analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

5620163803545600.zip

Full analysis: https://app.any.run/tasks/b186815a-5339-48e7-b828-16f9174ff1ae
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: July 18, 2019, 11:00:33
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
opendir
loader
rat
nanocore
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

A823C44B69A808A9265380768BB17AE2

SHA1:

55ADB2186788F426751FEAD59383D2CA3BC7DBBD

SHA256:

E76DC192366A1CD06480F7FFA102892E6F8CB08413C816BDA4C3102273DB4BAD

SSDEEP:

3072:3teQvds1KbkeN9o9IbGIc22LLRvWcWQx7f:3teQvy1Kbfsb22LlvSq7f

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Requests a remote executable file from MS Office

      • EXCEL.EXE (PID: 972)
      • EXCEL.EXE (PID: 1400)
      • EXCEL.EXE (PID: 1748)
      • EXCEL.EXE (PID: 2600)

    • Known privilege escalation attack

      • mpnotifys.exe (PID: 2860)
      • mpnotifys.exe (PID: 2956)
      • mpnotifys.exe (PID: 3540)
      • mpnotifys.exe (PID: 3736)
      • mpnotifys.exe (PID: 3988)

    • Executable content was dropped or overwritten

      • EXCEL.EXE (PID: 972)

    • Unusual execution from Microsoft Office

      • EXCEL.EXE (PID: 972)
      • EXCEL.EXE (PID: 1400)
      • EXCEL.EXE (PID: 1748)
      • EXCEL.EXE (PID: 2644)
      • EXCEL.EXE (PID: 2600)

    • Application was dropped or rewritten from another process

      • mpnotifys.exe (PID: 2860)
      • mpnotifys.exe (PID: 2560)
      • mpnotifys.exe (PID: 2956)
      • mpnotifys.exe (PID: 2452)
      • RegSvcs.exe (PID: 3800)
      • RegSvcs.exe (PID: 3780)
      • mpnotifys.exe (PID: 3736)
      • mpnotifys.exe (PID: 3268)
      • mpnotifys.exe (PID: 3540)
      • RegSvcs.exe (PID: 2072)
      • RegSvcs.exe (PID: 1096)
      • mpnotifys.exe (PID: 3988)
      • mpnotifys.exe (PID: 1576)
      • mpnotifys.exe (PID: 3636)
      • RegSvcs.exe (PID: 3820)
      • RegSvcs.exe (PID: 2148)
      • RegSvcs.exe (PID: 2520)
      • RegSvcs.exe (PID: 280)
      • RegSvcs.exe (PID: 996)
      • RegSvcs.exe (PID: 1804)
      • RegSvcs.exe (PID: 2284)
      • RegSvcs.exe (PID: 572)
      • RegSvcs.exe (PID: 1524)
      • RegSvcs.exe (PID: 2488)
      • RegSvcs.exe (PID: 4080)
      • RegSvcs.exe (PID: 3976)
      • RegSvcs.exe (PID: 4060)
      • RegSvcs.exe (PID: 3256)
      • RegSvcs.exe (PID: 1908)
      • RegSvcs.exe (PID: 3072)
      • RegSvcs.exe (PID: 3096)
      • RegSvcs.exe (PID: 3816)
      • RegSvcs.exe (PID: 3532)
      • RegSvcs.exe (PID: 3624)
      • RegSvcs.exe (PID: 4088)
      • RegSvcs.exe (PID: 2352)
      • RegSvcs.exe (PID: 2696)
      • RegSvcs.exe (PID: 3080)
      • RegSvcs.exe (PID: 4092)
      • RegSvcs.exe (PID: 1772)
      • RegSvcs.exe (PID: 2408)
      • RegSvcs.exe (PID: 1540)
      • RegSvcs.exe (PID: 3628)
      • RegSvcs.exe (PID: 3952)
      • RegSvcs.exe (PID: 3932)
      • RegSvcs.exe (PID: 3796)
      • RegSvcs.exe (PID: 3700)
      • RegSvcs.exe (PID: 3284)
      • RegSvcs.exe (PID: 2636)
      • RegSvcs.exe (PID: 3120)
      • RegSvcs.exe (PID: 1160)
      • RegSvcs.exe (PID: 3764)
      • RegSvcs.exe (PID: 2220)
      • RegSvcs.exe (PID: 2172)
      • RegSvcs.exe (PID: 1684)
      • RegSvcs.exe (PID: 3352)
      • RegSvcs.exe (PID: 3652)
      • RegSvcs.exe (PID: 2504)
      • RegSvcs.exe (PID: 1356)
      • RegSvcs.exe (PID: 3336)
      • RegSvcs.exe (PID: 3648)
      • RegSvcs.exe (PID: 2980)
      • RegSvcs.exe (PID: 1816)
      • RegSvcs.exe (PID: 1316)
      • RegSvcs.exe (PID: 340)
      • RegSvcs.exe (PID: 3004)
      • RegSvcs.exe (PID: 2200)

    • Changes the autorun value in the registry

      • mpnotifys.exe (PID: 2560)
      • RegSvcs.exe (PID: 3800)
      • mpnotifys.exe (PID: 2452)
      • mpnotifys.exe (PID: 3268)
      • mpnotifys.exe (PID: 1576)
      • mpnotifys.exe (PID: 3636)

    • NanoCore was detected

      • RegSvcs.exe (PID: 3800)

  • SUSPICIOUS

    • Executed via COM

      • EXCEL.EXE (PID: 972)
      • EXCEL.EXE (PID: 1400)
      • EXCEL.EXE (PID: 1748)
      • EXCEL.EXE (PID: 2644)
      • EXCEL.EXE (PID: 2600)
      • excelcnv.exe (PID: 3468)

    • Executable content was dropped or overwritten

      • mpnotifys.exe (PID: 2560)
      • RegSvcs.exe (PID: 3800)

    • Suspicious files were dropped or overwritten

      • mpnotifys.exe (PID: 2560)

    • Modifies the open verb of a shell class

      • mpnotifys.exe (PID: 2860)
      • mpnotifys.exe (PID: 2956)
      • mpnotifys.exe (PID: 3540)
      • mpnotifys.exe (PID: 3736)
      • mpnotifys.exe (PID: 3988)

    • Creates files in the program directory

      • RegSvcs.exe (PID: 3800)

    • Creates files in the user directory

      • RegSvcs.exe (PID: 3800)

  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3228)
      • EXCEL.EXE (PID: 972)
      • EXCEL.EXE (PID: 1400)
      • EXCEL.EXE (PID: 1748)
      • EXCEL.EXE (PID: 2644)
      • EXCEL.EXE (PID: 2600)
      • excelcnv.exe (PID: 3468)

    • Manual execution by user

      • WINWORD.EXE (PID: 3228)
      • WinRAR.exe (PID: 4000)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 3228)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: 93ec9f1693fa9d85eaff76bcc01946934e008e73c9f6af474ff9f0378e7ba367
ZipUncompressedSize: 132151
ZipCompressedSize: 132034
ZipCRC: 0x00000000
ZipModifyDate: 1980:00:00 00:00:00
ZipCompression: Unknown (99)
ZipBitFlag: 0x0009
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
130
Monitored processes
86
Malicious processes
21
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winrar.exe no specs winrar.exe no specs winword.exe no specs excel.exe mpnotifys.exe no specs excel.exe eventvwr.exe no specs eventvwr.exe mpnotifys.exe mpnotifys.exe no specs #NANOCORE regsvcs.exe excel.exe eventvwr.exe no specs eventvwr.exe mpnotifys.exe regsvcs.exe no specs mpnotifys.exe no specs excel.exe no specs eventvwr.exe no specs eventvwr.exe mpnotifys.exe mpnotifys.exe no specs excel.exe regsvcs.exe no specs eventvwr.exe no specs eventvwr.exe mpnotifys.exe regsvcs.exe no specs mpnotifys.exe no specs excelcnv.exe no specs eventvwr.exe no specs eventvwr.exe mpnotifys.exe regsvcs.exe no specs regsvcs.exe no specs regsvcs.exe no specs regsvcs.exe no specs regsvcs.exe no specs regsvcs.exe no specs regsvcs.exe no specs regsvcs.exe no specs regsvcs.exe no specs regsvcs.exe no specs regsvcs.exe no specs regsvcs.exe no specs regsvcs.exe no specs regsvcs.exe no specs regsvcs.exe no specs regsvcs.exe no specs regsvcs.exe no specs regsvcs.exe no specs regsvcs.exe no specs regsvcs.exe no specs regsvcs.exe no specs regsvcs.exe no specs regsvcs.exe no specs regsvcs.exe no specs regsvcs.exe no specs regsvcs.exe no specs regsvcs.exe no specs regsvcs.exe no specs regsvcs.exe no specs regsvcs.exe no specs regsvcs.exe no specs regsvcs.exe no specs regsvcs.exe no specs regsvcs.exe no specs regsvcs.exe no specs regsvcs.exe no specs regsvcs.exe no specs regsvcs.exe no specs regsvcs.exe no specs regsvcs.exe no specs regsvcs.exe no specs regsvcs.exe no specs regsvcs.exe no specs regsvcs.exe no specs regsvcs.exe no specs regsvcs.exe no specs regsvcs.exe no specs regsvcs.exe no specs regsvcs.exe no specs regsvcs.exe no specs regsvcs.exe no specs regsvcs.exe no specs regsvcs.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3696"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Downloads\5620163803545600.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
4000"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Nouveau Archive WinRAR.rar"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
3228"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\LISTE DES MANDATS FRAUDULEUX.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
972"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" -EmbeddingC:\Program Files\Microsoft Office\Office14\EXCEL.EXE
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Exit code:
0
Version:
14.0.6024.1000
2860"C:\Users\admin\AppData\Local\Temp\mpnotifys.exe" C:\Users\admin\AppData\Local\Temp\mpnotifys.exe—EXCEL.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
1400"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" -EmbeddingC:\Program Files\Microsoft Office\Office14\EXCEL.EXE
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Exit code:
0
Version:
14.0.6024.1000
2124"C:\Windows\System32\eventvwr.exe" C:\Windows\System32\eventvwr.exe—mpnotifys.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Event Viewer Snapin Launcher
Exit code:
3221226540
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1708"C:\Windows\System32\eventvwr.exe" C:\Windows\System32\eventvwr.exe
mpnotifys.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Event Viewer Snapin Launcher
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2560"C:\Users\admin\AppData\Local\Temp\mpnotifys.exe" C:\Users\admin\AppData\Local\Temp\mpnotifys.exe
eventvwr.exe
User:
admin
Integrity Level:
HIGH
2956"C:\Users\admin\AppData\Local\Temp\mpnotifys.exe" C:\Users\admin\AppData\Local\Temp\mpnotifys.exe—EXCEL.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Total events
5 848
Read events
5 011
Write events
0
Delete events
0

Modification events

No data
Executable files
4
Suspicious files
2
Text files
4
Unknown types
5

Dropped files

PID
Process
Filename
Type
3228WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR406F.tmp.cvr —
MD5:—
SHA256:—
972EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVR4A43.tmp.cvr —
MD5:—
SHA256:—
1400EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVR5B88.tmp.cvr —
MD5:—
SHA256:—
1748EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVR6397.tmp.cvr —
MD5:—
SHA256:—
2644EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVR6C22.tmp.cvr —
MD5:—
SHA256:—
2600EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVR73C4.tmp.cvr —
MD5:—
SHA256:—
3468excelcnv.exeC:\Users\admin\AppData\Local\Temp\CVR7CFB.tmp.cvr —
MD5:—
SHA256:—
3468excelcnv.exeC:\Users\admin\AppData\Local\Temp\~DF538817D06DE56AD7.TMP —
MD5:—
SHA256:—
3228WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~DF9026972C1BF32CA4.TMP —
MD5:—
SHA256:—
3468excelcnv.exeC:\Users\admin\AppData\Local\Temp\~DF92CE712B22F8654B.TMP —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
28
DNS requests
13
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1748
EXCEL.EXE
GET
304
194.59.164.40:80
http://u700222964.hostingerapp.com/mpnotifys.exe
unknown
—
—
suspicious
1400
EXCEL.EXE
GET
304
194.59.164.40:80
http://u700222964.hostingerapp.com/mpnotifys.exe
unknown
—
—
suspicious
2600
EXCEL.EXE
GET
304
194.59.164.40:80
http://u700222964.hostingerapp.com/mpnotifys.exe
unknown
—
—
suspicious
972
EXCEL.EXE
GET
200
194.59.164.40:80
http://u700222964.hostingerapp.com/mpnotifys.exe
unknown
executable
1.23 Mb
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
972
EXCEL.EXE
194.59.164.40:80
u700222964.hostingerapp.com
—
—
suspicious
1400
EXCEL.EXE
194.59.164.40:80
u700222964.hostingerapp.com
—
—
suspicious
3800
RegSvcs.exe
8.8.8.8:53
—
Google Inc.
US
whitelisted
1748
EXCEL.EXE
194.59.164.40:80
u700222964.hostingerapp.com
—
—
suspicious
2600
EXCEL.EXE
194.59.164.40:80
u700222964.hostingerapp.com
—
—
suspicious
3800
RegSvcs.exe
185.247.228.17:47581
etoiilefiiilante.duckdns.org
—
—
malicious
—
—
8.8.8.8:53
—
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
u700222964.hostingerapp.com
  • 194.59.164.40
suspicious
etoiilefiiilante.duckdns.org
  • 185.247.228.17
malicious

Threats

PID
Process
Class
Message
972
EXCEL.EXE
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3800
RegSvcs.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
3800
RegSvcs.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
3800
RegSvcs.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
3800
RegSvcs.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
3800
RegSvcs.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
3800
RegSvcs.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
3800
RegSvcs.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
3800
RegSvcs.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
3800
RegSvcs.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
5620163803545600.zip