File name:

RC7.zip

Full analysis: https://app.any.run/tasks/c46a1633-4bf5-49c4-a765-9ca4c3fa877c
Verdict: Malicious activity
Analysis date: September 18, 2023, 13:41:50
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

969E35B7E89E91FC8FE43AAF37522BF1

SHA1:

3DB5217B148790102F8BD5DC78055042CF81650D

SHA256:

E3DDD5E0BE260F532C9FB7EEB5315B377859E5164943BB1577A2477C97D750EF

SSDEEP:

196608:cKi6ANPUJ9Xyvy7CUq1+akdzD3z67EEI2l4NZZm/5fJYwqm:u5NspyvFgpzP64EIJN7m/5RYw9

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • RC7.exe (PID: 2012)
      • Memcheck.exe (PID: 2480)
      • RC7.exe (PID: 1848)

    • Application was dropped or rewritten from another process

      • RC7.exe (PID: 2012)
      • Project Daylight.exe (PID: 2772)
      • Memcheck.exe (PID: 3576)
      • Memcheck.exe (PID: 2084)
      • Elysian.exe (PID: 540)
      • ExtremeInjector.exe (PID: 2560)
      • ExtremeInjector.exe (PID: 2724)
      • Memcheck.exe (PID: 2480)
      • accountchange.exe (PID: 4068)
      • Halycon.exe (PID: 1788)
      • RC7.exe (PID: 1848)

  • SUSPICIOUS

    • Reads the Internet Settings

      • RC7.exe (PID: 2012)
      • Project Daylight.exe (PID: 2772)
      • ExtremeInjector.exe (PID: 2560)
      • ExtremeInjector.exe (PID: 2724)

    • Application launched itself

      • ExtremeInjector.exe (PID: 2560)

  • INFO

    • Checks supported languages

      • RC7.exe (PID: 2012)
      • Project Daylight.exe (PID: 2772)
      • Memcheck.exe (PID: 2084)
      • Memcheck.exe (PID: 2608)
      • Memcheck.exe (PID: 2480)
      • ExtremeInjector.exe (PID: 2724)
      • ExtremeInjector.exe (PID: 2560)
      • accountchange.exe (PID: 4068)
      • RC7.exe (PID: 1848)

    • Manual execution by a user

      • RC7.exe (PID: 2012)
      • Project Daylight.exe (PID: 2772)
      • accountchange.exe (PID: 4068)

    • Reads the computer name

      • RC7.exe (PID: 2012)
      • Project Daylight.exe (PID: 2772)
      • Memcheck.exe (PID: 2084)
      • Memcheck.exe (PID: 2480)
      • ExtremeInjector.exe (PID: 2560)
      • ExtremeInjector.exe (PID: 2724)
      • RC7.exe (PID: 1848)
      • accountchange.exe (PID: 4068)

    • Reads the machine GUID from the registry

      • RC7.exe (PID: 2012)
      • ExtremeInjector.exe (PID: 2560)
      • ExtremeInjector.exe (PID: 2724)

    • Application launched itself

      • msedge.exe (PID: 2768)

    • Create files in a temporary directory

      • Memcheck.exe (PID: 2084)
      • Memcheck.exe (PID: 2608)
      • ExtremeInjector.exe (PID: 2724)

    • Reads Environment values

      • ExtremeInjector.exe (PID: 2724)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: RC7/accountchange.exe
ZipUncompressedSize: 642048
ZipCompressedSize: 236083
ZipCRC: 0x10375708
ZipModifyDate: 2016:07:04 02:14:28
ZipCompression: Deflated
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
70
Monitored processes
26
Malicious processes
5
Suspicious processes
3

Behavior graph

Click at the process to see the details
start drop and start winrar.exe no specs searchprotocolhost.exe no specs rc7.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs project daylight.exe no specs memcheck.exe no specs memcheck.exe memcheck.exe no specs memcheck.exe elysian.exe no specs extremeinjector.exe no specs extremeinjector.exe halycon.exe no specs msedge.exe no specs msedge.exe no specs rc7.exe no specs accountchange.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
540"C:\Users\admin\Desktop\RC7\Elysian.exe" C:\Users\admin\Desktop\RC7\Elysian.exe—Project Daylight.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225781
Modules
Images
c:\users\admin\desktop\rc7\elysian.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1528"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1412 --field-trial-handle=1328,i,9972145990188867017,2262720744741652140,131072 /prefetch:3C:\Program Files\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1584"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=1492 --field-trial-handle=1328,i,9972145990188867017,2262720744741652140,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1788"C:\Users\admin\Desktop\RC7\Halycon.exe" C:\Users\admin\Desktop\RC7\Halycon.exe—Project Daylight.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225781
Modules
Images
c:\users\admin\desktop\rc7\halycon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1848"C:\Users\admin\Desktop\RC7\RC7.exe" C:\Users\admin\Desktop\RC7\RC7.exe—Project Daylight.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\rc7\rc7.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\psapi.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\winmm.dll
2012"C:\Users\admin\Desktop\RC7\RC7.exe" C:\Users\admin\Desktop\RC7\RC7.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\rc7\rc7.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\psapi.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
2040"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1300 --field-trial-handle=1328,i,9972145990188867017,2262720744741652140,131072 /prefetch:2C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\microsoft\edge\application\msedge.exe
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
2084"C:\Users\admin\Desktop\RC7\Memcheck.exe" C:\Users\admin\Desktop\RC7\Memcheck.exe
Project Daylight.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\rc7\memcheck.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\usp10.dll
c:\windows\system32\user32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
2480C:\Users\admin\AppData\Local\Temp\cetrainers\CET76B8.tmp\extracted\Memcheck.exe "C:\Users\admin\AppData\Local\Temp\cetrainers\CET76B8.tmp\extracted\CET_TRAINER.CETRAINER" "-ORIGIN:C:\Users\admin\Desktop\RC7\"C:\Users\admin\AppData\Local\Temp\cetrainers\CET76B8.tmp\extracted\Memcheck.exe
Memcheck.exe
User:
admin
Company:
Cheat Engine
Integrity Level:
HIGH
Description:
Cheat Engine
Exit code:
0
Version:
6.5.0.4590
Modules
Images
c:\users\admin\appdata\local\temp\cetrainers\cet76b8.tmp\extracted\memcheck.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2560"C:\Users\admin\Desktop\RC7\ExtremeInjector.exe" C:\Users\admin\Desktop\RC7\ExtremeInjector.exe—Project Daylight.exe
User:
admin
Company:
master131
Integrity Level:
MEDIUM
Description:
Extreme Injector
Exit code:
0
Version:
3.6.1.0
Modules
Images
c:\users\admin\desktop\rc7\extremeinjector.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
9 402
Read events
9 268
Write events
130
Delete events
4

Modification events

(PID) Process:(3748) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\178\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3748) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3748) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3748) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3748) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3748) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3748) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3748) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2564) SearchProtocolHost.exeKey:HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\178\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2012) RC7.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:NodeSlots
Value:
0202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202
Executable files
20
Suspicious files
21
Text files
46
Unknown types
0

Dropped files

PID
Process
Filename
Type
3748WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3748.984\RC7\elysian.dllexecutable
MD5:E518A3AD28D7410B585455A3E915FE55
SHA256:DB47A84BB3BB93C381D2C13D744C18106E8C310C9B7C074D0FC99CBC908E25EF
3748WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3748.984\RC7\accountchange.exeexecutable
MD5:C4F8790EC53D25C9271BCA94D3E7553A
SHA256:56066AE5481C334937483DD0EE1874D44C97B87263BD7D81E6AFC414AFB6363A
3748WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3748.984\RC7\Injector or.exeexecutable
MD5:DFB31FBD3FE18A501D657C88F2B2D4AA
SHA256:6B80ADD0DE5968DC30C5EB37445264C204360B6FF1B87860B0CEBA7F3CA104A1
3748WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3748.984\RC7\lua5.1.dllexecutable
MD5:EE3043C17751C763E26D03F6EEBB1B8B
SHA256:26384C6EE7D50863E3FB65FDC1BAD452D9311F34D782390401DE9BB130EECC4A
3748WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3748.984\RC7\memcheck(1) (1).dllexecutable
MD5:8D2EBBC526125E43A6203983F7C71E61
SHA256:43AE9D049DE8287160475A1288AD7ACAADCE278B088279EAEA869886E9A43FAB
3748WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3748.984\RC7\Project Daylight.exeexecutable
MD5:E942326D0A4A23B575A3BCAF8E687549
SHA256:6638E5FB2F507D0EC46B7CE4CEE04C5758806AA26DB9B788853F06C2E2CAD311
3748WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3748.984\RC7\Memcheck.dllexecutable
MD5:D0AED298460A16C1B587875D411B0B4A
SHA256:E4E19790BE03A782497D9CA11F74010B6A016127DE984C7CB67A9AC2D04BDFB6
2768msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF1037cb.TMP —
MD5:—
SHA256:—
3748WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3748.984\RC7\Memcheck(1).dllexecutable
MD5:8D2EBBC526125E43A6203983F7C71E61
SHA256:43AE9D049DE8287160475A1288AD7ACAADCE278B088279EAEA869886E9A43FAB
2768msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
31
DNS requests
28
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2768
msedge.exe
239.255.255.250:1900
—
—
—
whitelisted
1528
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
1528
msedge.exe
142.250.184.206:443
drive.google.com
GOOGLE
US
whitelisted
1528
msedge.exe
204.79.197.239:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
1528
msedge.exe
20.105.73.143:443
nav-edge.smartscreen.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
1528
msedge.exe
104.126.37.160:443
www.bing.com
Akamai International B.V.
DE
unknown
1528
msedge.exe
152.199.21.175:443
msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com
EDGECAST
DE
whitelisted
1528
msedge.exe
13.107.21.239:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown

DNS requests

Domain
IP
Reputation
drive.google.com
  • 142.250.184.206
shared
config.edge.skype.com
  • 13.107.42.16
whitelisted
edge.microsoft.com
  • 204.79.197.239
  • 13.107.21.239
whitelisted
nav-edge.smartscreen.microsoft.com
  • 20.105.73.143
whitelisted
www.bing.com
  • 104.126.37.160
  • 104.126.37.177
  • 104.126.37.153
  • 104.126.37.155
  • 104.126.37.170
  • 104.126.37.162
  • 104.126.37.168
  • 104.126.37.171
  • 104.126.37.161
whitelisted
msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com
  • 152.199.21.175
whitelisted
self.events.data.microsoft.com
  • 20.189.173.9
whitelisted
fonts.googleapis.com
  • 142.250.186.42
whitelisted
fonts.gstatic.com
  • 216.58.206.35
whitelisted
ssl.gstatic.com
  • 216.58.206.35
whitelisted

Threats

No threats detected
Process
Message
Memcheck.exe
sizeof fxstate = 512
Memcheck.exe
Offset of LBR_Count=760
Memcheck.exe
TSymhandler.create 3
Memcheck.exe
TSymhandler.create 1
Memcheck.exe
TSymhandler.create 2
Memcheck.exe
TSymhandler.create exit
Memcheck.exe
TSymhandler.create 2
Memcheck.exe
TSymhandler.create 1
Memcheck.exe
TSymhandler.create
Memcheck.exe
TSymbolListHandler.create exit
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
RC7.zip