URL:

http://garage.zabkray.net/files/articles/ND3T_W57/Mafon_calculator.zip

Full analysis: https://app.any.run/tasks/5804e932-bf8c-450c-9857-ef1de54d05ba
Verdict: No threats detected
Analysis date: July 16, 2019, 03:39:18
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
opendir
Indicators:
MD5:

43FF325A4369A5E70BC31B85B8558841

SHA1:

A66A54EB37D2AF61F883AEBA8F25186B7EC10423

SHA256:

D6A9A17450CFF0D556A488F9546BF676DACB23DB430AD6C7265828DB09598B12

SSDEEP:

3:N1KZEXSKg8K+RuWKcx6OVOFG1RP:C6CKvKcpyq5

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Creates files in the user directory

      • iexplore.exe (PID: 3156)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3156)
      • iexplore.exe (PID: 2896)

    • Changes internet zones settings

      • iexplore.exe (PID: 2896)

    • Application launched itself

      • iexplore.exe (PID: 2896)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2896)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
35
Monitored processes
3
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe winrar.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2600"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Downloads\Mafon_calculator.zip"C:\Program Files\WinRAR\WinRAR.exe—iexplore.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2896"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3156"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2896 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
1 281
Read events
1 174
Write events
103
Delete events
4

Modification events

(PID) Process:(2896) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2896) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2896) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(2896) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(2896) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2896) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000077000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(2896) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{59DA76BD-A77B-11E9-A9B1-5254004A04AF}
Value:
0
(PID) Process:(2896) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Type
Value:
4
(PID) Process:(2896) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Count
Value:
1
(PID) Process:(2896) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Time
Value:
E307070002001000030027002D003603
Executable files
0
Suspicious files
3
Text files
10
Unknown types
4

Dropped files

PID
Process
Filename
Type
2896iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\favicon[1].ico —
MD5:—
SHA256:—
2896iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
2896iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF084D88C3C50203AC.TMP —
MD5:—
SHA256:—
2896iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFD5F077D95927AC4E.TMP —
MD5:—
SHA256:—
2896iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{59DA76BD-A77B-11E9-A9B1-5254004A04AF}.dat —
MD5:—
SHA256:—
3156iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012019071620190717\index.datdat
MD5:82EB4F5D308E1278024DE7DE07180FD5
SHA256:B21B913F4C118D0904A0AB2A10565B1785A9B133E23AFE074FD3165688EE5136
2896iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{59DA76BE-A77B-11E9-A9B1-5254004A04AF}.datbinary
MD5:B65153E57B12E68181237160578F9FE6
SHA256:A8299F5B87D69126D4CF347C7D0C07D320CDCBFF3375086ACE956666CB25ABD0
3156iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\JavaDeployReg.logtext
MD5:9FB3BF2E6FC31B3C54D9C277A644465D
SHA256:33BFD5F47C11C0F1D8352E06E95D0E348D2C8BDE4E1D1A8813AD95B1BD66A2B3
3156iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\V6D0LO40\Mafon_calculator[1].zipcompressed
MD5:FA8A37EE9849FE475891600C8B6FBF3C
SHA256:AD0CF5CF2892CCB566F73059869CFD8DBD7E2EC681298B8B093E20DF52598511
3156iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.datdat
MD5:B04A8FFBC91C1075AE5DCA8AC05BC3AB
SHA256:61B754DEBBCC9B185DF441AF56BA7B2C3C584552C23C0262B320239FFA8E4C42
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
2
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3156
iexplore.exe
GET
200
188.168.80.191:80
http://garage.zabkray.net/files/articles/ND3T_W57/Mafon_calculator.zip
RU
compressed
23.6 Kb
unknown
2896
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2896
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3156
iexplore.exe
188.168.80.191:80
garage.zabkray.net
Closed Joint Stock Company TransTeleCom
RU
unknown

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
garage.zabkray.net
  • 188.168.80.191
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://garage.zabkray.net/files/articles/ND3T_W57/Mafon_calculator.zip