analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

ZDS-V7slytDASZe9_AHZemEEUA__1fadae66388efc27bf0e95bd1a721c1d10fe5c798023d799bd709a703459a0db__WE7sC9MQzqs.zip

Full analysis: https://app.any.run/tasks/dc04aceb-b5e4-4f1e-92d0-164182a1744c
Verdict: Malicious activity
Analysis date: October 20, 2020, 09:45:21
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

BB173013DC25FBC1F7FAE65A20A6AA8C

SHA1:

7D1D716B2CA1805BA6050A9141C52BBBD0157A35

SHA256:

EF6FF103C8224A150E2B28DDD6D2A73BEE784AD4A9B1B33591BE3F21A5D91AE5

SSDEEP:

24576:vP+Pg4P372e9iFlXFkHr/6aS6gw2+1E4T1zp4WVg:3+PtPL2zXFkr6afE+1i

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 1fadae66388efc27bf0e95bd1a721c1d10fe5c798023d799bd709a703459a0db.exe (PID: 3416)

  • SUSPICIOUS

    • Creates files in the user directory

      • 1fadae66388efc27bf0e95bd1a721c1d10fe5c798023d799bd709a703459a0db.exe (PID: 3416)

  • INFO

    • Manual execution by user

      • rundll32.exe (PID: 3752)
      • 1fadae66388efc27bf0e95bd1a721c1d10fe5c798023d799bd709a703459a0db.exe (PID: 3416)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: 1fadae66388efc27bf0e95bd1a721c1d10fe5c798023d799bd709a703459a0db
ZipUncompressedSize: 1189888
ZipCompressedSize: 1136842
ZipCRC: 0x54e250bc
ZipModifyDate: 2020:10:20 09:40:11
ZipCompression: Deflated
ZipBitFlag: 0x0809
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs rundll32.exe no specs 1fadae66388efc27bf0e95bd1a721c1d10fe5c798023d799bd709a703459a0db.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3064"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\947a0acc-50f1-4b13-8206-814f5c026983.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3752"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\Desktop\1fadae66388efc27bf0e95bd1a721c1d10fe5c798023d799bd709a703459a0dbC:\Windows\system32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3416"C:\Users\admin\Desktop\1fadae66388efc27bf0e95bd1a721c1d10fe5c798023d799bd709a703459a0db.exe" C:\Users\admin\Desktop\1fadae66388efc27bf0e95bd1a721c1d10fe5c798023d799bd709a703459a0db.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Total events
503
Read events
476
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
0
Text files
0
Unknown types
33

Dropped files

PID
Process
Filename
Type
3064WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3064.47545\1fadae66388efc27bf0e95bd1a721c1d10fe5c798023d799bd709a703459a0db —
MD5:—
SHA256:—
34161fadae66388efc27bf0e95bd1a721c1d10fe5c798023d799bd709a703459a0db.exeC:\Users\admin\AppData\Local\Temp\swf2exe.ini —
MD5:—
SHA256:—
34161fadae66388efc27bf0e95bd1a721c1d10fe5c798023d799bd709a703459a0db.exeC:\Users\admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.solsol
MD5:EA3ABCA7EEAE7CFB9AAEB2A5A8AEFC05
SHA256:6AE8E8902D1546E4EB7B07C077605C54B1ED7FDEC488C268184D8CBB4572C970
34161fadae66388efc27bf0e95bd1a721c1d10fe5c798023d799bd709a703459a0db.exeC:\Users\admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sxxsol
MD5:EA3ABCA7EEAE7CFB9AAEB2A5A8AEFC05
SHA256:6AE8E8902D1546E4EB7B07C077605C54B1ED7FDEC488C268184D8CBB4572C970
34161fadae66388efc27bf0e95bd1a721c1d10fe5c798023d799bd709a703459a0db.exeC:\Users\admin\AppData\Local\Temp\resflash.swfswf
MD5:EEA913EE7A2B9308E61F0A8F4557E89D
SHA256:68263D52474C0A929F21F9D158707D0815BA12BE6E199158462387B9514E5A03
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
ZDS-V7slytDASZe9_AHZemEEUA__1fadae66388efc27bf0e95bd1a721c1d10fe5c798023d799bd709a703459a0db__WE7sC9MQzqs.zip