analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

malware.zip

Full analysis: https://app.any.run/tasks/8d1b4127-6e4b-4f10-ae5b-0c63e893bfd6
Verdict: Malicious activity
Analysis date: December 06, 2022, 01:16:15
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
cve-2022-30190
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

A8E41B10354D07800FA16FFB8247D4AA

SHA1:

4CF5BBB099F33F30A5A95520B3184E3C9D9870A5

SHA256:

F8BD28F38B64BD952D05F83069328FD7F38E7DA2B4E59F787CE27DB467D180B3

SSDEEP:

192:tU+GRY6E1fjWDOvZ/FQfTS1/CCVGDhwUJm7Yhbe0EKtXvWIg2bkALm/6ceEbbsX2:RL6sfjN/wTSdVGDhrJmSb7pWnRh/UEUm

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • CVE-2022-30190 detected

      • WINWORD.EXE (PID: 3692)

  • SUSPICIOUS

    • Detected use of alternative data streams (AltDS)

      • WINWORD.EXE (PID: 3692)

  • INFO

    • Reads default file associations for system extensions

      • WinRAR.exe (PID: 2308)

    • Checks proxy server information

      • WINWORD.EXE (PID: 3692)

    • Reads Microsoft Office registry keys

      • WinRAR.exe (PID: 2308)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
2
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs winword.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2308"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\malware.zip"C:\Program Files\WinRAR\WinRAR.exe—Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3692"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Rar$DIb2308.37009\sample.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
Total events
5 279
Read events
4 494
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
9
Text files
0
Unknown types
2

Dropped files

PID
Process
Filename
Type
3692WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR85EA.tmp.cvr —
MD5:—
SHA256:—
3692WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-CNRY.FSDbinary
MD5:D3C749BBD72EC1E6B03A6665F206D588
SHA256:6630F6C5684DFCF9425F2DADDCDEC8603AE6BAD3DEA0FACCAC5CCA4D59BDB3FC
3692WINWORD.EXEC:\Users\admin\AppData\Local\Temp\Rar$DIb2308.37009\~$sample.docpgc
MD5:795CD4C06555896CBDFE145F3312F65A
SHA256:B4387283D7BB1D31C3CE13C27DBED6D2DB6CEF14A18FA7E5C7007849E31E7BD1
3692WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:04F48239D319FC8C579A86F2CE245B37
SHA256:36B90FF32241D0B705531CA888AA505DAB5818DA4BC28C35D69F88919C15737E
3692WINWORD.EXEC:\Users\admin\AppData\Local\Temp\{F6317D4C-0B4F-4F23-9E9F-DD28B46EEA8E}binary
MD5:D3C749BBD72EC1E6B03A6665F206D588
SHA256:6630F6C5684DFCF9425F2DADDCDEC8603AE6BAD3DEA0FACCAC5CCA4D59BDB3FC
3692WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-{61C399C8-56D7-4FE5-9FD2-738FAD537FC7}.FSDbinary
MD5:19BAB5FB79C3978AC27C4090731A49D9
SHA256:DBDE8AA30580CED7F3EAB5577CBC70DEA1C992703E0E6CA9610133E368FD8564
3692WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSDbinary
MD5:152D19F6D6F33C594746CD76701E8C94
SHA256:D4EBC439A93C0FCC2961DC5D19E5A3439324A21B0F81B860778CC0C772113867
3692WINWORD.EXEC:\Users\admin\AppData\Local\Temp\{69114CDB-96A9-4705-B6BE-247D0DD46C5E}binary
MD5:152D19F6D6F33C594746CD76701E8C94
SHA256:D4EBC439A93C0FCC2961DC5D19E5A3439324A21B0F81B860778CC0C772113867
3692WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-{F46B88E6-DCA7-4574-B34E-9122B9535C19}.FSDbinary
MD5:68D421F7641A7C63AE5D1686A9C49BB5
SHA256:E0BB56D6F6F419C30F02D7E08E4E4F6BE672E31678379A340102F52B8633EE3E
3692WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSF-{0E1EEE64-E8C6-4E2A-9759-63CF07FD8988}.FSFbinary
MD5:D471A0BB5F0B8A9AC834E0172491B7F9
SHA256:418B6AE0A39787583DCD77DA0ED040F8C3DDA03410E71D04C235EE6E736F298F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

Domain
IP
Reputation
www.xmlformats.com
  • —
malicious

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
malware.zip