analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

part_9e99badafa05569ca4989ffb833074222d9b5ef526641fc57139613b4dd09b4c.zip

Full analysis: https://app.any.run/tasks/1bd88b23-2dbe-4d7a-afbb-d70ba40b6a87
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Malware Trends Tracker     >>>
Analysis date: April 23, 2019, 11:32:48
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
trojan
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

39B38B1BBC6C768639F18741AC98E86F

SHA1:

44BB33AFA5260A1B6DDAC499820AE277EB026412

SHA256:

DFEFFDE2A0EF06F3EA95475FB57FBCE77F1DC073E33A9B14F6A06E7B69384C70

SSDEEP:

6144:3sk+hjTQkA7zbdllAAYfzS0VdgW0wM16Rf88WMOg19p:8kk0rpYLSYqIMYZMo

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • enquiry-POL2387IBMB654.exe (PID: 2096)
      • explorer.exe (PID: 2824)
      • explorer.exe (PID: 936)
      • enquiry-POL2387IBMB654.exe (PID: 2360)
      • explorer.exe (PID: 3604)
      • explorer.exe (PID: 3096)
      • explorer.exe (PID: 3048)
      • explorer.exe (PID: 2352)

    • Writes to a start menu file

      • explorer.exe (PID: 936)
      • explorer.exe (PID: 3048)

    • Actions looks like stealing of personal data

      • explorer.exe (PID: 2824)
      • explorer.exe (PID: 3096)

    • Changes settings of System certificates

      • explorer.exe (PID: 2824)

  • SUSPICIOUS

    • Uses RUNDLL32.EXE to load library

      • control.exe (PID: 2244)

    • Executable content was dropped or overwritten

      • enquiry-POL2387IBMB654.exe (PID: 2096)

    • Creates executable files which already exist in Windows

      • enquiry-POL2387IBMB654.exe (PID: 2096)

    • Creates files in the user directory

      • enquiry-POL2387IBMB654.exe (PID: 2096)
      • explorer.exe (PID: 936)
      • explorer.exe (PID: 3048)

    • Starts itself from another location

      • enquiry-POL2387IBMB654.exe (PID: 2096)
      • enquiry-POL2387IBMB654.exe (PID: 2360)

    • Application launched itself

      • explorer.exe (PID: 936)
      • explorer.exe (PID: 3048)

    • Checks for external IP

      • explorer.exe (PID: 2824)
      • explorer.exe (PID: 3096)

    • Loads DLL from Mozilla Firefox

      • explorer.exe (PID: 2824)
      • explorer.exe (PID: 3096)

    • Adds / modifies Windows certificates

      • explorer.exe (PID: 2824)

  • INFO

    • Reads settings of System Certificates

      • explorer.exe (PID: 2824)
      • explorer.exe (PID: 3096)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 788
ZipBitFlag: 0x0001
ZipCompression: Deflated
ZipModifyDate: 2019:04:23 09:38:15
ZipCRC: 0xd730ea7b
ZipCompressedSize: 350173
ZipUncompressedSize: 667648
ZipFileName: enquiry-POL2387IBMB654.iso
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
57
Monitored processes
12
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winrar.exe no specs control.exe no specs rundll32.exe no specs winrar.exe no specs enquiry-pol2387ibmb654.exe explorer.exe enquiry-pol2387ibmb654.exe no specs explorer.exe explorer.exe no specs explorer.exe explorer.exe explorer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
456"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\part_9e99badafa05569ca4989ffb833074222d9b5ef526641fc57139613b4dd09b4c.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
2244"C:\Windows\System32\control.exe" "C:\Windows\System32\timedate.cpl",C:\Windows\System32\control.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Control Panel
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3152"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Windows\System32\timedate.cpl",C:\Windows\system32\rundll32.exe—control.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1492"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\enquiry-POL2387IBMB654.iso" C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
2096"C:\Users\admin\Desktop\enquiry-POL2387IBMB654.exe" C:\Users\admin\Desktop\enquiry-POL2387IBMB654.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
936"C:\Users\admin\AppData\Roaming\windows\explorer.exe"C:\Users\admin\AppData\Roaming\windows\explorer.exe
enquiry-POL2387IBMB654.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
2360"C:\Users\admin\Desktop\enquiry-POL2387IBMB654.exe" C:\Users\admin\Desktop\enquiry-POL2387IBMB654.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2824"C:\Users\admin\AppData\Roaming\windows\explorer.exe"C:\Users\admin\AppData\Roaming\windows\explorer.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
4294967295
3604"C:\Users\admin\AppData\Roaming\windows\explorer.exe" 2 2824 1108078C:\Users\admin\AppData\Roaming\windows\explorer.exe—explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
4294967295
3048"C:\Users\admin\AppData\Roaming\windows\explorer.exe"C:\Users\admin\AppData\Roaming\windows\explorer.exe
enquiry-POL2387IBMB654.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Total events
849
Read events
781
Write events
68
Delete events
0

Modification events

(PID) Process:(456) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(456) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(456) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(456) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\part_9e99badafa05569ca4989ffb833074222d9b5ef526641fc57139613b4dd09b4c.zip
(PID) Process:(456) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(456) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(456) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(456) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(456) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E
Operation:writeName:@C:\Windows\System32\isoburn.exe,-350
Value:
Disc Image File
(PID) Process:(2244) control.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
Executable files
1
Suspicious files
1
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
1492WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1492.28075\enquiry-POL2387IBMB654.exe —
MD5:—
SHA256:—
2096enquiry-POL2387IBMB654.exeC:\Users\admin\AppData\Roaming\windows\explorer.exe:ZoneIdentifier —
MD5:—
SHA256:—
2360enquiry-POL2387IBMB654.exeC:\Users\admin\AppData\Roaming\windows\explorer.exe:ZoneIdentifier —
MD5:—
SHA256:—
456WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb456.24861\enquiry-POL2387IBMB654.isocompressed
MD5:0A1F3AD39B78D28BAB586E7AACC0D5C9
SHA256:9E99BADAFA05569CA4989FFB833074222D9B5EF526641FC57139613B4DD09B4C
936explorer.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windows.vbstext
MD5:9C03460D338DAB1D95C79A5256BB0D61
SHA256:3FA218C5828C7F2970BC88E0928E63033761994DA86AA0E93FAAE923B97A82E1
3048explorer.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windows.vbstext
MD5:9C03460D338DAB1D95C79A5256BB0D61
SHA256:3FA218C5828C7F2970BC88E0928E63033761994DA86AA0E93FAAE923B97A82E1
2096enquiry-POL2387IBMB654.exeC:\Users\admin\AppData\Roaming\windows\explorer.exeexecutable
MD5:266181A714E195C2ACB9A1DE3C046869
SHA256:F525394B2636C84DD9EBA3D996504D7A61D0B34B536E17CE71F203F736E1859D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
4
DNS requests
3
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3096
explorer.exe
GET
200
131.186.113.70:80
http://checkip.dyndns.org/
US
html
105 b
shared
2824
explorer.exe
GET
200
131.186.113.70:80
http://checkip.dyndns.org/
US
html
105 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2824
explorer.exe
217.70.178.9:587
mail.gandi.net
GANDI SAS
FR
malicious
2824
explorer.exe
131.186.113.70:80
checkip.dyndns.org
—
US
malicious
3096
explorer.exe
131.186.113.70:80
checkip.dyndns.org
—
US
malicious
3096
explorer.exe
217.70.178.9:587
mail.gandi.net
GANDI SAS
FR
malicious

DNS requests

Domain
IP
Reputation
checkip.dyndns.org
  • 131.186.113.70
  • 216.146.43.71
  • 216.146.43.70
shared
mail.gandi.net
  • 217.70.178.9
shared

Threats

PID
Process
Class
Message
—
—
Misc activity
ET INFO DYNAMIC_DNS Query to *.dyndns. Domain
2824
explorer.exe
Potential Corporate Privacy Violation
ET POLICY External IP Lookup - checkip.dyndns.org
2824
explorer.exe
Potential Corporate Privacy Violation
POLICY [PTsecurity] External IP Check checkip.dyndns.org
2824
explorer.exe
Potentially Bad Traffic
ET POLICY DynDNS CheckIp External IP Address Server Response
3096
explorer.exe
Potential Corporate Privacy Violation
ET POLICY External IP Lookup - checkip.dyndns.org
3096
explorer.exe
Potential Corporate Privacy Violation
POLICY [PTsecurity] External IP Check checkip.dyndns.org
3096
explorer.exe
Potentially Bad Traffic
ET POLICY DynDNS CheckIp External IP Address Server Response
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
part_9e99badafa05569ca4989ffb833074222d9b5ef526641fc57139613b4dd09b4c.zip