analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

RAMDisk_Win7-8-8-1_VER20205.7z

Full analysis: https://app.any.run/tasks/7b58d363-4298-481a-813e-b455973b8f78
Verdict: Malicious activity
Analysis date: January 23, 2019, 01:46:58
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

D7BF11F0EF68BE4B15E09CD5E2687B07

SHA1:

15F61772259ED7E5C1DAA6235A2FD85BFB705595

SHA256:

DBCEFCEC78707561D721B932A481C2B32A071E23E0BED9CD8C871F237431A8BC

SSDEEP:

98304:70r2tqSkDLfnmwJ61JwcR5xL08TZFu24tyYi8ZPQuhH+RdGQDIwLjLkWhNP53:70+qpLfnZonnxQ8/u9tv3ome7GQDHZDF

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Setup.exe (PID: 2296)
      • AsusSetup.exe (PID: 2556)
      • AsusSetup.exe (PID: 3384)
      • IKernel.exe (PID: 2756)
      • iKernel.exe (PID: 3240)
      • iKernel.exe (PID: 2536)
      • IKernel.exe (PID: 2488)
    • Loads dropped or rewritten executable

      • IKernel.exe (PID: 2488)
      • Setup.exe (PID: 2296)
  • SUSPICIOUS

    • Creates files in the Windows directory

      • AsusSetup.exe (PID: 3384)
    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3040)
      • Setup.exe (PID: 2296)
      • IKernel.exe (PID: 2488)
    • Creates files in the program directory

      • Setup.exe (PID: 2296)
      • IKernel.exe (PID: 2488)
    • Starts itself from another location

      • IKernel.exe (PID: 2488)
    • Creates COM task schedule object

      • IKernel.exe (PID: 2488)
  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2288)
    • Creates files in the user directory

      • WINWORD.EXE (PID: 2288)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
9
Malicious processes
1
Suspicious processes
3

Behavior graph

Click at the process to see the details
drop and start drop and start start drop and start winrar.exe asussetup.exe no specs asussetup.exe setup.exe ikernel.exe no specs ikernel.exe ikernel.exe no specs ikernel.exe no specs winword.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3040"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\RAMDisk_Win7-8-8-1_VER20205.7z"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
2556"C:\Users\admin\AppData\Local\Temp\Rar$EXa3040.4821\RAMDisk_Win7-8-8-1_VER20205\AsusSetup.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3040.4821\RAMDisk_Win7-8-8-1_VER20205\AsusSetup.exeWinRAR.exe
User:
admin
Company:
ASUSTeK Computer Inc.
Integrity Level:
MEDIUM
Description:
AsusSetup
Exit code:
3221226540
Version:
2.0.17.3
3384"C:\Users\admin\AppData\Local\Temp\Rar$EXa3040.4821\RAMDisk_Win7-8-8-1_VER20205\AsusSetup.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3040.4821\RAMDisk_Win7-8-8-1_VER20205\AsusSetup.exe
WinRAR.exe
User:
admin
Company:
ASUSTeK Computer Inc.
Integrity Level:
HIGH
Description:
AsusSetup
Exit code:
0
Version:
2.0.17.3
2296"C:\Users\admin\AppData\Local\Temp\Rar$EXa3040.4821\RAMDisk_Win7-8-8-1_VER20205\x64\Setup.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3040.4821\RAMDisk_Win7-8-8-1_VER20205\x64\Setup.exe
AsusSetup.exe
User:
admin
Company:
InstallShield Software Corporation
Integrity Level:
HIGH
Description:
InstallShield (R) Setup Launcher
Exit code:
0
Version:
6, 31, 100, 1190
2756"C:\Program Files\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe" -RegServerC:\Program Files\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exeSetup.exe
User:
admin
Company:
InstallShield Software Corporation
Integrity Level:
HIGH
Description:
InstallShield (R) Setup Engine
Exit code:
0
Version:
6, 31, 100, 1221
2488C:\PROGRA~1\COMMON~1\INSTAL~1\Engine\6\INTEL3~1\IKernel.exe -EmbeddingC:\PROGRA~1\COMMON~1\INSTAL~1\Engine\6\INTEL3~1\IKernel.exe
svchost.exe
User:
admin
Company:
InstallShield Software Corporation
Integrity Level:
HIGH
Description:
InstallShield (R) Setup Engine
Exit code:
0
Version:
6, 31, 100, 1221
3240"C:\Program Files\Common Files\InstallShield\engine\6\Intel 32\iKernel.exe" /REGSERVERC:\Program Files\Common Files\InstallShield\engine\6\Intel 32\iKernel.exeIKernel.exe
User:
admin
Company:
InstallShield Software Corporation
Integrity Level:
HIGH
Description:
InstallShield (R) Setup Engine
Exit code:
0
Version:
6, 31, 100, 1221
2536"C:\Program Files\Common Files\InstallShield\engine\6\Intel 32\iKernel.exe" /UNREGSERVERC:\Program Files\Common Files\InstallShield\engine\6\Intel 32\iKernel.exeIKernel.exe
User:
admin
Company:
InstallShield Software Corporation
Integrity Level:
HIGH
Description:
InstallShield (R) Setup Engine
Exit code:
0
Version:
6, 31, 100, 1221
2288"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\privacyarts.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Total events
8 679
Read events
1 677
Write events
0
Delete events
0

Modification events

No data
Executable files
12
Suspicious files
4
Text files
35
Unknown types
13

Dropped files

PID
Process
Filename
Type
3040WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3040.4821\RAMDisk_Win7-8-8-1_VER20205\x64\German.initext
MD5:C4772F9414D9F7BF78B00F3056CB30F3
SHA256:C4DDA6F4689C0E28C28BB9D04002358C8A8F4A4A59DECE234A5CDCC16ED86BCD
3040WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3040.4821\RAMDisk_Win7-8-8-1_VER20205\x64\data1.cabcompressed
MD5:25E19C70DEFA675DB210427B9AF876B8
SHA256:4FD2806CFE10DDAEC58E0CB9BC3B3EB609E8834A8E287219BF96216D0D554627
3040WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3040.4821\RAMDisk_Win7-8-8-1_VER20205\x64\French.initext
MD5:1EFF955A42840E736684C2F9C7A85A3B
SHA256:49D82A0117BC37EB2C76E36AFAAC2C9EA1A4B87C314F4CA302FEB1410C6071F0
3040WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3040.4821\RAMDisk_Win7-8-8-1_VER20205\x64\AsusSetup.initext
MD5:A7461B9C1391B49EE33F55B6E98D8CD9
SHA256:EB09C92E6B3B3CF4776E4075EDB8E11888873FD088B8A01064E08191E0F5E77F
3040WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3040.4821\RAMDisk_Win7-8-8-1_VER20205\AsusSetup.initext
MD5:05CE9E6F452C086CD2921A51E5789EAA
SHA256:6E63415B88C64C0FA7EBB6EB80659F11E67EB28ABF90613D0EBDA7600A1A6AA7
3040WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3040.4821\RAMDisk_Win7-8-8-1_VER20205\x64\data1.hdrhdr
MD5:755C0280409348711D0B69124DDDCD8A
SHA256:409AFC28276CACA684C9BDB84714B4585864BCA1F3F0527D3E2A74933D381A7E
3040WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3040.4821\RAMDisk_Win7-8-8-1_VER20205\x64\Russian.initext
MD5:33CA80E97CB255234531F5B6DC559160
SHA256:41E61B89650D48BFC45AA3F24074D18389F7499841537CD3B1EEFF28F3A8E8DA
3040WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3040.4821\RAMDisk_Win7-8-8-1_VER20205\x64\setup.inxinx
MD5:1DBF6697515225433BD96BE1E618402C
SHA256:0B5836AC469F5834F0F124F51E22AF3DDD85313141EC66D5F313613BCB97221E
3040WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3040.4821\RAMDisk_Win7-8-8-1_VER20205\x64\Japanese.initext
MD5:D0DC621FCB9D432A2F0E4BB9BCC0FBA4
SHA256:E8CEF0F186BDE7F28F8BA507A21462C9F311C6B22CCC5D94E37117996DFC9EEF
3040WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3040.4821\RAMDisk_Win7-8-8-1_VER20205\x64\data2.cabcompressed
MD5:E6E6280E07F79B97577A749DC7B18D3E
SHA256:C5BB4790CAAC3A6912F767C0559856EEC43188119C6365EAF577595271594882
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info