analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

RAMDisk_Win7-8-8-1_VER20205.7z

Full analysis: https://app.any.run/tasks/fd64e945-69ed-440f-9e0d-a8146ea37b32
Verdict: Malicious activity
Analysis date: January 23, 2019, 01:43:41
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

D7BF11F0EF68BE4B15E09CD5E2687B07

SHA1:

15F61772259ED7E5C1DAA6235A2FD85BFB705595

SHA256:

DBCEFCEC78707561D721B932A481C2B32A071E23E0BED9CD8C871F237431A8BC

SSDEEP:

98304:70r2tqSkDLfnmwJ61JwcR5xL08TZFu24tyYi8ZPQuhH+RdGQDIwLjLkWhNP53:70+qpLfnZonnxQ8/u9tv3ome7GQDHZDF

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • AsusSetup.exe (PID: 3164)
      • Setup.exe (PID: 3024)
      • AsusSetup.exe (PID: 1636)
      • IKernel.exe (PID: 3508)
      • IKernel.exe (PID: 3444)
      • iKernel.exe (PID: 2256)
      • iKernel.exe (PID: 4072)
      • AsusSetup.exe (PID: 252)
      • Setup.exe (PID: 3464)
      • IKernel.exe (PID: 792)
      • IKernel.exe (PID: 2144)
      • AsusSetup.exe (PID: 2392)
      • iKernel.exe (PID: 2724)
      • AsusSetup.exe (PID: 2324)
      • iKernel.exe (PID: 1104)
      • AsusSetup.exe (PID: 3416)

    • Loads dropped or rewritten executable

      • Setup.exe (PID: 3024)
      • IKernel.exe (PID: 3444)
      • IKernel.exe (PID: 2144)
      • Setup.exe (PID: 3464)

  • SUSPICIOUS

    • Creates files in the Windows directory

      • AsusSetup.exe (PID: 1636)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3108)
      • Setup.exe (PID: 3024)
      • IKernel.exe (PID: 3444)
      • Setup.exe (PID: 3464)
      • IKernel.exe (PID: 2144)

    • Creates files in the program directory

      • Setup.exe (PID: 3024)
      • IKernel.exe (PID: 3444)
      • Setup.exe (PID: 3464)
      • IKernel.exe (PID: 2144)

    • Starts itself from another location

      • IKernel.exe (PID: 3444)
      • IKernel.exe (PID: 2144)

    • Creates COM task schedule object

      • IKernel.exe (PID: 2144)
      • IKernel.exe (PID: 3444)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
55
Monitored processes
17
Malicious processes
5
Suspicious processes
3

Behavior graph

Click at the process to see the details
drop and start drop and start drop and start drop and start drop and start drop and start start drop and start drop and start winrar.exe asussetup.exe no specs asussetup.exe setup.exe ikernel.exe no specs ikernel.exe ikernel.exe no specs ikernel.exe no specs asussetup.exe no specs asussetup.exe setup.exe ikernel.exe no specs ikernel.exe ikernel.exe no specs ikernel.exe no specs asussetup.exe no specs asussetup.exe

Process information

PID
CMD
Path
Indicators
Parent process
3108"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\RAMDisk_Win7-8-8-1_VER20205.7z"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
3164"C:\Users\admin\AppData\Local\Temp\Rar$EXa3108.36041\RAMDisk_Win7-8-8-1_VER20205\AsusSetup.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3108.36041\RAMDisk_Win7-8-8-1_VER20205\AsusSetup.exe—WinRAR.exe
User:
admin
Company:
ASUSTeK Computer Inc.
Integrity Level:
MEDIUM
Description:
AsusSetup
Exit code:
3221226540
Version:
2.0.17.3
1636"C:\Users\admin\AppData\Local\Temp\Rar$EXa3108.36041\RAMDisk_Win7-8-8-1_VER20205\AsusSetup.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3108.36041\RAMDisk_Win7-8-8-1_VER20205\AsusSetup.exe
WinRAR.exe
User:
admin
Company:
ASUSTeK Computer Inc.
Integrity Level:
HIGH
Description:
AsusSetup
Exit code:
0
Version:
2.0.17.3
3024"C:\Users\admin\AppData\Local\Temp\Rar$EXa3108.36041\RAMDisk_Win7-8-8-1_VER20205\x64\Setup.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3108.36041\RAMDisk_Win7-8-8-1_VER20205\x64\Setup.exe
AsusSetup.exe
User:
admin
Company:
InstallShield Software Corporation
Integrity Level:
HIGH
Description:
InstallShield (R) Setup Launcher
Exit code:
0
Version:
6, 31, 100, 1190
3508"C:\Program Files\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe" -RegServerC:\Program Files\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe—Setup.exe
User:
admin
Company:
InstallShield Software Corporation
Integrity Level:
HIGH
Description:
InstallShield (R) Setup Engine
Exit code:
0
Version:
6, 31, 100, 1221
3444C:\PROGRA~1\COMMON~1\INSTAL~1\Engine\6\INTEL3~1\IKernel.exe -EmbeddingC:\PROGRA~1\COMMON~1\INSTAL~1\Engine\6\INTEL3~1\IKernel.exe
svchost.exe
User:
admin
Company:
InstallShield Software Corporation
Integrity Level:
HIGH
Description:
InstallShield (R) Setup Engine
Exit code:
0
Version:
6, 31, 100, 1221
4072"C:\Program Files\Common Files\InstallShield\engine\6\Intel 32\iKernel.exe" /REGSERVERC:\Program Files\Common Files\InstallShield\engine\6\Intel 32\iKernel.exe—IKernel.exe
User:
admin
Company:
InstallShield Software Corporation
Integrity Level:
HIGH
Description:
InstallShield (R) Setup Engine
Exit code:
0
Version:
6, 31, 100, 1221
2256"C:\Program Files\Common Files\InstallShield\engine\6\Intel 32\iKernel.exe" /UNREGSERVERC:\Program Files\Common Files\InstallShield\engine\6\Intel 32\iKernel.exe—IKernel.exe
User:
admin
Company:
InstallShield Software Corporation
Integrity Level:
HIGH
Description:
InstallShield (R) Setup Engine
Exit code:
0
Version:
6, 31, 100, 1221
252"C:\Users\admin\AppData\Local\Temp\Rar$EXa3108.37259\RAMDisk_Win7-8-8-1_VER20205\x86\AsusSetup.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3108.37259\RAMDisk_Win7-8-8-1_VER20205\x86\AsusSetup.exe—WinRAR.exe
User:
admin
Company:
ASUSTeK Computer Inc.
Integrity Level:
MEDIUM
Description:
AsusSetup
Exit code:
3221226540
Version:
2.0.17.3
2392"C:\Users\admin\AppData\Local\Temp\Rar$EXa3108.37259\RAMDisk_Win7-8-8-1_VER20205\x86\AsusSetup.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3108.37259\RAMDisk_Win7-8-8-1_VER20205\x86\AsusSetup.exe
WinRAR.exe
User:
admin
Company:
ASUSTeK Computer Inc.
Integrity Level:
HIGH
Description:
AsusSetup
Exit code:
0
Version:
2.0.17.3
Total events
9 823
Read events
1 989
Write events
0
Delete events
0

Modification events

No data
Executable files
28
Suspicious files
11
Text files
91
Unknown types
21

Dropped files

PID
Process
Filename
Type
3108WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3108.36041\RAMDisk_Win7-8-8-1_VER20205\x64\French.initext
MD5:1EFF955A42840E736684C2F9C7A85A3B
SHA256:49D82A0117BC37EB2C76E36AFAAC2C9EA1A4B87C314F4CA302FEB1410C6071F0
3108WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3108.36041\RAMDisk_Win7-8-8-1_VER20205\x64\data2.cabcompressed
MD5:E6E6280E07F79B97577A749DC7B18D3E
SHA256:C5BB4790CAAC3A6912F767C0559856EEC43188119C6365EAF577595271594882
3108WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3108.36041\RAMDisk_Win7-8-8-1_VER20205\x64\English.initext
MD5:D6B2EC13BDF78C2DD1576F7EAD987D37
SHA256:2A02D8E5D229A8EE83457949A902585418E8B84BD1DD64A9A51A34ADAF0D504B
3108WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3108.36041\RAMDisk_Win7-8-8-1_VER20205\x64\data1.hdrhdr
MD5:755C0280409348711D0B69124DDDCD8A
SHA256:409AFC28276CACA684C9BDB84714B4585864BCA1F3F0527D3E2A74933D381A7E
3108WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3108.36041\RAMDisk_Win7-8-8-1_VER20205\x64\layout.binbinary
MD5:9E90D48B5ABC969C63ABB2AC316C595F
SHA256:397DC0406DF7505392BBC7596B9D1749E46D84CF7681C60D40BB4781D3A6A28F
3108WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3108.36041\RAMDisk_Win7-8-8-1_VER20205\x64\Spanish.initext
MD5:35C0825C50E04CD248CC35703BC26AC5
SHA256:C433EF7A865630D4FCAAF36C29DACB93A5F1D3A712DE2B337BA720EB948856C0
3108WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3108.36041\RAMDisk_Win7-8-8-1_VER20205\AsusSetup.initext
MD5:05CE9E6F452C086CD2921A51E5789EAA
SHA256:6E63415B88C64C0FA7EBB6EB80659F11E67EB28ABF90613D0EBDA7600A1A6AA7
3108WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3108.36041\RAMDisk_Win7-8-8-1_VER20205\x64\SChinese.initext
MD5:41F1BC38E4D8D0F7707BD54B42D6575F
SHA256:78E30A9D2B4966754C9441489E449BFA143A004D3C18ADEC4661418873C6DACA
3108WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3108.36041\RAMDisk_Win7-8-8-1_VER20205\x64\AsusSetup.initext
MD5:A7461B9C1391B49EE33F55B6E98D8CD9
SHA256:EB09C92E6B3B3CF4776E4075EDB8E11888873FD088B8A01064E08191E0F5E77F
3108WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3108.36041\RAMDisk_Win7-8-8-1_VER20205\x64\setup.inxinx
MD5:1DBF6697515225433BD96BE1E618402C
SHA256:0B5836AC469F5834F0F124F51E22AF3DDD85313141EC66D5F313613BCB97221E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
RAMDisk_Win7-8-8-1_VER20205.7z