analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.zip

Full analysis: https://app.any.run/tasks/2c7bec3c-ed7e-400b-b03f-e3fba7b0eb5c
Verdict: Malicious activity
Analysis date: January 24, 2022, 15:32:39
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v5.1 to extract
MD5:

C05E1ECD00574A1545F9FE380CA48535

SHA1:

E4DB6BA15C8396D449EF056BF9D0CA1A26E190EE

SHA256:

E9571C2045E8F3FE717BDE901DE69192D0346626B11E5489050FF90850E02F2F

SSDEEP:

12288:nMRoBqyP8ITRLnZyVwvxyEpbUB0Dr5RxtI+MgMJC:EoBF8aRb0wvxyUbUBkVRxrOJC

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 332)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 2964)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 1272)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 2928)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 3500)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 304)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 444)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 3180)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 2192)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 2516)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 3092)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 3292)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 3536)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 3300)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 2344)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 1276)
    • Changes the autorun value in the registry

      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 1272)
  • SUSPICIOUS

    • Checks supported languages

      • WinRAR.exe (PID: 3004)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 332)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 2964)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 1272)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 3500)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 2928)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 304)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 3180)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 2192)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 444)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 2516)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 3292)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 3092)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 3536)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 3300)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 2344)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 1276)
    • Reads the computer name

      • WinRAR.exe (PID: 3004)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 332)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 2964)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 2928)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 1272)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 3500)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 304)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 3180)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 2192)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 444)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 3292)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 2516)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 3092)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 2344)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 3300)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 3536)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 1276)
    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 3004)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 1272)
    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3004)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 1272)
    • Application launched itself

      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 332)
    • Reads Environment values

      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 1272)
    • Creates files in the user directory

      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 1272)
  • INFO

    • Manual execution by user

      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 332)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 2964)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 2928)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 3500)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 3180)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 304)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 444)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 2192)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 2516)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 3292)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 3092)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 3536)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 3300)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 2344)
      • 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe (PID: 1276)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe
ZipUncompressedSize: 493568
ZipCompressedSize: 447318
ZipCRC: 0x63297911
ZipModifyDate: 2022:01:24 15:32:15
ZipCompression: Unknown (99)
ZipBitFlag: 0x0003
ZipRequiredVersion: 51
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
52
Monitored processes
17
Malicious processes
16
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe no specs 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe no specs 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe no specs 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe no specs 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe no specs 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe no specs 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe no specs 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe no specs 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe no specs 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe no specs 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe no specs 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe no specs 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe no specs 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe no specs 5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3004"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.zip"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
332"C:\Users\admin\Desktop\5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe" C:\Users\admin\Desktop\5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exeExplorer.EXE
User:
admin
Company:
Mazda
Integrity Level:
MEDIUM
Description:
Yesterday's Records
Exit code:
0
Version:
1.0.0.0
2964"C:\Users\admin\Desktop\5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe" C:\Users\admin\Desktop\5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exeExplorer.EXE
User:
admin
Company:
Mazda
Integrity Level:
MEDIUM
Description:
Yesterday's Records
Exit code:
4294967295
Version:
1.0.0.0
1272"C:\Users\admin\Desktop\5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe"C:\Users\admin\Desktop\5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe
5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe
User:
admin
Company:
Mazda
Integrity Level:
MEDIUM
Description:
Yesterday's Records
Version:
1.0.0.0
2928"C:\Users\admin\Desktop\5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe" C:\Users\admin\Desktop\5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exeExplorer.EXE
User:
admin
Company:
Mazda
Integrity Level:
MEDIUM
Description:
Yesterday's Records
Version:
1.0.0.0
3500"C:\Users\admin\Desktop\5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe" C:\Users\admin\Desktop\5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exeExplorer.EXE
User:
admin
Company:
Mazda
Integrity Level:
MEDIUM
Description:
Yesterday's Records
Version:
1.0.0.0
304"C:\Users\admin\Desktop\5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe" C:\Users\admin\Desktop\5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exeExplorer.EXE
User:
admin
Company:
Mazda
Integrity Level:
MEDIUM
Description:
Yesterday's Records
Version:
1.0.0.0
3180"C:\Users\admin\Desktop\5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe" C:\Users\admin\Desktop\5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exeExplorer.EXE
User:
admin
Company:
Mazda
Integrity Level:
MEDIUM
Description:
Yesterday's Records
Version:
1.0.0.0
2192"C:\Users\admin\Desktop\5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe" C:\Users\admin\Desktop\5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exeExplorer.EXE
User:
admin
Company:
Mazda
Integrity Level:
MEDIUM
Description:
Yesterday's Records
Version:
1.0.0.0
444"C:\Users\admin\Desktop\5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exe" C:\Users\admin\Desktop\5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exeExplorer.EXE
User:
admin
Company:
Mazda
Integrity Level:
MEDIUM
Description:
Yesterday's Records
Version:
1.0.0.0
Total events
1 919
Read events
1 907
Write events
12
Delete events
0

Modification events

(PID) Process:(3004) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3004) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3004) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3004) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3004) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3004) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.zip
(PID) Process:(3004) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3004) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3004) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3004) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
2
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
3004WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3004.2687\5aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exeexecutable
MD5:092150BD4076F81FCB8504C233AB9AEE
SHA256:5ABA9463F9513D9BA1C46A225E94EFD4E46D165E7D8891535EDE13EB5A0F2EAA
12725aba9463f9513d9ba1c46a225e94efd4e46d165e7d8891535ede13eb5a0f2eaa.exeC:\Users\admin\AppData\Roaming\YZtXgX\YZtXgX.exeexecutable
MD5:092150BD4076F81FCB8504C233AB9AEE
SHA256:5ABA9463F9513D9BA1C46A225E94EFD4E46D165E7D8891535EDE13EB5A0F2EAA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info