File name:

kodak-capture-pro-se_141979525.zip

Full analysis: https://app.any.run/tasks/d9fdec4a-d030-4dd2-a1cc-7c860b98ded8
Verdict: Malicious activity
Analysis date: April 27, 2021, 18:56:02
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

867463C0900F4A6F2942FF2AA58B4909

SHA1:

BCC9D164DA75E9D3AB40A66D5E495A1111B66F77

SHA256:

F4D6422F7090E3A633268E9A3C31689A9B25E644D841A1A85E4C3741245D6081

SSDEEP:

196608:W7iha/qgW4JmrqVgHUWUu1zmhASQPgA9ly0VLqAhvlNLowMucuae:AqeWkRgHZX1zmhVQPgAC09Bb/N

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • kodak-capture-pro-se_141979525.exe (PID: 3372)
      • kodak-capture-pro-se_141979525.exe (PID: 3508)
      • kodak-capture-pro-se_141979525.tmp (PID: 1492)
      • k0h24quk.jrc.exe (PID: 1092)
      • k0h24quk.jrc.exe (PID: 3988)

    • Application was dropped or rewritten from another process

      • kodak-capture-pro-se_141979525.exe (PID: 3372)
      • kodak-capture-pro-se_141979525.exe (PID: 3508)
      • k0h24quk.jrc.exe (PID: 1092)
      • k0h24quk.jrc.exe (PID: 3988)
      • Est.exe (PID: 1640)
      • CClipboard.exe (PID: 1020)
      • CClipboardCm.exe (PID: 1276)
      • CClipboard.exe (PID: 2852)
      • CClipboardCm.exe (PID: 1636)
      • COptions.exe (PID: 2524)

    • Loads dropped or rewritten executable

      • Est.exe (PID: 1640)
      • WerFault.exe (PID: 2860)
      • explorer.exe (PID: 324)
      • CClipboardCm.exe (PID: 1636)
      • WinRAR.exe (PID: 816)
      • svchost.exe (PID: 876)
      • ctfmon.exe (PID: 820)
      • CClipboard.exe (PID: 2852)
      • regsvr32.exe (PID: 2484)

    • Registers / Runs the DLL via REGSVR32.EXE

      • k0h24quk.jrc.tmp (PID: 2244)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 816)
      • kodak-capture-pro-se_141979525.exe (PID: 3372)
      • kodak-capture-pro-se_141979525.exe (PID: 3508)
      • kodak-capture-pro-se_141979525.tmp (PID: 1492)
      • k0h24quk.jrc.exe (PID: 1092)
      • k0h24quk.jrc.exe (PID: 3988)
      • k0h24quk.jrc.tmp (PID: 2244)

    • Reads Windows owner or organization settings

      • kodak-capture-pro-se_141979525.tmp (PID: 1492)
      • k0h24quk.jrc.tmp (PID: 2244)

    • Reads the Windows organization settings

      • kodak-capture-pro-se_141979525.tmp (PID: 1492)
      • k0h24quk.jrc.tmp (PID: 2244)

    • Drops a file with too old compile date

      • kodak-capture-pro-se_141979525.tmp (PID: 1492)

    • Creates a directory in Program Files

      • kodak-capture-pro-se_141979525.tmp (PID: 1492)
      • k0h24quk.jrc.tmp (PID: 2244)
      • CClipboard.exe (PID: 2852)

    • Drops a file with a compile date too recent

      • kodak-capture-pro-se_141979525.tmp (PID: 1492)

    • Drops a file that was compiled in debug mode

      • kodak-capture-pro-se_141979525.tmp (PID: 1492)

    • Creates files in the program directory

      • WerFault.exe (PID: 2860)
      • CClipboard.exe (PID: 2852)

    • Creates files in the user directory

      • CClipboard.exe (PID: 2852)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 2484)

  • INFO

    • Application was dropped or rewritten from another process

      • kodak-capture-pro-se_141979525.tmp (PID: 1492)
      • kodak-capture-pro-se_141979525.tmp (PID: 580)
      • k0h24quk.jrc.tmp (PID: 2740)
      • k0h24quk.jrc.tmp (PID: 2244)

    • Creates files in the program directory

      • kodak-capture-pro-se_141979525.tmp (PID: 1492)
      • k0h24quk.jrc.tmp (PID: 2244)

    • Loads dropped or rewritten executable

      • kodak-capture-pro-se_141979525.tmp (PID: 1492)

    • Creates a software uninstall entry

      • kodak-capture-pro-se_141979525.tmp (PID: 1492)
      • k0h24quk.jrc.tmp (PID: 2244)

    • Reads settings of System Certificates

      • CClipboard.exe (PID: 2852)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: k0h24quk.jrc.exe
ZipUncompressedSize: 4973240
ZipCompressedSize: 4864419
ZipCRC: 0xd7503770
ZipModifyDate: 2019:12:17 19:30:18
ZipCompression: Deflated
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
64
Monitored processes
21
Malicious processes
10
Suspicious processes
2

Behavior graph

Click at the process to see the details
drop and start drop and start start drop and start drop and start drop and start drop and start drop and start winrar.exe kodak-capture-pro-se_141979525.exe kodak-capture-pro-se_141979525.tmp no specs kodak-capture-pro-se_141979525.exe kodak-capture-pro-se_141979525.tmp est.exe k0h24quk.jrc.exe k0h24quk.jrc.tmp no specs k0h24quk.jrc.exe k0h24quk.jrc.tmp werfault.exe no specs regsvr32.exe no specs regsvr32.exe no specs cclipboard.exe no specs cclipboard.exe cclipboardcm.exe no specs cclipboardcm.exe no specs explorer.exe no specs ctfmon.exe no specs svchost.exe coptions.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
324C:\Windows\Explorer.EXEC:\Windows\explorer.exe——
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
580"C:\Users\admin\AppData\Local\Temp\is-UBRD6.tmp\kodak-capture-pro-se_141979525.tmp" /SL5="$2015C,3766975,721408,C:\Users\admin\AppData\Local\Temp\Rar$EXa816.11609\kodak-capture-pro-se_141979525.exe" C:\Users\admin\AppData\Local\Temp\is-UBRD6.tmp\kodak-capture-pro-se_141979525.tmp—kodak-capture-pro-se_141979525.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-ubrd6.tmp\kodak-capture-pro-se_141979525.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
816"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\kodak-capture-pro-se_141979525.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
820C:\Windows\System32\ctfmon.exe C:\Windows\System32\ctfmon.exe—taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
CTF Loader
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ctfmon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msctfmonitor.dll
c:\windows\system32\msctf.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
876C:\Windows\system32\svchost.exe -k netsvcsC:\Windows\System32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1020"C:\Program Files\ComfortClipboard\CClipboard.exe" C:\Program Files\ComfortClipboard\CClipboard.exe—k0h24quk.jrc.tmp
User:
admin
Company:
Comfort Software Group
Integrity Level:
MEDIUM
Description:
Comfort Clipboard Pro 9
Exit code:
3221226540
Version:
9.1.1.0
Modules
Images
c:\program files\comfortclipboard\cclipboard.exe
c:\systemroot\system32\ntdll.dll
1092"C:\Users\admin\AppData\Local\Temp\Rar$EXa816.13502\k0h24quk.jrc.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa816.13502\k0h24quk.jrc.exe
WinRAR.exe
User:
admin
Company:
Comfort Software Group
Integrity Level:
MEDIUM
Description:
Comfort Clipboard Pro 9.1.1.0 Setup
Exit code:
0
Version:
9.1.1.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa816.13502\k0h24quk.jrc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1276"C:\Program Files\ComfortClipboard\CClipboardCm.exe" C:\Program Files\ComfortClipboard\CClipboardCm.exe—CClipboard.exe
User:
admin
Company:
Comfort Software Group
Integrity Level:
MEDIUM
Description:
Comfort Clipboard Service
Exit code:
3221226540
Version:
7.4.0.0
Modules
Images
c:\program files\comfortclipboard\cclipboardcm.exe
c:\systemroot\system32\ntdll.dll
1492"C:\Users\admin\AppData\Local\Temp\is-0HOJP.tmp\kodak-capture-pro-se_141979525.tmp" /SL5="$30178,3766975,721408,C:\Users\admin\AppData\Local\Temp\Rar$EXa816.11609\kodak-capture-pro-se_141979525.exe" /SPAWNWND=$2017A /NOTIFYWND=$2015C C:\Users\admin\AppData\Local\Temp\is-0HOJP.tmp\kodak-capture-pro-se_141979525.tmp
kodak-capture-pro-se_141979525.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-0hojp.tmp\kodak-capture-pro-se_141979525.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1636"C:\Program Files\ComfortClipboard\CClipboardCm.exe" C:\Program Files\ComfortClipboard\CClipboardCm.exe—CClipboard.exe
User:
admin
Company:
Comfort Software Group
Integrity Level:
HIGH
Description:
Comfort Clipboard Service
Exit code:
0
Version:
7.4.0.0
Modules
Images
c:\program files\comfortclipboard\cclipboardcm.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
Total events
4 074
Read events
3 719
Write events
353
Delete events
2

Modification events

(PID) Process:(816) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(816) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(816) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(816) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:@C:\Windows\system32\NetworkExplorer.dll,-1
Value:
Network
(PID) Process:(816) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\kodak-capture-pro-se_141979525.zip
(PID) Process:(816) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(816) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(816) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(816) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(324) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.zip\OpenWithList
Operation:writeName:a
Value:
WinRAR.exe
Executable files
21
Suspicious files
8
Text files
77
Unknown types
61

Dropped files

PID
Process
Filename
Type
1492kodak-capture-pro-se_141979525.tmpC:\Program Files\Et\is-40VFJ.tmp —
MD5:—
SHA256:—
1492kodak-capture-pro-se_141979525.tmpC:\Program Files\Et\is-174N3.tmp —
MD5:—
SHA256:—
1492kodak-capture-pro-se_141979525.tmpC:\Program Files\Et\is-D089S.tmp —
MD5:—
SHA256:—
1492kodak-capture-pro-se_141979525.tmpC:\Program Files\Et\is-JMHA0.tmp —
MD5:—
SHA256:—
1492kodak-capture-pro-se_141979525.tmpC:\Program Files\Et\is-DBPLS.tmp —
MD5:—
SHA256:—
1492kodak-capture-pro-se_141979525.tmpC:\Program Files\Et\is-16K9J.tmp —
MD5:—
SHA256:—
1492kodak-capture-pro-se_141979525.tmpC:\Program Files\Et\is-IVL5B.tmp —
MD5:—
SHA256:—
1492kodak-capture-pro-se_141979525.tmpC:\Program Files\Et\is-TSCEF.tmp —
MD5:—
SHA256:—
1492kodak-capture-pro-se_141979525.tmpC:\Program Files\Et\is-3G7J8.tmp —
MD5:—
SHA256:—
1492kodak-capture-pro-se_141979525.tmpC:\Program Files\Et\vel\is-T7OVF.tmp —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
4
DNS requests
4
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1640
Est.exe
POST
—
104.21.84.93:80
http://grigblog.club/v2/events
US
—
—
malicious
2852
CClipboard.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQS14tALDViBvqCf47YkiQRtKz1BAQUpc436uuwdQ6UZ4i0RfrZJBCHlh8CEA4U%2B2m2cNcO96A8cRrk3lo%3D
US
der
278 b
whitelisted
2852
CClipboard.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1640
Est.exe
104.21.84.93:80
grigblog.club
Cloudflare Inc
US
malicious
2852
CClipboard.exe
172.67.218.15:443
www.comfort-software.com
—
US
suspicious
2852
CClipboard.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2852
CClipboard.exe
172.67.140.157:443
www.comfortsoftware.com
—
US
unknown

DNS requests

Domain
IP
Reputation
grigblog.club
  • 104.21.84.93
  • 172.67.190.230
malicious
www.comfort-software.com
  • 172.67.218.15
  • 104.21.24.80
malicious
ocsp.digicert.com
  • 93.184.220.29
whitelisted
www.comfortsoftware.com
  • 172.67.140.157
  • 104.21.57.22
malicious

Threats

PID
Process
Class
Message
1640
Est.exe
A Network Trojan was detected
ET MALWARE DownloadAssistant Activity
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
kodak-capture-pro-se_141979525.zip