File name:

factura546532.msi_95463.rar.zip

Full analysis: https://app.any.run/tasks/8c2e589c-dac0-494c-96bd-f9e7dfdd490b
Verdict: Malicious activity
Analysis date: July 09, 2024, 17:32:30
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
banker
mekotio
Indicators:
MIME: application/zip
File info: Zip archive data, at least v5.1 to extract, compression method=AES Encrypted
MD5:

5F5B21F79EE6D11EAB1CFD3A0856D42D

SHA1:

99431CA4FD05F6610753C381DD1872CAA8DA93A2

SHA256:

E04D3E04DB783920DBBAF35772988EF0A156DE99DE6C98C2727BE4F6530B35F5

SSDEEP:

98304:kUeW1CirkLyrMtfq5eZ1y2aYlma/BBiBzbhNacUhEXaP46rWw4GLhT5kEPMEjUlm:iY33yH2gaLmZYTkxPBQavF/7oi

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3344)
      • msiexec.exe (PID: 2748)

    • MEKOTIO has been detected (SURICATA)

      • msiexec.exe (PID: 3144)

  • SUSPICIOUS

    • Application launched itself

      • WinRAR.exe (PID: 3344)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 3532)
      • WinRAR.exe (PID: 3344)
      • msiexec.exe (PID: 3144)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 2748)

    • Connects to unusual port

      • msiexec.exe (PID: 3144)

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 3144)

    • Checks for external IP

      • msiexec.exe (PID: 3144)

    • Reads the Internet Settings

      • msiexec.exe (PID: 3144)

  • INFO

    • Checks supported languages

      • msiexec.exe (PID: 2748)
      • msiexec.exe (PID: 3144)

    • Reads the computer name

      • msiexec.exe (PID: 2748)
      • msiexec.exe (PID: 3144)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 2748)
      • msiexec.exe (PID: 3144)

    • Application launched itself

      • msiexec.exe (PID: 2748)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 2748)

    • Reads Environment values

      • msiexec.exe (PID: 3144)

    • Create files in a temporary directory

      • msiexec.exe (PID: 3144)
      • msiexec.exe (PID: 2748)

    • Reads the software policy settings

      • msiexec.exe (PID: 3144)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 3144)

    • Checks proxy server information

      • msiexec.exe (PID: 3144)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 51
ZipBitFlag: 0x0009
ZipCompression: Unknown (99)
ZipModifyDate: 2024:07:09 17:30:02
ZipCRC: 0x3f7d0f8e
ZipCompressedSize: 13031125
ZipUncompressedSize: 13028608
ZipFileName: factura546532.msi_95463.rar
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
5
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs winrar.exe no specs msiexec.exe no specs msiexec.exe #MEKOTIO msiexec.exe

Process information

PID
CMD
Path
Indicators
Parent process
2748C:\Windows\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3144C:\Windows\system32\MsiExec.exe -Embedding D9D934A12412154E29A733DEA0A70585C:\Windows\System32\msiexec.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3208"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\Rar$EXa3532.18717\factura546532.msi_95463\factura546532.msi_factura546532.msi_95463.msi" C:\Windows\System32\msiexec.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3344"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\factura546532.msi_95463.rar.zipC:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3532"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\Rar$DIb3344.17704\factura546532.msi_95463.rarC:\Program Files\WinRAR\WinRAR.exe—WinRAR.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
Total events
14 404
Read events
14 284
Write events
108
Delete events
12

Modification events

(PID) Process:(3344) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3344) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3344) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3344) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3344) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3344) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(3344) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\factura546532.msi_95463.rar.zip
(PID) Process:(3344) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3344) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3344) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
9
Suspicious files
11
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
3344WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIb3344.17704\factura546532.msi_95463.rar —
MD5:—
SHA256:—
3532WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3532.18717\factura546532.msi_95463\factura546532.msi_factura546532.msi_95463.msi —
MD5:—
SHA256:—
2748msiexec.exeC:\Windows\Installer\52f54.msi —
MD5:—
SHA256:—
2748msiexec.exeC:\Windows\Installer\MSI38FD.tmp —
MD5:—
SHA256:—
2748msiexec.exeC:\Config.Msi\52f57.rbs —
MD5:—
SHA256:—
2748msiexec.exeC:\Windows\Installer\MSI31F4.tmpexecutable
MD5:B158D8D605571EA47A238DF5AB43DFAA
SHA256:CA763693CC25D316F14A9EBAD80EBF00590329550C45ADB7E5205486533C2504
2748msiexec.exeC:\Windows\Installer\MSI3272.tmpexecutable
MD5:B158D8D605571EA47A238DF5AB43DFAA
SHA256:CA763693CC25D316F14A9EBAD80EBF00590329550C45ADB7E5205486533C2504
3144msiexec.exeC:\Users\admin\AppData\Local\Temp\AiFilesBackNoImpers_CEA1AFD8_2FC2_42FE_A2CB_822317A26156.bakbinary
MD5:AE292DB619585AAEBE3D1B591BF98C6B
SHA256:05DFCF23BB5630C410C3CCBC897FB0FAE9FEA991074151B4FE89277CB7B33B6D
2748msiexec.exeC:\Windows\Installer\MSI32B2.tmpexecutable
MD5:B158D8D605571EA47A238DF5AB43DFAA
SHA256:CA763693CC25D316F14A9EBAD80EBF00590329550C45ADB7E5205486533C2504
2748msiexec.exeC:\Windows\Installer\52f56.ipibinary
MD5:9CDBD224BBFC8A480201190A74D731B1
SHA256:ACB2A0D6F551669601E20B3969BE893D2B52314F850F01AA755D5FDFDD976752
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
14
DNS requests
8
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1372
svchost.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
3144
msiexec.exe
GET
200
69.192.161.44:80
http://x1.c.lencr.org/
unknown
—
—
unknown
1060
svchost.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?67a3611ec3c0260d
unknown
—
—
unknown
3144
msiexec.exe
GET
200
184.24.77.57:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgN4GMmBeA8jMFX7CildM4dFVg%3D%3D
unknown
—
—
unknown
1372
svchost.exe
GET
304
199.232.210.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?33775f6043c93e33
unknown
—
—
unknown
1372
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1372
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1060
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
1372
svchost.exe
199.232.210.172:80
ctldl.windowsupdate.com
FASTLY
US
unknown
1372
svchost.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
1372
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
unknown
3144
msiexec.exe
34.117.186.192:443
ipinfo.io
GOOGLE-CLOUD-PLATFORM
US
unknown
3144
msiexec.exe
69.192.161.44:80
x1.c.lencr.org
AKAMAI-AS
DE
unknown
3144
msiexec.exe
184.24.77.57:80
r3.o.lencr.org
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
ctldl.windowsupdate.com
  • 199.232.210.172
  • 199.232.214.172
  • 93.184.221.240
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
ipinfo.io
  • 34.117.186.192
shared
x1.c.lencr.org
  • 69.192.161.44
whitelisted
r3.o.lencr.org
  • 184.24.77.57
  • 184.24.77.80
  • 184.24.77.54
  • 184.24.77.45
  • 184.24.77.47
  • 184.24.77.48
  • 184.24.77.46
  • 184.24.77.83
  • 184.24.77.52
whitelisted

Threats

PID
Process
Class
Message
3144
msiexec.exe
Device Retrieving External IP Address Detected
ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)
3144
msiexec.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup SSL Cert Observed (ipinfo .io)
1060
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ipinfo .io)
3144
msiexec.exe
A Network Trojan was detected
BANKER [ANY.RUN] Mekotio Server Response
3144
msiexec.exe
A Network Trojan was detected
BANKER [ANY.RUN] Mekotio
Process
Message
msiexec.exe
Logger::SetLogFile( C:\Users\admin\AppData\Roaming\Caphyon\Advanced Installer\AI_ResourceCleaner.log ) while OLD path is:
msiexec.exe
Logger::SetLogFile( C:\Users\admin\AppData\Roaming\Caphyon\Advanced Installer\AI_ResourceCleaner.log ) while OLD path is:
msiexec.exe
Logger::SetLogFile( C:\Users\admin\AppData\Roaming\Caphyon\Advanced Installer\AI_ResourceCleaner.log ) while OLD path is:
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
factura546532.msi_95463.rar.zip