Rar$EXb1328.10776\certhelp.execerthelp.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb1328.10776\certhelp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
3120"C:\Users\admin\AppData\Local\Microsoft\Windows\secmsi.exe"C:\Users\admin\AppData\Local\Microsoft\Windows\secmsi.exe
certhelp.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\secmsi.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
2008"C:\Users\admin\AppData\Local\Microsoft\Windows\secmsi.exe"C:\Users\admin\AppData\Local\Microsoft\Windows\secmsi.exe
secmsi.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\secmsi.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\shlwapi.dll
Total events
1 438
Read events
1 407
Write events
31
Delete events
0

Modification events

(PID) Process:(1328) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1328) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1328) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1328) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(1328) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(1328) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\certhelp.zip
(PID) Process:(1328) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1328) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1328) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1328) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
2
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
3388certhelp.exeC:\Users\admin\AppData\Local\Microsoft\Windows\secmsi.exeexecutable
MD5:B4B768B594A7A999743B203B80CF2D14
SHA256:E0D69A6E9B4ABFB79954DD73EAC0AEC0D4F3B3FC5A9DD5AF9202B621949748CA
1328WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb1328.10776\certhelp.exeexecutable
MD5:B4B768B594A7A999743B203B80CF2D14
SHA256:E0D69A6E9B4ABFB79954DD73EAC0AEC0D4F3B3FC5A9DD5AF9202B621949748CA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
0
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2008
secmsi.exe
POST
37.187.57.57:443
http://37.187.57.57:443/
FR
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2008
secmsi.exe
37.187.57.57:443
OVH SAS
FR
malicious

DNS requests

No data

Threats

PID
Process
Class
Message
2008
secmsi.exe
A Network Trojan was detected
ET TROJAN Win32/Emotet CnC Checkin (POST)
2008
secmsi.exe
A Network Trojan was detected
ET TROJAN W32/Emotet.v4 Checkin
2008
secmsi.exe
Potentially Bad Traffic
ET POLICY HTTP traffic on port 443 (POST)
2008
secmsi.exe
Potentially Bad Traffic
ET INFO GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1
2008
secmsi.exe
Potentially Bad Traffic
AV POLICY HTTP traffic on port 443 to IP host (POST)
No debug info