analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

RAMDisk_Win7-8-8-1_VER20205.7z

Full analysis: https://app.any.run/tasks/b7e889ff-3a21-4590-a968-48967d533f61
Verdict: Malicious activity
Analysis date: January 23, 2019, 01:49:39
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

D7BF11F0EF68BE4B15E09CD5E2687B07

SHA1:

15F61772259ED7E5C1DAA6235A2FD85BFB705595

SHA256:

DBCEFCEC78707561D721B932A481C2B32A071E23E0BED9CD8C871F237431A8BC

SSDEEP:

98304:70r2tqSkDLfnmwJ61JwcR5xL08TZFu24tyYi8ZPQuhH+RdGQDIwLjLkWhNP53:70+qpLfnZonnxQ8/u9tv3ome7GQDHZDF

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • AsusSetup.exe (PID: 3536)
      • AsusSetup.exe (PID: 2608)
      • Setup.exe (PID: 2464)
      • IKernel.exe (PID: 2940)
      • iKernel.exe (PID: 3108)
      • iKernel.exe (PID: 3592)
      • IKernel.exe (PID: 2972)

    • Loads dropped or rewritten executable

      • IKernel.exe (PID: 2972)
      • Setup.exe (PID: 2464)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Setup.exe (PID: 2464)
      • WinRAR.exe (PID: 3084)
      • IKernel.exe (PID: 2972)

    • Creates files in the Windows directory

      • AsusSetup.exe (PID: 3536)

    • Creates files in the program directory

      • Setup.exe (PID: 2464)
      • IKernel.exe (PID: 2972)

    • Starts itself from another location

      • IKernel.exe (PID: 2972)

    • Creates COM task schedule object

      • IKernel.exe (PID: 2972)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
8
Malicious processes
1
Suspicious processes
3

Behavior graph

Click at the process to see the details
drop and start drop and start start drop and start winrar.exe asussetup.exe no specs asussetup.exe setup.exe ikernel.exe no specs ikernel.exe ikernel.exe no specs ikernel.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3084"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\RAMDisk_Win7-8-8-1_VER20205.7z"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
2608"C:\Users\admin\AppData\Local\Temp\Rar$EXa3084.21443\RAMDisk_Win7-8-8-1_VER20205\AsusSetup.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3084.21443\RAMDisk_Win7-8-8-1_VER20205\AsusSetup.exe—WinRAR.exe
User:
admin
Company:
ASUSTeK Computer Inc.
Integrity Level:
MEDIUM
Description:
AsusSetup
Exit code:
3221226540
Version:
2.0.17.3
3536"C:\Users\admin\AppData\Local\Temp\Rar$EXa3084.21443\RAMDisk_Win7-8-8-1_VER20205\AsusSetup.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3084.21443\RAMDisk_Win7-8-8-1_VER20205\AsusSetup.exe
WinRAR.exe
User:
admin
Company:
ASUSTeK Computer Inc.
Integrity Level:
HIGH
Description:
AsusSetup
Exit code:
0
Version:
2.0.17.3
2464"C:\Users\admin\AppData\Local\Temp\Rar$EXa3084.21443\RAMDisk_Win7-8-8-1_VER20205\x64\Setup.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3084.21443\RAMDisk_Win7-8-8-1_VER20205\x64\Setup.exe
AsusSetup.exe
User:
admin
Company:
InstallShield Software Corporation
Integrity Level:
HIGH
Description:
InstallShield (R) Setup Launcher
Exit code:
0
Version:
6, 31, 100, 1190
2940"C:\Program Files\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe" -RegServerC:\Program Files\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe—Setup.exe
User:
admin
Company:
InstallShield Software Corporation
Integrity Level:
HIGH
Description:
InstallShield (R) Setup Engine
Exit code:
0
Version:
6, 31, 100, 1221
2972C:\PROGRA~1\COMMON~1\INSTAL~1\Engine\6\INTEL3~1\IKernel.exe -EmbeddingC:\PROGRA~1\COMMON~1\INSTAL~1\Engine\6\INTEL3~1\IKernel.exe
svchost.exe
User:
admin
Company:
InstallShield Software Corporation
Integrity Level:
HIGH
Description:
InstallShield (R) Setup Engine
Exit code:
0
Version:
6, 31, 100, 1221
3592"C:\Program Files\Common Files\InstallShield\engine\6\Intel 32\iKernel.exe" /REGSERVERC:\Program Files\Common Files\InstallShield\engine\6\Intel 32\iKernel.exe—IKernel.exe
User:
admin
Company:
InstallShield Software Corporation
Integrity Level:
HIGH
Description:
InstallShield (R) Setup Engine
Exit code:
0
Version:
6, 31, 100, 1221
3108"C:\Program Files\Common Files\InstallShield\engine\6\Intel 32\iKernel.exe" /UNREGSERVERC:\Program Files\Common Files\InstallShield\engine\6\Intel 32\iKernel.exe—IKernel.exe
User:
admin
Company:
InstallShield Software Corporation
Integrity Level:
HIGH
Description:
InstallShield (R) Setup Engine
Exit code:
0
Version:
6, 31, 100, 1221
Total events
8 005
Read events
1 059
Write events
0
Delete events
0

Modification events

No data
Executable files
12
Suspicious files
4
Text files
33
Unknown types
9

Dropped files

PID
Process
Filename
Type
3084WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3084.21443\RAMDisk_Win7-8-8-1_VER20205\x64\data1.cabcompressed
MD5:25E19C70DEFA675DB210427B9AF876B8
SHA256:4FD2806CFE10DDAEC58E0CB9BC3B3EB609E8834A8E287219BF96216D0D554627
3084WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3084.21443\RAMDisk_Win7-8-8-1_VER20205\x64\French.initext
MD5:1EFF955A42840E736684C2F9C7A85A3B
SHA256:49D82A0117BC37EB2C76E36AFAAC2C9EA1A4B87C314F4CA302FEB1410C6071F0
3084WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3084.21443\RAMDisk_Win7-8-8-1_VER20205\AsusSetup.initext
MD5:05CE9E6F452C086CD2921A51E5789EAA
SHA256:6E63415B88C64C0FA7EBB6EB80659F11E67EB28ABF90613D0EBDA7600A1A6AA7
3084WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3084.21443\RAMDisk_Win7-8-8-1_VER20205\x64\AsusSetup.initext
MD5:A7461B9C1391B49EE33F55B6E98D8CD9
SHA256:EB09C92E6B3B3CF4776E4075EDB8E11888873FD088B8A01064E08191E0F5E77F
3084WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3084.21443\RAMDisk_Win7-8-8-1_VER20205\x64\English.initext
MD5:D6B2EC13BDF78C2DD1576F7EAD987D37
SHA256:2A02D8E5D229A8EE83457949A902585418E8B84BD1DD64A9A51A34ADAF0D504B
3084WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3084.21443\RAMDisk_Win7-8-8-1_VER20205\x64\Russian.initext
MD5:33CA80E97CB255234531F5B6DC559160
SHA256:41E61B89650D48BFC45AA3F24074D18389F7499841537CD3B1EEFF28F3A8E8DA
3084WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3084.21443\RAMDisk_Win7-8-8-1_VER20205\x64\SChinese.initext
MD5:41F1BC38E4D8D0F7707BD54B42D6575F
SHA256:78E30A9D2B4966754C9441489E449BFA143A004D3C18ADEC4661418873C6DACA
3084WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3084.21443\RAMDisk_Win7-8-8-1_VER20205\x64\Spanish.initext
MD5:35C0825C50E04CD248CC35703BC26AC5
SHA256:C433EF7A865630D4FCAAF36C29DACB93A5F1D3A712DE2B337BA720EB948856C0
3084WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3084.21443\RAMDisk_Win7-8-8-1_VER20205\x64\data1.hdrhdr
MD5:755C0280409348711D0B69124DDDCD8A
SHA256:409AFC28276CACA684C9BDB84714B4585864BCA1F3F0527D3E2A74933D381A7E
3084WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3084.21443\RAMDisk_Win7-8-8-1_VER20205\x64\layout.binbinary
MD5:9E90D48B5ABC969C63ABB2AC316C595F
SHA256:397DC0406DF7505392BBC7596B9D1749E46D84CF7681C60D40BB4781D3A6A28F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
RAMDisk_Win7-8-8-1_VER20205.7z