File name:

SoftAnalisis.zip

Full analysis: https://app.any.run/tasks/0c45224c-f384-44c3-8f1a-d5c398e97399
Verdict: Malicious activity
Analysis date: October 04, 2022, 20:46:48
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

50ACFB00ADC3C10AEE8A32B513D7ABE8

SHA1:

ECB67A5D0A9EC5CAD64A3FF54CE5C7D89393F5A5

SHA256:

ED8EA86A2023FD79B817CBACC14DE71E38FAC1063EAD66FDCFF19232F96B9AF3

SSDEEP:

196608:eVeIq39QG8NOlOdsWNJQ1x1ubA3ENnW00dWAiEBjpF:QwQG8v/MXoAdjbiapF

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • WinRAR.exe (PID: 3472)

    • Drops executable file immediately after starts

      • WinRAR.exe (PID: 3472)

    • Application was dropped or rewritten from another process

      • setup.exe (PID: 1880)

  • SUSPICIOUS

    • Reads the computer name

      • WinRAR.exe (PID: 3472)
      • dfsvc.exe (PID: 3784)
      • setup.exe (PID: 1880)

    • Uses RUNDLL32.EXE to load library

      • WinRAR.exe (PID: 3472)

    • Checks supported languages

      • WinRAR.exe (PID: 3472)
      • dfsvc.exe (PID: 3784)
      • setup.exe (PID: 1880)

    • Reads Environment values

      • dfsvc.exe (PID: 3784)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3472)

    • Reads internet explorer settings

      • dfsvc.exe (PID: 3784)

    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 3472)

  • INFO

    • Checks supported languages

      • rundll32.exe (PID: 1596)

    • Reads the computer name

      • rundll32.exe (PID: 1596)

    • Dropped object may contain Bitcoin addresses

      • WinRAR.exe (PID: 3472)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
4
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start start winrar.exe rundll32.exe no specs dfsvc.exe setup.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1596"rundll32.exe" dfshim.dll,ShOpenVerbApplication C:\Users\admin\AppData\Local\Temp\Rar$DIa3472.8363\SEG_ApplicationLayer.applicationC:\Windows\system32\rundll32.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
1880"C:\Users\admin\AppData\Local\Temp\Rar$EXa3472.11908\SoftAnalisis\setup.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3472.11908\SoftAnalisis\setup.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup
Exit code:
0
Version:
16.0.31206.173 built by: D16.10
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3472.11908\softanalisis\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcrt.dll
3472"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\SoftAnalisis.zip"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3784"C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe
rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
ClickOnce
Exit code:
0
Version:
4.0.30319.34209 built by: FX452RTMGDR
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\dfsvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
1 785
Read events
1 726
Write events
57
Delete events
2

Modification events

(PID) Process:(3472) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3472) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3472) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3472) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3472) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3472) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\SoftAnalisis.zip
(PID) Process:(3472) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3472) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3472) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3472) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
39
Suspicious files
1
Text files
23
Unknown types
0

Dropped files

PID
Process
Filename
Type
3472WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa3472.8363\SEG_ApplicationLayer.applicationxml
MD5:—
SHA256:—
3472WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3472.11908\SoftAnalisis\Application Files\SEG_ApplicationLayer_1_0_0_2\C1.Win.C1Command.4.dll.deployexecutable
MD5:—
SHA256:—
3472WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3472.11908\SoftAnalisis\Application Files\SEG_ApplicationLayer_1_0_0_2\C1.Win.C1Chart.4.dll.deployexecutable
MD5:—
SHA256:—
3472WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3472.11908\SoftAnalisis\Application Files\SEG_ApplicationLayer_1_0_0_2\C1.Win.C1Ribbon.4.dll.deployexecutable
MD5:—
SHA256:—
3784dfsvc.exeC:\Users\admin\AppData\Local\Temp\Deployment\Q30PHD1Z.RJG\5LGYP4M5.XH8.applicationxml
MD5:—
SHA256:—
3472WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3472.11908\SoftAnalisis\Application Files\SEG_ApplicationLayer_1_0_0_2\C1.Win.C1List.4.dll.deployexecutable
MD5:—
SHA256:—
3472WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3472.11908\SoftAnalisis\Application Files\SEG_ApplicationLayer_1_0_0_2\C1.Win.C1Schedule.4.dll.deployexecutable
MD5:—
SHA256:—
3472WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3472.11908\SoftAnalisis\Application Files\SEG_ApplicationLayer_1_0_0_2\C1.Win.C1SuperTooltip.4.dll.deployexecutable
MD5:—
SHA256:—
3472WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3472.11908\SoftAnalisis\Application Files\SEG_ApplicationLayer_1_0_0_2\C1.Win.C1TileControl.4.dll.deployexecutable
MD5:—
SHA256:—
3784dfsvc.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\6DLW9JGQ.logtext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
3
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3784
dfsvc.exe
20.81.178.30:80
apps.x-pertec.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
apps.x-pertec.com
  • 20.81.178.30
unknown
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

No threats detected
Process
Message
dfsvc.exe
*** Status originated: -1073741811 *** Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
dfsvc.exe
*** Status originated: -1073741811 *** Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
dfsvc.exe
*** Status originated: -1073741811 *** Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SoftAnalisis.zip