File name:

SoftAnalisis.zip

Full analysis: https://app.any.run/tasks/5614e3ad-f0cc-45c4-b397-792de40d11de
Verdict: Malicious activity
Analysis date: October 04, 2022, 20:29:11
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

50ACFB00ADC3C10AEE8A32B513D7ABE8

SHA1:

ECB67A5D0A9EC5CAD64A3FF54CE5C7D89393F5A5

SHA256:

ED8EA86A2023FD79B817CBACC14DE71E38FAC1063EAD66FDCFF19232F96B9AF3

SSDEEP:

196608:eVeIq39QG8NOlOdsWNJQ1x1ubA3ENnW00dWAiEBjpF:QwQG8v/MXoAdjbiapF

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • WinRAR.exe (PID: 3264)

    • Application was dropped or rewritten from another process

      • setup.exe (PID: 3700)

    • Drops executable file immediately after starts

      • WinRAR.exe (PID: 3264)

  • SUSPICIOUS

    • Checks supported languages

      • WinRAR.exe (PID: 3264)
      • setup.exe (PID: 3700)
      • dfsvc.exe (PID: 1748)

    • Reads the computer name

      • WinRAR.exe (PID: 3264)
      • dfsvc.exe (PID: 1748)
      • setup.exe (PID: 3700)

    • Reads internet explorer settings

      • dfsvc.exe (PID: 1748)

    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 3264)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3264)

    • Uses RUNDLL32.EXE to load library

      • WinRAR.exe (PID: 3264)

    • Reads Environment values

      • dfsvc.exe (PID: 1748)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • WinRAR.exe (PID: 3264)

    • Checks supported languages

      • rundll32.exe (PID: 2612)
      • rundll32.exe (PID: 2912)

    • Reads the computer name

      • rundll32.exe (PID: 2612)
      • rundll32.exe (PID: 2912)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
5
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start winrar.exe setup.exe no specs dfsvc.exe rundll32.exe no specs rundll32.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1748"C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe
setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
ClickOnce
Exit code:
0
Version:
4.0.30319.34209 built by: FX452RTMGDR
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\dfsvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2612"rundll32.exe" dfshim.dll,ShOpenVerbApplication C:\Users\admin\AppData\Local\Temp\Rar$DIa3264.4277\SEG_ApplicationLayer.applicationC:\Windows\system32\rundll32.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
2912"rundll32.exe" dfshim.dll,ShOpenVerbApplication C:\Users\admin\AppData\Local\Temp\Rar$DIa3264.4775\SEG_ApplicationLayer.applicationC:\Windows\system32\rundll32.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
3264"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\SoftAnalisis.zip"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3700"C:\Users\admin\AppData\Local\Temp\Rar$EXa3264.3177\SoftAnalisis\setup.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3264.3177\SoftAnalisis\setup.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup
Exit code:
0
Version:
16.0.31206.173 built by: D16.10
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3264.3177\softanalisis\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
Total events
1 911
Read events
1 852
Write events
57
Delete events
2

Modification events

(PID) Process:(3264) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3264) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3264) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3264) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3264) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3264) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\SoftAnalisis.zip
(PID) Process:(3264) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3264) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3264) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3264) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
39
Suspicious files
1
Text files
27
Unknown types
0

Dropped files

PID
Process
Filename
Type
3264WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3264.3177\SoftAnalisis\Application Files\SEG_ApplicationLayer_1_0_0_2\C1.Win.C1Command.4.dll.deployexecutable
MD5:—
SHA256:—
3264WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3264.3177\SoftAnalisis\Application Files\SEG_ApplicationLayer_1_0_0_2\C1.Win.C1List.4.dll.deployexecutable
MD5:—
SHA256:—
3264WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3264.3177\SoftAnalisis\Application Files\SEG_ApplicationLayer_1_0_0_2\C1.Win.C1Chart.4.dll.deployexecutable
MD5:—
SHA256:—
3264WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3264.3177\SoftAnalisis\Application Files\SEG_ApplicationLayer_1_0_0_2\C1.Win.C1Ribbon.4.dll.deployexecutable
MD5:—
SHA256:—
3264WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3264.3177\SoftAnalisis\Application Files\SEG_ApplicationLayer_1_0_0_2\C1.Win.C1InputPanel.4.dll.deployexecutable
MD5:—
SHA256:—
3264WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3264.3177\SoftAnalisis\Application Files\SEG_ApplicationLayer_1_0_0_2\CommonEntityLayer.dll.deployexecutable
MD5:—
SHA256:—
3264WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3264.3177\SoftAnalisis\Application Files\SEG_ApplicationLayer_1_0_0_2\C1.C1Excel.4.dll.deployexecutable
MD5:61B27A959E979EA10FA3A97750438BD1
SHA256:9DFF9CC85B08994D47C92E1355294BD598B231067890FAE350DE1495027CBFD1
3264WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3264.3177\SoftAnalisis\Application Files\SEG_ApplicationLayer_1_0_0_2\CommonDataLayer.dll.deployexecutable
MD5:—
SHA256:—
3264WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3264.3177\SoftAnalisis\Application Files\SEG_ApplicationLayer_1_0_0_2\C1.Win.C1Input.4.dll.deployexecutable
MD5:254B7A48B05675961F63008CF028438E
SHA256:1F5C6FE80B9CFE0C990095DD77171C386D04BDDB07E88399CD41B81C14E68B55
3264WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3264.3177\SoftAnalisis\Application Files\SEG_ApplicationLayer_1_0_0_2\C1.Win.C1SuperTooltip.4.dll.deployexecutable
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1748
dfsvc.exe
GET
—
20.81.178.30:80
http://apps.x-pertec.com/SoftAnalisis/Application%20Files/SEG_ApplicationLayer_1_0_0_1/SEG_ApplicationLayer.exe.manifest
US
—
—
whitelisted
1748
dfsvc.exe
GET
200
20.81.178.30:80
http://apps.x-pertec.com/SoftAnalisis/SEG_ApplicationLayer.application
US
xml
2.18 Kb
whitelisted
1748
dfsvc.exe
GET
200
20.81.178.30:80
http://apps.x-pertec.com/SoftAnalisis/SEG_ApplicationLayer.application
US
xml
2.18 Kb
whitelisted
1748
dfsvc.exe
GET
200
20.81.178.30:80
http://apps.x-pertec.com/SoftAnalisis/Application%20Files/SEG_ApplicationLayer_1_0_0_1/SEG_ApplicationLayer.exe.manifest
US
xml
34.0 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1748
dfsvc.exe
20.81.178.30:80
apps.x-pertec.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
apps.x-pertec.com
  • 20.81.178.30
unknown

Threats

No threats detected
Process
Message
dfsvc.exe
*** Status originated: -1073741811 *** Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
dfsvc.exe
*** Status originated: -1073741811 *** Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
dfsvc.exe
*** Status originated: -1073741811 *** Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
dfsvc.exe
*** Status originated: -1073741811 *** Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
dfsvc.exe
*** Status originated: -1073741811 *** Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
dfsvc.exe
*** Status originated: -1073741811 *** Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SoftAnalisis.zip