analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

RAMDisk_Win7-8-8-1_VER20205.7z

Full analysis: https://app.any.run/tasks/bfee0bfb-7726-45eb-befb-d1b70cde6449
Verdict: Malicious activity
Analysis date: January 23, 2019, 01:47:21
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

D7BF11F0EF68BE4B15E09CD5E2687B07

SHA1:

15F61772259ED7E5C1DAA6235A2FD85BFB705595

SHA256:

DBCEFCEC78707561D721B932A481C2B32A071E23E0BED9CD8C871F237431A8BC

SSDEEP:

98304:70r2tqSkDLfnmwJ61JwcR5xL08TZFu24tyYi8ZPQuhH+RdGQDIwLjLkWhNP53:70+qpLfnZonnxQ8/u9tv3ome7GQDHZDF

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • IKernel.exe (PID: 3144)
      • IKernel.exe (PID: 3116)
      • iKernel.exe (PID: 3804)

    • Loads dropped or rewritten executable

      • IKernel.exe (PID: 3116)
      • Setup.exe (PID: 2240)

  • SUSPICIOUS

    • Creates files in the Windows directory

      • AsusSetup.exe (PID: 3204)

    • Executable content was dropped or overwritten

      • Setup.exe (PID: 2240)
      • IKernel.exe (PID: 3116)

    • Creates files in the program directory

      • IKernel.exe (PID: 3116)
      • Setup.exe (PID: 2240)

    • Starts itself from another location

      • IKernel.exe (PID: 3116)

    • Creates COM task schedule object

      • IKernel.exe (PID: 3116)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
7
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start winrar.exe no specs asussetup.exe no specs asussetup.exe setup.exe ikernel.exe no specs ikernel.exe ikernel.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3068"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\RAMDisk_Win7-8-8-1_VER20205.7z"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
2320"C:\Users\admin\Desktop\RAMDisk_Win7-8-8-1_VER20205\AsusSetup.exe" C:\Users\admin\Desktop\RAMDisk_Win7-8-8-1_VER20205\AsusSetup.exe—explorer.exe
User:
admin
Company:
ASUSTeK Computer Inc.
Integrity Level:
MEDIUM
Description:
AsusSetup
Exit code:
3221226540
Version:
2.0.17.3
3204"C:\Users\admin\Desktop\RAMDisk_Win7-8-8-1_VER20205\AsusSetup.exe" C:\Users\admin\Desktop\RAMDisk_Win7-8-8-1_VER20205\AsusSetup.exe
explorer.exe
User:
admin
Company:
ASUSTeK Computer Inc.
Integrity Level:
HIGH
Description:
AsusSetup
Version:
2.0.17.3
2240"C:\Users\admin\Desktop\RAMDisk_Win7-8-8-1_VER20205\x64\Setup.exe" C:\Users\admin\Desktop\RAMDisk_Win7-8-8-1_VER20205\x64\Setup.exe
AsusSetup.exe
User:
admin
Company:
InstallShield Software Corporation
Integrity Level:
HIGH
Description:
InstallShield (R) Setup Launcher
Version:
6, 31, 100, 1190
3144"C:\Program Files\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe" -RegServerC:\Program Files\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe—Setup.exe
User:
admin
Company:
InstallShield Software Corporation
Integrity Level:
HIGH
Description:
InstallShield (R) Setup Engine
Exit code:
0
Version:
6, 31, 100, 1221
3116C:\PROGRA~1\COMMON~1\INSTAL~1\Engine\6\INTEL3~1\IKernel.exe -EmbeddingC:\PROGRA~1\COMMON~1\INSTAL~1\Engine\6\INTEL3~1\IKernel.exe
svchost.exe
User:
admin
Company:
InstallShield Software Corporation
Integrity Level:
HIGH
Description:
InstallShield (R) Setup Engine
Version:
6, 31, 100, 1221
3804"C:\Program Files\Common Files\InstallShield\engine\6\Intel 32\iKernel.exe" /REGSERVERC:\Program Files\Common Files\InstallShield\engine\6\Intel 32\iKernel.exe—IKernel.exe
User:
admin
Company:
InstallShield Software Corporation
Integrity Level:
HIGH
Description:
InstallShield (R) Setup Engine
Exit code:
0
Version:
6, 31, 100, 1221
Total events
1 257
Read events
721
Write events
0
Delete events
0

Modification events

No data
Executable files
8
Suspicious files
4
Text files
33
Unknown types
5

Dropped files

PID
Process
Filename
Type
3068WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3068.11247\RAMDisk_Win7-8-8-1_VER20205\x64\data1.cabcompressed
MD5:25E19C70DEFA675DB210427B9AF876B8
SHA256:4FD2806CFE10DDAEC58E0CB9BC3B3EB609E8834A8E287219BF96216D0D554627
3068WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3068.11247\RAMDisk_Win7-8-8-1_VER20205\x64\data2.cabcompressed
MD5:E6E6280E07F79B97577A749DC7B18D3E
SHA256:C5BB4790CAAC3A6912F767C0559856EEC43188119C6365EAF577595271594882
3068WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3068.11247\RAMDisk_Win7-8-8-1_VER20205\x64\AsusSetup.initext
MD5:A7461B9C1391B49EE33F55B6E98D8CD9
SHA256:EB09C92E6B3B3CF4776E4075EDB8E11888873FD088B8A01064E08191E0F5E77F
3068WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3068.11247\RAMDisk_Win7-8-8-1_VER20205\x64\French.initext
MD5:1EFF955A42840E736684C2F9C7A85A3B
SHA256:49D82A0117BC37EB2C76E36AFAAC2C9EA1A4B87C314F4CA302FEB1410C6071F0
3068WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3068.11247\RAMDisk_Win7-8-8-1_VER20205\AsusSetup.initext
MD5:05CE9E6F452C086CD2921A51E5789EAA
SHA256:6E63415B88C64C0FA7EBB6EB80659F11E67EB28ABF90613D0EBDA7600A1A6AA7
3068WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3068.11247\RAMDisk_Win7-8-8-1_VER20205\x64\setup.isstext
MD5:F3E305408F6DF189D5089FE2A6315004
SHA256:CCA3E8C62E48B7AA7804376595CD00E42A43C752A473ADACF60A80BA9C061D25
3068WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3068.11247\RAMDisk_Win7-8-8-1_VER20205\x64\layout.binbinary
MD5:9E90D48B5ABC969C63ABB2AC316C595F
SHA256:397DC0406DF7505392BBC7596B9D1749E46D84CF7681C60D40BB4781D3A6A28F
3068WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3068.11247\RAMDisk_Win7-8-8-1_VER20205\x64\German.initext
MD5:C4772F9414D9F7BF78B00F3056CB30F3
SHA256:C4DDA6F4689C0E28C28BB9D04002358C8A8F4A4A59DECE234A5CDCC16ED86BCD
3068WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3068.11247\RAMDisk_Win7-8-8-1_VER20205\x64\Korean.initext
MD5:AA04CBF250D5AC37A6CFB1D2A47C15D2
SHA256:7E1AE1EEE165CCA98A3CDBA00957682C31289EDE0895165296CB57B28DF2ED9F
3068WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3068.11247\RAMDisk_Win7-8-8-1_VER20205\x64\AsusSetup.exe.manifestxml
MD5:0F6424259E5D2FBD3D73611B90F3B3F3
SHA256:A6CFCD7889CF69EAD72F9BC9767A7F82D97E490F336F40CC42CAD04116BE99DC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
RAMDisk_Win7-8-8-1_VER20205.7z