| File name: | ziptech.zip |
| Full analysis: | https://app.any.run/tasks/c622030c-65f7-4fca-8055-1c5c91f64b02 |
| Verdict: | Malicious activity |
| Analysis date: | January 25, 2024, 02:56:23 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v2.0 to extract |
| MD5: | 4D16AAAF0A781EDF789753D8BF58F2D8 |
| SHA1: | B2920BDB96F33778AB512E26886B589F328BEFD7 |
| SHA256: | F6A8978BBBF142F46B633F0D70DD4DC6F7CA4FEEBC1D5AAFC3736FA20DBB6365 |
| SSDEEP: | 24576:QnQOwCa45kaD6vc0PKNl1vo0UE3KNmIPoCUCf2KBfXh+6SE6zJ4y0hs5f:QnQOwCa45kaD6E0PKNLvo0UE3mmIPo11 |
MALICIOUS
Drops the executable file immediately after the start
- WinRAR.exe (PID: 1036)
- csc.exe (PID: 1496)
- csc.exe (PID: 1808)
- csc.exe (PID: 1404)
Starts Visual C# compiler
- sdiagnhost.exe (PID: 2744)
SUSPICIOUS
Probably uses Microsoft diagnostics tool to execute malicious payload
- pcwrun.exe (PID: 2388)
Process drops legitimate windows executable
- msdt.exe (PID: 568)
Reads settings of System Certificates
- msdt.exe (PID: 568)
Reads the Internet Settings
- sdiagnhost.exe (PID: 2744)
Uses .NET C# to load dll
- sdiagnhost.exe (PID: 2744)
Executable content was dropped or overwritten
- csc.exe (PID: 1496)
- csc.exe (PID: 1808)
- csc.exe (PID: 1404)
INFO
Executable content was dropped or overwritten
- WinRAR.exe (PID: 1036)
Create files in a temporary directory
- msdt.exe (PID: 568)
- pcwrun.exe (PID: 2388)
- sdiagnhost.exe (PID: 2744)
- csc.exe (PID: 1808)
- csc.exe (PID: 1496)
- cvtres.exe (PID: 2896)
- cvtres.exe (PID: 2732)
- cvtres.exe (PID: 1236)
- csc.exe (PID: 1404)
Reads security settings of Internet Explorer
- msdt.exe (PID: 568)
- sdiagnhost.exe (PID: 2744)
Drops the executable file immediately after the start
- msdt.exe (PID: 568)
Manual execution by a user
- pcwrun.exe (PID: 2388)
Reads the machine GUID from the registry
- csc.exe (PID: 1808)
- cvtres.exe (PID: 1236)
- csc.exe (PID: 1496)
- cvtres.exe (PID: 2896)
- csc.exe (PID: 1404)
- cvtres.exe (PID: 2732)
Checks supported languages
- csc.exe (PID: 1808)
- cvtres.exe (PID: 1236)
- csc.exe (PID: 1496)
- cvtres.exe (PID: 2896)
- cvtres.exe (PID: 2732)
- csc.exe (PID: 1404)
Creates files or folders in the user directory
- msdt.exe (PID: 568)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .zip | | | ZIP compressed archive (100) |
|---|
EXIF
ZIP
| ZipRequiredVersion: | 20 |
|---|---|
| ZipBitFlag: | 0x0001 |
| ZipCompression: | Deflated |
| ZipModifyDate: | 2024:01:25 02:55:18 |
| ZipCRC: | 0x9eb15604 |
| ZipCompressedSize: | 651590 |
| ZipUncompressedSize: | 1046976 |
| ZipFileName: | ziptech.exe |
Total processes
52
Monitored processes
10
Malicious processes
2
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 568 | C:\Windows\System32\msdt.exe -path C:\Windows\diagnostics\index\PCWDiagnostic.xml -af C:\Users\admin\AppData\Local\Temp\PCW1A38.xml /skip TRUE | C:\Windows\System32\msdt.exe | — | pcwrun.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Diagnostics Troubleshooting Wizard Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1036 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\ziptech.zip" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
| 1236 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES1FC7.tmp" "c:\Users\admin\AppData\Local\Temp\CSC1FC6.tmp" | C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe | — | csc.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft® Resource File To COFF Object Conversion Utility Exit code: 0 Version: 8.00.50727.5003 (Win7SP1GDR.050727-5400) Modules
| |||||||||||||||
| 1404 | "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\vvvnzmbu.cmdline" | C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe | sdiagnhost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Visual C# Command Line Compiler Exit code: 0 Version: 8.0.50727.5483 (Win7SP1GDR.050727-5400) Modules
| |||||||||||||||
| 1496 | "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\ygkukgcy.cmdline" | C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe | sdiagnhost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Visual C# Command Line Compiler Exit code: 0 Version: 8.0.50727.5483 (Win7SP1GDR.050727-5400) Modules
| |||||||||||||||
| 1808 | "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\m-jijlyx.cmdline" | C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe | sdiagnhost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Visual C# Command Line Compiler Exit code: 0 Version: 8.0.50727.5483 (Win7SP1GDR.050727-5400) Modules
| |||||||||||||||
| 2388 | C:\Windows\system32\pcwrun.exe "C:\Users\admin\Desktop\ziptech.exe" | C:\Windows\System32\pcwrun.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Program Compatibility Troubleshooter Invoker Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2732 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES20A2.tmp" "c:\Users\admin\AppData\Local\Temp\CSC20A1.tmp" | C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe | — | csc.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft® Resource File To COFF Object Conversion Utility Exit code: 0 Version: 8.00.50727.5003 (Win7SP1GDR.050727-5400) Modules
| |||||||||||||||
| 2744 | C:\Windows\System32\sdiagnhost.exe -Embedding | C:\Windows\System32\sdiagnhost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Scripted Diagnostics Native Host Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2896 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES1F4A.tmp" "c:\Users\admin\AppData\Local\Temp\CSC1F49.tmp" | C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe | — | csc.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft® Resource File To COFF Object Conversion Utility Exit code: 0 Version: 8.00.50727.5003 (Win7SP1GDR.050727-5400) Modules
| |||||||||||||||
Total events
6 443
Read events
6 402
Write events
41
Delete events
0
Modification events
| (PID) Process: | (1036) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (1036) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 3 |
Value: C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip | |||
| (PID) Process: | (1036) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\phacker.zip | |||
| (PID) Process: | (1036) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\Win7-KB3191566-x86.zip | |||
| (PID) Process: | (1036) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip | |||
| (PID) Process: | (1036) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (1036) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (1036) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (1036) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (1036) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
Executable files
8
Suspicious files
14
Text files
23
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1496 | csc.exe | C:\Users\admin\AppData\Local\Temp\ygkukgcy.pdb | binary | |
MD5:F0F1947AAC9AFFCE47BB9BBD32D1E7FB | SHA256:8737EE9B78CDD33DF49AC9A40F317E51A943D0B75815A898E30260B7C5A92925 | |||
| 2744 | sdiagnhost.exe | C:\Users\admin\AppData\Local\Temp\ygkukgcy.cmdline | text | |
MD5:0936BAC7DA800A012A45C182FC5247B9 | SHA256:6442ECBF4D722794BAFD521970517C429CC592480EF5026A8FE4E9F5EF34A58F | |||
| 1496 | csc.exe | C:\Users\admin\AppData\Local\Temp\CSC1F49.tmp | binary | |
MD5:0029671209B523CA2CA590C75AC29FBB | SHA256:F063A1A6434E0F65891FDDE8A5627DE870DF8F9648654901E3ED58BB45481E9C | |||
| 1496 | csc.exe | C:\Users\admin\AppData\Local\Temp\ygkukgcy.out | text | |
MD5:C28AF1996FF7401660095F0ADA9BCA22 | SHA256:CBBB24FAADDB4FA44322C9CD1859FBB12B5ED8EAA31A086E7F368DFD887044F8 | |||
| 2744 | sdiagnhost.exe | C:\Users\admin\AppData\Local\Temp\m-jijlyx.0.cs | text | |
MD5:3880DE647B10555A534F34D5071FE461 | SHA256:F73390C091CD7E45DAC07C22B26BF667054EACDA31119513505390529744E15E | |||
| 568 | msdt.exe | C:\Users\admin\AppData\Local\Temp\SDIAG_94e2bca3-73de-44ba-a765-fe76c924d249\DiagPackage.diagpkg | html | |
MD5:18A906A43C1C3E27064DB30C81505234 | SHA256:041430D1F0AE14300C46BDCD917C882F4850DA3D6010E3FBF692023655BC406E | |||
| 1036 | WinRAR.exe | C:\Users\admin\Desktop\ziptech.exe | executable | |
MD5:A16BB4E58D21D8A40D798A22EDA620A6 | SHA256:3C3DB121ED85648FA8E2341A5BD04552D7FF146F022F1127173B8F43AAE1C1E5 | |||
| 1036 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXb1036.37763\ziptech.exe | executable | |
MD5:A16BB4E58D21D8A40D798A22EDA620A6 | SHA256:3C3DB121ED85648FA8E2341A5BD04552D7FF146F022F1127173B8F43AAE1C1E5 | |||
| 568 | msdt.exe | C:\Users\admin\AppData\Local\Temp\SDIAG_94e2bca3-73de-44ba-a765-fe76c924d249\TS_ProgramCompatibilityWizard.ps1 | text | |
MD5:46E22C2582B54BE56D80D7A79FEC9BB5 | SHA256:459AF2960B08E848573D45A7350223657ADB2115F24A3C37E69FFE61DEA647F9 | |||
| 568 | msdt.exe | C:\Users\admin\AppData\Local\Temp\SDIAG_94e2bca3-73de-44ba-a765-fe76c924d249\DiagPackage.dll | executable | |
MD5:4B9F845D6FF4BCED0EA8D7B0EA4AE7E7 | SHA256:21369005C8400B68D8CAB1A9A6C4D5809F5A685A8E18D311272467BB25D3D3C8 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
DNS requests
Threats
Process | Message |
|---|---|
csc.exe |
*** HR propagated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
|
csc.exe |
*** HR originated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
|
csc.exe |
*** HR originated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
|
csc.exe |
*** HR originated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
|
csc.exe |
*** HR originated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
|
csc.exe |
*** HR propagated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
|
csc.exe |
*** HR propagated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
|
csc.exe |
*** HR propagated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
|
csc.exe |
*** HR originated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
|
csc.exe |
*** HR originated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
|