analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

WaffMEMZ密码malware.7z

Full analysis: https://app.any.run/tasks/603f582c-00da-4440-8de4-25651af1e978
Verdict: Malicious activity
Analysis date: July 18, 2019, 09:03:36
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

527D8596B05F8A5EA645A2327BC083FE

SHA1:

985960A519CAC4977C849D34FDA06D016FA75F95

SHA256:

D76514431F556A3B5BCFF9D9222C94FF97ED4139B157D8C73966A18607A8C86F

SSDEEP:

192:MAgxv8STCX5EuBlt/xHRsjgHMclxkbatifgAzS01AgI3T6dmVXFN+Ic/uf1:e9CXdBD/xhMmxm3fgx0YmdmVXFN+D/ud

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • WaffMEMZ-1.0-Destructive.exe (PID: 3560)
      • WaffMEMZ-1.0-Destructive.exe (PID: 3200)
      • WaffMEMZ-1.0-Destructive.exe (PID: 2892)
      • WaffMEMZ-1.0-Destructive.exe (PID: 3680)
      • WaffMEMZ-1.0-Destructive.exe (PID: 2836)
      • WaffMEMZ-1.0-Destructive.exe (PID: 2452)
      • WaffMEMZ-1.0-Destructive.exe (PID: 4052)

    • Low-level write access rights to disk partition

      • WaffMEMZ-1.0-Destructive.exe (PID: 2836)

    • Application was injected by another process

      • SearchIndexer.exe (PID: 332)
      • svchost.exe (PID: 1044)
      • svchost.exe (PID: 852)

    • Runs injected code in another process

      • rstrui.exe (PID: 3056)

    • Changes settings of System certificates

      • svchost.exe (PID: 1044)

  • SUSPICIOUS

    • Application launched itself

      • WaffMEMZ-1.0-Destructive.exe (PID: 3560)
      • taskmgr.exe (PID: 3700)

    • Low-level read access rights to disk partition

      • WaffMEMZ-1.0-Destructive.exe (PID: 2836)
      • wbengine.exe (PID: 3996)
      • vds.exe (PID: 2584)

    • Creates files in the user directory

      • WaffMEMZ-1.0-Destructive.exe (PID: 2836)

    • Starts Internet Explorer

      • WaffMEMZ-1.0-Destructive.exe (PID: 2836)

    • Creates files in the program directory

      • SearchIndexer.exe (PID: 332)
      • fxssvc.exe (PID: 5440)

    • Executed as Windows Service

      • wbengine.exe (PID: 3996)
      • vssvc.exe (PID: 2260)
      • vds.exe (PID: 2584)
      • fxssvc.exe (PID: 5440)

    • Creates files in the Windows directory

      • rstrui.exe (PID: 3056)
      • fxssvc.exe (PID: 5440)

    • Executed via COM

      • vdsldr.exe (PID: 2236)

    • Reads internet explorer settings

      • mmc.exe (PID: 3328)

    • Adds / modifies Windows certificates

      • svchost.exe (PID: 1044)

    • Writes to a desktop.ini file (may be used to cloak folders)

      • WFS.exe (PID: 4820)

  • INFO

    • Manual execution by user

      • WaffMEMZ-1.0-Destructive.exe (PID: 3560)
      • taskmgr.exe (PID: 3700)

    • Changes internet zones settings

      • iexplore.exe (PID: 3480)

    • Creates files in the user directory

      • iexplore.exe (PID: 3468)
      • iexplore.exe (PID: 3984)
      • iexplore.exe (PID: 2320)
      • iexplore.exe (PID: 2980)
      • iexplore.exe (PID: 2996)
      • iexplore.exe (PID: 1608)
      • iexplore.exe (PID: 3480)
      • iexplore.exe (PID: 5500)
      • iexplore.exe (PID: 5880)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3468)
      • iexplore.exe (PID: 2320)
      • iexplore.exe (PID: 3984)
      • iexplore.exe (PID: 2980)
      • iexplore.exe (PID: 2996)
      • iexplore.exe (PID: 1608)
      • iexplore.exe (PID: 5500)
      • iexplore.exe (PID: 5880)
      • iexplore.exe (PID: 3416)

    • Application launched itself

      • iexplore.exe (PID: 3480)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2320)
      • iexplore.exe (PID: 3984)
      • iexplore.exe (PID: 2980)
      • iexplore.exe (PID: 2996)
      • iexplore.exe (PID: 1608)
      • iexplore.exe (PID: 3480)
      • iexplore.exe (PID: 3468)
      • iexplore.exe (PID: 5880)
      • iexplore.exe (PID: 3416)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2996)
      • iexplore.exe (PID: 2980)
      • iexplore.exe (PID: 1608)
      • svchost.exe (PID: 1044)
      • iexplore.exe (PID: 3480)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2996)
      • iexplore.exe (PID: 1608)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2996)
      • iexplore.exe (PID: 1608)

    • Dropped object may contain Bitcoin addresses

      • iexplore.exe (PID: 1608)
      • iexplore.exe (PID: 3416)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
114
Monitored processes
67
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start inject inject inject winrar.exe no specs waffmemz-1.0-destructive.exe waffmemz-1.0-destructive.exe no specs waffmemz-1.0-destructive.exe no specs waffmemz-1.0-destructive.exe no specs waffmemz-1.0-destructive.exe no specs waffmemz-1.0-destructive.exe no specs waffmemz-1.0-destructive.exe notepad.exe no specs iexplore.exe iexplore.exe iexplore.exe iexplore.exe regedit.exe no specs rstrui.exe no specs wbengine.exe no specs svchost.exe svchost.exe searchindexer.exe vssvc.exe no specs vdsldr.exe no specs vds.exe no specs iexplore.exe mmc.exe no specs sdclt.exe control.exe no specs hdwwiz.exe no specs msdt.exe no specs iexplore.exe snippingtool.exe no specs iexplore.exe mmc.exe no specs mmc.exe no specs taskmgr.exe no specs isoburn.exe no specs tabcal.exe no specs taskmgr.exe iexplore.exe wfs.exe no specs fxssvc.exe no specs mmc.exe no specs iexplore.exe windowsanytimeupgraderesults.exe no specs mmc.exe no specs control.exe no specs iexplore.exe iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs syskey.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3092"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\WaffMEMZ密码malware.7z"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
3560"C:\Users\admin\Desktop\WaffMEMZ-1.0-Destructive.exe" C:\Users\admin\Desktop\WaffMEMZ-1.0-Destructive.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
2892"C:\Users\admin\Desktop\WaffMEMZ-1.0-Destructive.exe" /watchdogC:\Users\admin\Desktop\WaffMEMZ-1.0-Destructive.exe—WaffMEMZ-1.0-Destructive.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1073807364
3200"C:\Users\admin\Desktop\WaffMEMZ-1.0-Destructive.exe" /watchdogC:\Users\admin\Desktop\WaffMEMZ-1.0-Destructive.exe—WaffMEMZ-1.0-Destructive.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
3680"C:\Users\admin\Desktop\WaffMEMZ-1.0-Destructive.exe" /watchdogC:\Users\admin\Desktop\WaffMEMZ-1.0-Destructive.exe—WaffMEMZ-1.0-Destructive.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1073807364
4052"C:\Users\admin\Desktop\WaffMEMZ-1.0-Destructive.exe" /watchdogC:\Users\admin\Desktop\WaffMEMZ-1.0-Destructive.exe—WaffMEMZ-1.0-Destructive.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1073807364
2452"C:\Users\admin\Desktop\WaffMEMZ-1.0-Destructive.exe" /watchdogC:\Users\admin\Desktop\WaffMEMZ-1.0-Destructive.exe—WaffMEMZ-1.0-Destructive.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1073807364
2836"C:\Users\admin\Desktop\WaffMEMZ-1.0-Destructive.exe" /mainC:\Users\admin\Desktop\WaffMEMZ-1.0-Destructive.exe
WaffMEMZ-1.0-Destructive.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1073807364
3864"C:\Windows\System32\notepad.exe" \note.txtC:\Windows\System32\notepad.exe—WaffMEMZ-1.0-Destructive.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Notepad
Exit code:
1073807364
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3480"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
WaffMEMZ-1.0-Destructive.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Exit code:
1073807364
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Total events
5 552
Read events
4 573
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
47
Text files
262
Unknown types
53

Dropped files

PID
Process
Filename
Type
3092WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3092.15389\WaffMEMZ-1.0-Destructive.exe —
MD5:—
SHA256:—
3480iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\favicon[1].ico —
MD5:—
SHA256:—
3480iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
2320iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt —
MD5:—
SHA256:—
852svchost.exeC:\Windows\appcompat\programs\RecentFileCache.bcftxt
MD5:89B163A5751B417E52EE9ABE1034EDD2
SHA256:00D1E1123575F8BBE9ECDE0146CF42470A8AE00FE7A60AAC09A44E71092A16EB
3468iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][3].txttext
MD5:37D8D9B1C58998E9F6E9C70F7CB73548
SHA256:5C4CDEDAC9A916C9C22796FDC77A48E16D515DE0A843BAD950FE52F48788D961
3468iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txttext
MD5:673B2B32BA7D7A490D477DCD1F29E45C
SHA256:D13AEA8ACCEEE71994C7FEDA70397E3F61905C5B8FF240C3CA47B5B0F2806548
2320iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][4].txttext
MD5:BF24EBB08D4F3849695FF4FBD23121DC
SHA256:96B1539AFC08DEA2CE4EED3E7492C9D327497656C570A2C7002424472C8C77F0
3468iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\PrivacIE\index.datdat
MD5:755283F360D4BE1954CD389F16F6749C
SHA256:CC3C9647B89C9EEFC23F965C4800B8CB1AD79463C0F935188426A10F871DDCCF
2320iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\rs=ACT90oE5OaNHqFT2iq9f0tXSUukw-3E8zw[1]text
MD5:8DBAB80279F4D808E13D76424B9D115A
SHA256:23FD301AB5731226C7C42F547A87779D936A7BDE229FD767DD39FE81896E9EC1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
47
TCP/UDP connections
273
DNS requests
53
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3468
iexplore.exe
GET
302
216.58.213.164:80
http://google.co.ck/search?q=mcafee+is+best+antivirus
US
html
366 b
whitelisted
3984
iexplore.exe
GET
302
216.58.213.164:80
http://google.co.ck/search?q=communism
US
html
345 b
whitelisted
3984
iexplore.exe
GET
429
216.58.215.36:80
http://www.google.com/sorry/index?continue=http://google.co.ck/search%3Fq%3Dcommunism&q=EgQlu4GmGKTswOkFIhkA8aeDS-BACgpp30lWdw7wEEWj0M63cGi1MgFy
US
html
2.78 Kb
whitelisted
2996
iexplore.exe
GET
302
216.58.213.164:80
http://google.co.ck/search?q=how+to+make+salad
US
html
359 b
whitelisted
2980
iexplore.exe
GET
302
216.58.213.164:80
http://google.co.ck/search?q=microsoft+recommends
US
html
358 b
whitelisted
2980
iexplore.exe
GET
301
216.58.213.164:80
http://google.co.ck/search?q=cats&tbm=isch
US
html
247 b
whitelisted
3468
iexplore.exe
GET
429
216.58.215.36:80
http://www.google.com/sorry/index?continue=http://google.co.ck/search%3Fq%3Dmcafee%2Bis%2Bbest%2Bantivirus&q=EgQlu4GmGJzswOkFIhkA8aeDSzIBuwIMdIogkzdo72brobKQwM2BMgFy
US
html
2.82 Kb
whitelisted
3468
iexplore.exe
GET
302
216.58.213.163:80
http://www.google.co.ck/search?q=comcast&tbm=isch
US
html
266 b
whitelisted
2320
iexplore.exe
GET
302
216.58.213.164:80
http://google.co.ck/search?q=download+titan+x+for+free
US
html
369 b
whitelisted
3984
iexplore.exe
GET
301
216.58.213.164:80
http://google.co.ck/search?q=cats&tbm=isch
US
html
247 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3480
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3468
iexplore.exe
216.58.215.36:443
www.google.com
Google Inc.
US
whitelisted
3468
iexplore.exe
216.58.215.36:80
www.google.com
Google Inc.
US
whitelisted
3468
iexplore.exe
216.58.213.164:80
google.co.ck
Google Inc.
US
whitelisted
3984
iexplore.exe
216.58.213.164:80
google.co.ck
Google Inc.
US
whitelisted
3984
iexplore.exe
216.58.215.36:80
www.google.com
Google Inc.
US
whitelisted
3984
iexplore.exe
216.58.215.36:443
www.google.com
Google Inc.
US
whitelisted
3468
iexplore.exe
216.58.201.227:443
www.gstatic.com
Google Inc.
US
whitelisted
2320
iexplore.exe
216.58.213.164:80
google.co.ck
Google Inc.
US
whitelisted
2320
iexplore.exe
216.58.213.163:443
www.google.co.ck
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
google.co.ck
  • 216.58.213.164
whitelisted
www.bing.com
  • 204.79.197.200
whitelisted
www.google.com
  • 216.58.215.36
whitelisted
www.gstatic.com
  • 216.58.201.227
whitelisted
www.google.co.ck
  • 216.58.213.163
whitelisted
encrypted-tbn0.gstatic.com
  • 172.217.18.206
whitelisted
answers.microsoft.com
  • 23.38.3.63
whitelisted
play.clubpenguin.com
  • 88.221.134.216
whitelisted
www.clubpenguinisland.com
  • 95.101.39.10
whitelisted
answersstaticfilecdn.azureedge.net
  • 88.221.134.40
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
WaffMEMZ密码malware.7z