File name:

snx.7z

Full analysis: https://app.any.run/tasks/c259b100-d3a2-480e-a6c3-668ef2fd886d
Verdict: Malicious activity
Analysis date: February 11, 2022, 11:13:34
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

D528BFCB0EDA366B74A797081F49DF8F

SHA1:

BA2C13DFA83A9EB391E4D91FDC96849550EDF32D

SHA256:

F154E4C4E98B3B3EC22ECFD7A391A10F9A3835173780A542B48F9E1FFE3EB0DD

SSDEEP:

24576:PsLIZW7dLMlVtE8KRVORXXFj9Gd73YsqEPzPI0z//wvxXK4x:PsLI479MlbgVOiqwzPI0T/UxXKC

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • DrvInst.exe (PID: 2180)
      • DrvInst.exe (PID: 2404)

    • Changes the autorun value in the registry

      • DrvInst.exe (PID: 2404)

    • Registers / Runs the DLL via REGSVR32.EXE

      • MsiExec.exe (PID: 1872)

    • Starts NET.EXE for service management

      • MsiExec.exe (PID: 1872)

    • Adds new firewall rule via NETSH.EXE

      • MsiExec.exe (PID: 1872)

    • Application was dropped or rewritten from another process

      • vna_utils.exe (PID: 1612)
      • vna_utils.exe (PID: 1220)
      • slimsvc.exe (PID: 3552)
      • slimsvc.exe (PID: 3712)

    • Loads dropped or rewritten executable

      • DrvInst.exe (PID: 2404)
      • vna_utils.exe (PID: 1612)
      • vna_utils.exe (PID: 1220)
      • slimsvc.exe (PID: 3712)
      • slimsvc.exe (PID: 3552)

  • SUSPICIOUS

    • Reads the computer name

      • WinRAR.exe (PID: 1472)
      • vna_utils.exe (PID: 1220)
      • DrvInst.exe (PID: 2180)
      • DrvInst.exe (PID: 2404)
      • slimsvc.exe (PID: 3552)
      • slimsvc.exe (PID: 3712)
      • vna_utils.exe (PID: 1612)

    • Checks supported languages

      • WinRAR.exe (PID: 1472)
      • vna_utils.exe (PID: 1220)
      • DrvInst.exe (PID: 2180)
      • DrvInst.exe (PID: 2404)
      • slimsvc.exe (PID: 3712)
      • slimsvc.exe (PID: 3552)
      • vna_utils.exe (PID: 1612)

    • Executed as Windows Service

      • msiexec.exe (PID: 2956)
      • vssvc.exe (PID: 3700)
      • slimsvc.exe (PID: 3712)

    • Drops a file with too old compile date

      • WinRAR.exe (PID: 1472)
      • msiexec.exe (PID: 2956)

    • Starts Microsoft Installer

      • WinRAR.exe (PID: 1472)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1472)
      • msiexec.exe (PID: 676)
      • msiexec.exe (PID: 2956)
      • vna_utils.exe (PID: 1220)
      • DrvInst.exe (PID: 2180)
      • DrvInst.exe (PID: 2404)

    • Reads Windows owner or organization settings

      • msiexec.exe (PID: 676)
      • msiexec.exe (PID: 2956)

    • Reads the Windows organization settings

      • msiexec.exe (PID: 676)
      • msiexec.exe (PID: 2956)

    • Application launched itself

      • msiexec.exe (PID: 2956)

    • Searches for installed software

      • msiexec.exe (PID: 2956)

    • Creates files in the program directory

      • msiexec.exe (PID: 2956)
      • slimsvc.exe (PID: 3712)

    • Reads Environment values

      • vssvc.exe (PID: 3700)
      • DrvInst.exe (PID: 2404)
      • netsh.exe (PID: 1888)

    • Creates a directory in Program Files

      • msiexec.exe (PID: 2956)

    • Drops a file that was compiled in debug mode

      • msiexec.exe (PID: 2956)
      • vna_utils.exe (PID: 1220)
      • DrvInst.exe (PID: 2180)
      • DrvInst.exe (PID: 2404)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 2956)

    • Creates files in the driver directory

      • DrvInst.exe (PID: 2180)
      • DrvInst.exe (PID: 2404)

    • Removes files from Windows directory

      • DrvInst.exe (PID: 2180)
      • DrvInst.exe (PID: 2404)

    • Creates files in the Windows directory

      • DrvInst.exe (PID: 2180)
      • DrvInst.exe (PID: 2404)

    • Executed via COM

      • DrvInst.exe (PID: 2404)
      • DrvInst.exe (PID: 2180)

    • Uses NETSH.EXE for network configuration

      • MsiExec.exe (PID: 1872)

  • INFO

    • Reads settings of System Certificates

      • msiexec.exe (PID: 676)
      • msiexec.exe (PID: 2956)
      • vna_utils.exe (PID: 1220)
      • DrvInst.exe (PID: 2180)
      • DrvInst.exe (PID: 2404)

    • Checks supported languages

      • msiexec.exe (PID: 676)
      • msiexec.exe (PID: 2956)
      • MsiExec.exe (PID: 1608)
      • vssvc.exe (PID: 3700)
      • MsiExec.exe (PID: 1872)
      • regsvr32.exe (PID: 2256)
      • net1.exe (PID: 2440)
      • net.exe (PID: 3788)
      • netsh.exe (PID: 1888)
      • MsiExec.exe (PID: 516)

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 676)
      • msiexec.exe (PID: 2956)
      • vna_utils.exe (PID: 1220)
      • DrvInst.exe (PID: 2180)
      • DrvInst.exe (PID: 2404)

    • Reads the computer name

      • msiexec.exe (PID: 676)
      • msiexec.exe (PID: 2956)
      • MsiExec.exe (PID: 1608)
      • MsiExec.exe (PID: 1872)
      • vssvc.exe (PID: 3700)
      • net1.exe (PID: 2440)
      • netsh.exe (PID: 1888)
      • MsiExec.exe (PID: 516)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
57
Monitored processes
17
Malicious processes
6
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe msiexec.exe msiexec.exe msiexec.exe no specs vssvc.exe no specs msiexec.exe vna_utils.exe drvinst.exe drvinst.exe regsvr32.exe no specs slimsvc.exe no specs net.exe no specs net1.exe no specs slimsvc.exe no specs vna_utils.exe no specs netsh.exe no specs msiexec.exe

Process information

PID
CMD
Path
Indicators
Parent process
516C:\Windows\system32\MsiExec.exe -Embedding F5D959405CF1266EA885A5E8DCC15F48C:\Windows\system32\MsiExec.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows� installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
676"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\Rar$EXa1472.17696\snx\cpextender.msi" C:\Windows\System32\msiexec.exe
WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows� installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1220"C:\Program Files\CheckPoint\SSL Network Extender\vna_utils.exe" -an vna dev install "C:\Program Files\CheckPoint\SSL Network Extender\netvna.inf" cp_vnaC:\Program Files\CheckPoint\SSL Network Extender\vna_utils.exe
MsiExec.exe
User:
SYSTEM
Company:
Check Point Software Technologies
Integrity Level:
SYSTEM
Exit code:
0
Version:
80,0,0070,15
Modules
Images
c:\program files\checkpoint\ssl network extender\vna_utils.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1472"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\snx.7z"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1608C:\Windows\system32\MsiExec.exe -Embedding 0E2427034DB6F4BB42575E2529001BDC CC:\Windows\system32\MsiExec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows� installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1612"C:\Program Files\CheckPoint\SSL Network Extender\vna_utils.exe" -an vna drv loadC:\Program Files\CheckPoint\SSL Network Extender\vna_utils.exe—MsiExec.exe
User:
SYSTEM
Company:
Check Point Software Technologies
Integrity Level:
SYSTEM
Exit code:
0
Version:
80,0,0070,15
Modules
Images
c:\program files\checkpoint\ssl network extender\vna_utils.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1872C:\Windows\system32\MsiExec.exe -Embedding DFA132C92E31293C24AD8EA412DEC7DC E Global\MSI0000C:\Windows\system32\MsiExec.exe
msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows� installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1888netsh advfirewall firewall add rule name = "SSL Network Extender Service" program = "C:\Program Files\CheckPoint\SSL Network Extender\slimsvc.exe" action = allow dir = inC:\Windows\system32\netsh.exe—MsiExec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\netsh.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
2180DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{0e3ba491-72b9-3836-965f-8d0f761dc945}\netvna.inf" "0" "6c6a8e163" "0000057C" "WinSta0\Default" "000005D4" "208" "c:\program files\checkpoint\ssl network extender"C:\Windows\system32\DrvInst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
2256"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\CheckPoint\SSL Network Extender\extender.dll"C:\Windows\system32\regsvr32.exe—MsiExec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft(C) Register Server
Exit code:
3
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
Total events
20 540
Read events
19 797
Write events
684
Delete events
59

Modification events

(PID) Process:(1472) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1472) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1472) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1472) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(1472) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(1472) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\snx.7z
(PID) Process:(1472) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1472) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1472) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1472) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
27
Suspicious files
24
Text files
7
Unknown types
11

Dropped files

PID
Process
Filename
Type
2956msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
1472WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1472.17696\snx\cpextender.msiexecutable
MD5:—
SHA256:—
1472WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1472.17696\snx\ver.initext
MD5:—
SHA256:—
2956msiexec.exeC:\System Volume Information\SPP\OnlineMetadataCache\{908676f0-8810-4f6a-8645-186344adfe32}_OnDiskSnapshotPropbinary
MD5:—
SHA256:—
1472WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1472.17696\snx\runner.exeexecutable
MD5:—
SHA256:—
2956msiexec.exeC:\Users\admin\AppData\Local\Temp\~DFFD830D3D1EBE9540.TMPgmc
MD5:—
SHA256:—
2956msiexec.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:—
SHA256:—
2956msiexec.exeC:\Windows\Installer\142180.msiexecutable
MD5:—
SHA256:—
2956msiexec.exeC:\Windows\Installer\142181.ipibinary
MD5:—
SHA256:—
2956msiexec.exeC:\Program Files\CheckPoint\SSL Network Extender\ver.initext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
Process
Message
MsiExec.exe
<11 Feb 11:13:53.593> <VnaInstall> ****************************** VnaInstall started **********************************
MsiExec.exe
<11 Feb 11:13:53.593> <SystemWithoutConsoleWait> Running: "C:\Program Files\CheckPoint\SSL Network Extender\vna_utils.exe" -an vna dev install "C:\Program Files\CheckPoint\SSL Network Extender\netvna.inf" cp_vna
MsiExec.exe
<11 Feb 11:13:55.812> <VnaInstall> vna dev install (first time) status 0
MsiExec.exe
<11 Feb 11:13:55.812> <SystemWithoutConsoleWait> Running: "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\CheckPoint\SSL Network Extender\extender.dll"
MsiExec.exe
<11 Feb 11:13:55.843> <SystemWithoutConsoleWait> Running: "C:\Program Files\CheckPoint\SSL Network Extender\slimsvc.exe" install
MsiExec.exe
<11 Feb 11:13:55.968> <SystemWithoutConsoleWait> Running: net start cpextender
MsiExec.exe
<11 Feb 11:13:58.546> <SystemWithoutConsoleWait> Running: "C:\Program Files\CheckPoint\SSL Network Extender\vna_utils.exe" -an vna drv load
MsiExec.exe
<11 Feb 11:13:58.593> <SystemWithoutConsoleWait> Running: netsh advfirewall firewall add rule name = "SSL Network Extender Service" program = "C:\Program Files\CheckPoint\SSL Network Extender\slimsvc.exe" action = allow dir = in
MsiExec.exe
<11 Feb 11:13:58.702> <VnaInstall> ****************************** VnaInstall ended **********************************
MsiExec.exe
<11 Feb 11:13:58.937> <CheckReboot> ****************************** CheckReboot started **********************************
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
snx.7z