analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| File name: | TNT Tracking.7z |
| Full analysis: | https://app.any.run/tasks/1d3d8193-55a9-4388-8549-5b37d231b06c |
| Verdict: | Malicious activity |
| Analysis date: | October 20, 2020, 13:34:18 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/x-7z-compressed |
| File info: | 7-zip archive data, version 0.4 |
| MD5: | E0D27F875437362A7F5493D26E113C94 |
| SHA1: | A629650AF81D182B18898ACEEAC1E7F9ADA79C03 |
| SHA256: | F81FB94406CB4687E204BA0D0EEC7BE8174EF4585636BBB426C290522BBC93F7 |
| SSDEEP: | 6144:flXzZ3qXog+XGrtI1IgtP1G61IhD45OfZXlscQIG0+v96LJsJg0xWGq9r36j/B8M:F1q+2C1IQ171cFTqZxJ+b9r36LW2l |
MALICIOUS
Loads dropped or rewritten executable
- TNT Tracking.exe (PID: 3432)
Application was dropped or rewritten from another process
- TNT Tracking.exe (PID: 3432)
- InstallUtil.exe (PID: 3996)
Actions looks like stealing of personal data
- InstallUtil.exe (PID: 3996)
SUSPICIOUS
Executable content was dropped or overwritten
- WinRAR.exe (PID: 2088)
- TNT Tracking.exe (PID: 3432)
INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .7z | | | 7-Zip compressed archive (v0.4) (57.1) |
|---|---|---|
| .7z | | | 7-Zip compressed archive (gen) (42.8) |
Total processes
39
Monitored processes
3
Malicious processes
3
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 2088 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Downloads\TNT Tracking.7z" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 | ||||
| 3432 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa2088.21104\TNT Tracking.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa2088.21104\TNT Tracking.exe | WinRAR.exe | |
User: admin Company: z/62o~_9p4k?g*7;5fz]3> Integrity Level: MEDIUM Description: 3y,)5qw>4}2n Exit code: 0 Version: 9.14.19.24 | ||||
| 3996 | "C:\Users\admin\AppData\Local\Temp\InstallUtil.exe" | C:\Users\admin\AppData\Local\Temp\InstallUtil.exe | TNT Tracking.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: .NET Framework installation utility Version: 4.7.3062.0 built by: NET472REL1 | ||||
Total events
544
Read events
497
Write events
47
Delete events
0
Modification events
| (PID) Process: | (2088) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (2088) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (2088) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\13B\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (2088) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\Downloads\TNT Tracking.7z | |||
| (PID) Process: | (2088) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (2088) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (2088) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (2088) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (2088) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
| (PID) Process: | (2088) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 1 | |||
Executable files
4
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2088 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa2088.21104\TNT Tracking.exe | executable | |
MD5:CAFE8103326255AD911C5C6607DCDC17 | SHA256:B6C62201F6C98F7ED96881358EFCE39415EDC9594DB5CE3964FB4DC12A12BAC9 | |||
| 3432 | TNT Tracking.exe | C:\Users\admin\AppData\Local\Temp\InstallUtil.exe | executable | |
MD5:91C9AE9C9A17A9DB5E08B120E668C74C | SHA256:E56A7E5D3AB9675555E2897FC3FAA2DD9265008A4967A7D54030AB8184D2D38F | |||
| 3432 | TNT Tracking.exe | C:\Users\admin\AppData\Local\Temp\d5826601-c1fb-4502-b6a6-7bd4388c1d4b\Xxl.dll | executable | |
MD5:14FF402962AD21B78AE0B4C43CD1F194 | SHA256:FB9646CB956945BDC503E69645F6B5316D3826B780D3C36738D6B944E884D15B | |||
| 3432 | TNT Tracking.exe | C:\Users\admin\AppData\Local\Temp\b35bc50e-fc56-4239-a7d0-bb79118b31c9\AgileDotNetRT.dll | executable | |
MD5:14FF402962AD21B78AE0B4C43CD1F194 | SHA256:FB9646CB956945BDC503E69645F6B5316D3826B780D3C36738D6B944E884D15B | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
1
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3996 | InstallUtil.exe | 212.227.15.142:587 | smtp.1and1.es | 1&1 Internet SE | DE | suspicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
smtp.1and1.es |
| shared |
Threats
PID | Process | Class | Message |
|---|---|---|---|
3996 | InstallUtil.exe | Generic Protocol Command Decode | SURICATA Applayer Detect protocol only one direction |