analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Debug.zip

Full analysis: https://app.any.run/tasks/044ef2f7-b5fd-4414-9dec-cc6c5e597817
Verdict: Malicious activity
Analysis date: August 12, 2022, 14:00:13
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

946A382AE0DA6182C483651785CCF4BC

SHA1:

4CA91B3477330919E3D984E533DD06A49CD2827F

SHA256:

DB0FA2E172995EE6E16038332C69A83B76B70B798B70918960E47E8331FE91D6

SSDEEP:

393216:QTe7x/9tB0F6lG/y1Tk5KobJ7iWPiP5MPTyoW71HxVi2RwQB0gPBIU:QTe7x/9tB0Ecy1TkkgiWqxyW71Rg2BIU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • WinRAR.exe (PID: 3864)
      • PhoenixGrabber.exe (PID: 3028)
      • csc.exe (PID: 2232)

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 3796)

    • Application was dropped or rewritten from another process

      • PhoenixGrabber.exe (PID: 3028)

    • Starts Visual C# compiler

      • PhoenixGrabber.exe (PID: 3028)

  • SUSPICIOUS

    • Reads the computer name

      • WinRAR.exe (PID: 3864)
      • PhoenixGrabber.exe (PID: 3028)

    • Checks supported languages

      • WinRAR.exe (PID: 3864)
      • PhoenixGrabber.exe (PID: 3028)
      • csc.exe (PID: 2232)
      • cvtres.exe (PID: 2468)
      • cmd.exe (PID: 2800)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3864)
      • csc.exe (PID: 2232)
      • PhoenixGrabber.exe (PID: 3028)

    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 3864)
      • PhoenixGrabber.exe (PID: 3028)
      • csc.exe (PID: 2232)

  • INFO

    • Manual execution by user

      • PhoenixGrabber.exe (PID: 3028)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: Debug/
ZipUncompressedSize: -
ZipCompressedSize: -
ZipCRC: 0x00000000
ZipModifyDate: 2022:07:18 18:00:04
ZipCompression: None
ZipBitFlag: -
ZipRequiredVersion: 10
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
6
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe searchprotocolhost.exe no specs phoenixgrabber.exe csc.exe cvtres.exe no specs cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3864"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Debug.zip"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3796"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\system32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7601.24542 (win7sp1_ldr_escrow.191209-2211)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3028"C:\Users\admin\Desktop\Debug\PhoenixGrabber.exe" C:\Users\admin\Desktop\Debug\PhoenixGrabber.exe
Explorer.EXE
User:
admin
Company:
extatent
Integrity Level:
MEDIUM
Description:
Phoenix Grabber
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\desktop\debug\phoenixgrabber.exe
c:\windows\system32\mscoree.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2232"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\ecgmmevk.cmdline"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PhoenixGrabber.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
4.0.30319.34209 built by: FX452RTMGDR
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\csc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcr120_clr0400.dll
c:\windows\system32\ole32.dll
2468C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RESB7BF.tmp" "c:\Users\admin\AppData\Local\Temp\CSCDB86F5FA66754CB0B667E6B8A52DDB1C.TMP"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
12.00.51209.34209 built by: FX452RTMGDR
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\cvtres.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcr120_clr0400.dll
c:\windows\system32\cryptsp.dll
2800"C:\Windows\System32\cmd.exe" /C VMProtect_Con C:\Users\admin\AppData\Local\Temp\\lol.exe C:\Users\admin\Desktop\Debug\lol.exeC:\Windows\System32\cmd.exe—PhoenixGrabber.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
2 128
Read events
2 110
Write events
18
Delete events
0

Modification events

(PID) Process:(3864) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3864) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3864) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3864) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3864) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3864) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Debug.zip
(PID) Process:(3864) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3864) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3864) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3864) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
5
Suspicious files
0
Text files
3
Unknown types
2

Dropped files

PID
Process
Filename
Type
2232csc.exeC:\Users\admin\AppData\Local\Temp\lol.exeexecutable
MD5:7775646E30564722D42B2E8BEA4C3399
SHA256:D66E56E44D224C17B92E91F555EF3D111D6165588B419B0361CC47C662B1E7E4
2232csc.exeC:\Users\admin\AppData\Local\Temp\CSCDB86F5FA66754CB0B667E6B8A52DDB1C.TMPres
MD5:8AE326488A7F6784DAB8B7D6E78E007E
SHA256:B2576CB40EED800BFCB9E54458A69F23656B6AD37C19FF271F98DAF9DEDBA716
3028PhoenixGrabber.exeC:\Users\admin\AppData\Local\Temp\ecgmmevk.cmdlinetext
MD5:1B03E49952C442D53E6DD867CCB5A1C6
SHA256:82B3BA1D7F70416F15275BF761F1A38E1F09BE93B821F4EE596F1BA3897E8A9F
3864WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3864.48378\Debug\PhoenixGrabber.exeexecutable
MD5:8CF5109368A824E33C0A83F11C1F7CCE
SHA256:6F6D8B376CFCBC0F439BB04544151C29223B3CF6CF67176A77FCBB3D1D80375E
2232csc.exeC:\Users\admin\AppData\Local\Temp\ecgmmevk.outtext
MD5:0264A99B9B81A3B6F5825EA0190C6200
SHA256:6DD5B2F28693ED0F1EFA3A2744812C5D17923CB64D064ABB0B7BF430B173B473
3028PhoenixGrabber.exeC:\Users\admin\AppData\Local\Temp\ecgmmevk.0.cstext
MD5:9E1E5557B6DB17126547180E0B6B2016
SHA256:45B47064F3D7D4523608EB1AC965179595C2B9AA6D47958785F21178179CB44E
2468cvtres.exeC:\Users\admin\AppData\Local\Temp\RESB7BF.tmpo
MD5:717E363FE4646874C40D8090D823F56B
SHA256:4EB60100C88E1926B91AC8F27A5C39323B677679FF7B2C4509410D01468220A6
3864WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3864.48378\Debug\BouncyCastle.Crypto.dllexecutable
MD5:F0B3E112CE4807A28E2B5D66A840ED7F
SHA256:333903C7D22A27098E45FC64B77A264AA220605CFBD3E329C200D7E4B42C881C
3028PhoenixGrabber.exeC:\Users\admin\AppData\Local\Temp\VMProtect_Con.exeexecutable
MD5:49FBD72C3A4AF4000E8BAFD34A5D9547
SHA256:F3ADCB446E1A7FB713B34EA2F675CDD059473C094E1B777291443769D6B359A5
3864WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3864.48378\Debug\Newtonsoft.Json.dllexecutable
MD5:081D9558BBB7ADCE142DA153B2D5577A
SHA256:B624949DF8B0E3A6153FDFB730A7C6F4990B6592EE0D922E1788433D276610F3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Debug.zip