analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

2.zip

Full analysis: https://app.any.run/tasks/d9fa6cb7-be3c-44c7-8990-e9afd2c4add0
Verdict: Malicious activity
Analysis date: January 11, 2019, 07:30:13
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

48158C4908DDCB2411C9E3C1613E56FC

SHA1:

1B7376E407B3A84A0CC518B1CDF7EBDD87CD4479

SHA256:

F2963BA302BAAA602FEB4A66455607C6DCA15174C11264056898B24F3001D76A

SSDEEP:

49152:xkHckII3rcYuJapvRcATqJ8dBMmiAMBT432JHrFK6yrQ8tI9qq8KLUGfiEmgmb:xockN7pZBD88Uj9ok9qofiBtb

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Setup(password=spytech).exe (PID: 2328)
      • driver-setup.exe (PID: 2164)
      • npf_mgm.exe (PID: 1200)
      • sysdiag.exe (PID: 3992)

    • Loads dropped or rewritten executable

      • Setup(password=spytech).exe (PID: 2328)
      • driver-setup.exe (PID: 2164)
      • sysdiag.exe (PID: 3992)
      • explorer.exe (PID: 116)
      • iexplore.exe (PID: 3788)
      • iexplore.exe (PID: 2388)
      • WinRAR.exe (PID: 2900)

    • UAC/LUA settings modification

      • Setup(password=spytech).exe (PID: 2328)

    • Changes the autorun value in the registry

      • sysdiag.exe (PID: 3992)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Setup(password=spytech).exe (PID: 2328)
      • driver-setup.exe (PID: 2164)

    • Creates files in the program directory

      • Setup(password=spytech).exe (PID: 2328)
      • driver-setup.exe (PID: 2164)

    • Creates files in the Windows directory

      • Setup(password=spytech).exe (PID: 2328)
      • driver-setup.exe (PID: 2164)

    • Creates files in the driver directory

      • driver-setup.exe (PID: 2164)

    • Creates executable files which already exist in Windows

      • Setup(password=spytech).exe (PID: 2328)

    • Creates a software uninstall entry

      • Setup(password=spytech).exe (PID: 2328)

    • Starts Internet Explorer

      • Setup(password=spytech).exe (PID: 2328)

    • Check for Java to be installed

      • iexplore.exe (PID: 3788)

  • INFO

    • Changes internet zones settings

      • iexplore.exe (PID: 3788)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2388)

    • Application launched itself

      • iexplore.exe (PID: 3788)

    • Creates files in the user directory

      • iexplore.exe (PID: 2388)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: SpyAgent's 10 Step Guide to Total Stealth.url
ZipUncompressedSize: 176
ZipCompressedSize: 123
ZipCRC: 0x8ea1cfb9
ZipModifyDate: 2001:10:15 17:00:18
ZipCompression: Deflated
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
8
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start drop and start winrar.exe no specs setup(password=spytech).exe driver-setup.exe npf_mgm.exe no specs iexplore.exe sysdiag.exe iexplore.exe explorer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2900"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\2.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
2328"C:\Users\admin\Desktop\Setup(password=spytech).exe" C:\Users\admin\Desktop\Setup(password=spytech).exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
2164"C:\PROGRA~1\SYSCON~1\driver-setup.exe" -sC:\PROGRA~1\SYSCON~1\driver-setup.exe
Setup(password=spytech).exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
1200"C:\Program Files\WinConfig\npf_mgm.exe" -rC:\Program Files\WinConfig\npf_mgm.exe—driver-setup.exe
User:
admin
Company:
CACE Technologies
Integrity Level:
HIGH
Description:
npf_mgm
Exit code:
0
Version:
3, 1, 0, 27
3788"C:\Program Files\Internet Explorer\iexplore.exe" http://www.spytech-web.com/spyagent/stealthguideC:\Program Files\Internet Explorer\iexplore.exe
Setup(password=spytech).exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3992"C:\Program Files\sysconfig\sysdiag.exe" C:\Program Files\sysconfig\sysdiag.exe
Setup(password=spytech).exe
User:
admin
Integrity Level:
HIGH
2388"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3788 CREDAT:79873C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
116C:\Windows\Explorer.EXEC:\Windows\explorer.exe——
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
5 664
Read events
3 973
Write events
0
Delete events
0

Modification events

No data
Executable files
32
Suspicious files
7
Text files
129
Unknown types
16

Dropped files

PID
Process
Filename
Type
2900WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2900.35436\Setup(password=spytech).exe —
MD5:—
SHA256:—
2328Setup(password=spytech).exeC:\Users\admin\AppData\Local\Temp\~vis0000\miscdata.xyz —
MD5:—
SHA256:—
2328Setup(password=spytech).exeC:\Users\admin\AppData\Local\Temp\~vis0000\sidesplash.bmpimage
MD5:C2B817930BFB31304C52DE7552767017
SHA256:0C3EA61F357590CC4AF11A6780F2255EA376970F26512B698724512F9788CA90
2328Setup(password=spytech).exeC:\Users\admin\AppData\Local\Temp\~vis0000\uninstal.logtext
MD5:6340F298B15A7AC60C4E9D3F8F68DC77
SHA256:F6E574ACFD8449810E6D06E820859D44EC0A0C7128BF2C52970A9637914E8B77
2328Setup(password=spytech).exeC:\Users\admin\AppData\Local\Temp\~vis0000\mainsplash.bmpimage
MD5:FC472B4B08065BBFCD14C51E9B1B62EE
SHA256:596EB1BBEBD7FCCFBF99D1C40E79E264493CBEF9BF10204C325722F7756EAAE3
2328Setup(password=spytech).exeC:\Users\admin\AppData\Local\Temp\~vis0000\rollback.logtext
MD5:BD22C444351CA08A282D00841BDE7E64
SHA256:4876AEB65CC35F6C079DFDDD77B313AF6E4806AEAF7DEB1CB60843C5F8D61CB2
116explorer.exeC:\Users\admin\Desktop\Setup(password=spytech).exeexecutable
MD5:16D51E066C3C6D00958586DE6F902395
SHA256:00EF4B30031766EB014C90C995F37732850B1AD6BCC2F34D0BBA1CBBBEF81C83
2328Setup(password=spytech).exeC:\Users\admin\AppData\Local\Temp\~vis0000\r0000000.000binary
MD5:3B0C38972C97F10AD92CBA030AB642A8
SHA256:34FC3175F97293D3A2C3126ED216B099071624D0ABEAE5359381CC75A4374B3B
2328Setup(password=spytech).exeC:\Program Files\sysconfig\sysk32.dllexecutable
MD5:7839E928C00E24EBB958A80E47426155
SHA256:22B33B884E17FB6C872621DA6BB272F3C8EA271CA6F9C4E88EF1D6ACE25A7404
2328Setup(password=spytech).exeC:\Users\admin\AppData\Local\Temp\~vis0000\rebootnt.exeexecutable
MD5:C459E252866435ED8B928D1509C28DE2
SHA256:4887FF02F8E45F5E03E351CB5156111659CC1B04FDCA9DAE3BD75CB99381DEDE
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
17
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2388
iexplore.exe
GET
301
184.154.69.210:80
http://www.spytech-web.com/spyagent/stealthguide
US
html
257 b
malicious
3788
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3788
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
2388
iexplore.exe
184.154.69.210:80
www.spytech-web.com
SingleHop, Inc.
US
malicious
2388
iexplore.exe
184.154.69.210:443
www.spytech-web.com
SingleHop, Inc.
US
malicious

DNS requests

Domain
IP
Reputation
www.spytech-web.com
  • 184.154.69.210
malicious
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
2.zip