analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
download:

7ev3n.zip

Full analysis: https://app.any.run/tasks/cca6e283-8890-40ee-811c-a266f29d954a
Verdict: Malicious activity
Analysis date: November 29, 2020, 21:50:57
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

C6F3D62C4FB57212172D358231E027BC

SHA1:

11276D7A49093A51F04667975E718BB15BC1289B

SHA256:

EA60123EC363610C8CFCD0AD5F0AB2832934AF69A3C715020A09E6D907691D4C

SSDEEP:

3072:4JB/Rmo5VYvT/dQVB3gUm1lnjhvBzXL0x2vkRFd+OqpzdyG6osCvS8LS7:CF5VYDmVBhm1lnjhvBrLqHDydyLCqd

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • [email protected] (PID: 1088)
      • system.exe (PID: 1892)
      • uac.exe (PID: 3500)
      • system.exe (PID: 3884)
      • winsat.exe (PID: 3332)
      • winsat.exe (PID: 2960)

    • Drops executable file immediately after starts

      • [email protected] (PID: 1088)
      • system.exe (PID: 1892)
      • uac.exe (PID: 3500)
      • wusa.exe (PID: 3296)

    • Loads dropped or rewritten executable

      • winsat.exe (PID: 3332)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 1188)

    • Uses Task Scheduler to autorun other applications

      • cmd.exe (PID: 3580)

    • Changes the autorun value in the registry

      • reg.exe (PID: 2924)

    • UAC/LUA settings modification

      • reg.exe (PID: 2116)

    • Changes the login/logoff helper path in the registry

      • reg.exe (PID: 1020)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1908)
      • [email protected] (PID: 1088)
      • system.exe (PID: 1892)
      • uac.exe (PID: 3500)
      • wusa.exe (PID: 3296)

    • Drops a file that was compiled in debug mode

      • WinRAR.exe (PID: 1908)
      • [email protected] (PID: 1088)
      • uac.exe (PID: 3500)
      • wusa.exe (PID: 3296)

    • Starts itself from another location

    • Starts CMD.EXE for commands execution

      • system.exe (PID: 1892)
      • uac.exe (PID: 3500)
      • system.exe (PID: 3884)

    • Creates files in the Windows directory

      • wusa.exe (PID: 3296)

    • Removes files from Windows directory

      • wusa.exe (PID: 3296)

    • Uses REG.EXE to modify Windows registry

      • cmd.exe (PID: 3844)
      • cmd.exe (PID: 2344)
      • cmd.exe (PID: 3020)
      • cmd.exe (PID: 2504)
      • cmd.exe (PID: 1016)
      • cmd.exe (PID: 1716)
      • cmd.exe (PID: 3272)

  • INFO

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0001
ZipCompression: Deflated
ZipModifyDate: 2019:10:10 17:33:20
ZipCRC: 0xfaa96043
ZipCompressedSize: 142919
ZipUncompressedSize: 322560
ZipFileName: [email protected]
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
93
Monitored processes
32
Malicious processes
7
Suspicious processes
3

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start winrar.exe [email protected] system.exe cmd.exe no specs cmd.exe no specs uac.exe cmd.exe no specs wusa.exe no specs wusa.exe no specs wusa.exe winsat.exe no specs winsat.exe system.exe no specs cmd.exe no specs cmd.exe schtasks.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs reg.exe reg.exe reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs shutdown.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1908"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\7ev3n.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
1073807364
Version:
5.60.0
1088"C:\Users\admin\Desktop\7ev3n\[email protected]" C:\Users\admin\Desktop\7ev3n\[email protected]
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
1892"C:\Users\admin\AppData\Local\system.exe"C:\Users\admin\AppData\Local\system.exe
[email protected]
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
3132cmd /c C:\Users\admin\AppData\Local\del.batC:\Windows\system32\cmd.exe—system.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3472cmd.exe /c C:\Users\admin\AppData\Local\uac.exe 32 C:\Users\admin\AppData\Local\system.exeC:\Windows\system32\cmd.exe—system.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3500C:\Users\admin\AppData\Local\uac.exe 32 C:\Users\admin\AppData\Local\system.exeC:\Users\admin\AppData\Local\uac.exe
cmd.exe
User:
admin
Company:
UG North
Integrity Level:
MEDIUM
Description:
UACMe main module
Exit code:
0
Version:
1.9.0.0
3460"C:\Windows\System32\cmd.exe" /c wusa C:\Users\admin\AppData\Local\Temp\ellocnak.msu /extract:%windir%\system32\sysprepC:\Windows\System32\cmd.exe—uac.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1952wusa C:\Users\admin\AppData\Local\Temp\ellocnak.msu /extract:C:\Windows\system32\sysprepC:\Windows\system32\wusa.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Update Standalone Installer
Exit code:
3221226540
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2148"C:\Windows\system32\wusa.exe" C:\Users\admin\AppData\Local\Temp\ellocnak.msu /extract:C:\Windows\system32\sysprepC:\Windows\system32\wusa.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Update Standalone Installer
Exit code:
3221226540
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3296"C:\Windows\system32\wusa.exe" C:\Users\admin\AppData\Local\Temp\ellocnak.msu /extract:C:\Windows\system32\sysprepC:\Windows\system32\wusa.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Update Standalone Installer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
587
Read events
527
Write events
0
Delete events
0

Modification events

No data
Executable files
8
Suspicious files
18
Text files
4
Unknown types
1

Dropped files

PID
Process
Filename
Type
1088[email protected]C:\Users\admin\AppData\Local\Temp\CabE023.tmp —
MD5:—
SHA256:—
1088[email protected]C:\Users\admin\AppData\Local\Temp\TarE024.tmp —
MD5:—
SHA256:—
3500uac.exeC:\Users\admin\AppData\Local\Temp\emcE14C.tmp —
MD5:—
SHA256:—
3500uac.exeC:\Users\admin\AppData\Local\Temp\emcE14D.tmp —
MD5:—
SHA256:—
3500uac.exeC:\Users\admin\AppData\Local\Temp\emcE14E.tmp —
MD5:—
SHA256:—
3500uac.exeC:\Users\admin\AppData\Local\Temp\emcE14F.tmp —
MD5:—
SHA256:—
3500uac.exeC:\Users\admin\AppData\Local\Temp\emcE150.tmp —
MD5:—
SHA256:—
3296wusa.exeC:\Windows\system32\sysprep\$dpx$.tmp\f0f86983dfea74418ecc81f58b0af9d0.tmp —
MD5:—
SHA256:—
3296wusa.exeC:\Windows\system32\sysprep\$dpx$.tmp\56460aaf8c158f4eb6057ef1811390f0.tmp —
MD5:—
SHA256:—
3296wusa.exeC:\Windows\Logs\DPX\setuperr.log —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
2
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1088
[email protected]
104.16.54.3:443
blockchain.info
Cloudflare Inc
US
shared

DNS requests

Domain
IP
Reputation
blockchain.info
  • 104.16.54.3
  • 104.16.55.3
shared
jaster.in
  • —
malicious

Threats

No threats detected
Process
Message
uac.exe
[UCM] Dll dropped successfully
winsat.exe
Akagi letter found
winsat.exe
Akagi letter found
winsat.exe
C:\Users\admin\AppData\Local\system.exe
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
7ev3n.zip