File name:

Phoenix Keylogger.zip

Full analysis: https://app.any.run/tasks/a3b1bda4-2ced-4a90-82c5-29b0f82151db
Verdict: Malicious activity
Analysis date: December 05, 2023, 01:15:24
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

47089A706EF8E29EE77CC8B83795ED90

SHA1:

8BD560ADBD322081639E9E8421C4B4D0BA276F8D

SHA256:

FBAAF92F4048FB147754D282C2F9BA4923480AEF9C751C2C8813A7DA44AA9865

SSDEEP:

98304:Xu2m3xWjluefWhO2aE61anv76QJ4zudUio73z4b6IBH3WyiEvEXP4/5ZNhUFUpGd:1D9gKDI8a4S15FYSXwvMXF4

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Phoenix Keylogger.exe (PID: 1608)
      • crack.exe (PID: 2520)
      • Phoenix_Keylogger.exe (PID: 3608)

    • Create files in the Startup directory

      • crack.exe (PID: 2520)

  • SUSPICIOUS

    • Reads the Internet Settings

      • Phoenix Keylogger.exe (PID: 1608)

    • Reads Microsoft Outlook installation path

      • Phoenix Keylogger.exe (PID: 1608)

    • Reads Internet Explorer settings

      • Phoenix Keylogger.exe (PID: 1608)
      • Phoenix_Keylogger.exe (PID: 3608)

  • INFO

    • Checks supported languages

      • Phoenix Keylogger.exe (PID: 1608)
      • crack.exe (PID: 2520)
      • Phoenix_Keylogger.exe (PID: 3608)
      • crack.exe (PID: 984)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 2144)

    • Manual execution by a user

      • Phoenix Keylogger.exe (PID: 1608)
      • notepad.exe (PID: 1864)
      • Phoenix_Keylogger.exe (PID: 3608)
      • crack.exe (PID: 984)
      • notepad.exe (PID: 3760)

    • Reads the machine GUID from the registry

      • Phoenix Keylogger.exe (PID: 1608)
      • crack.exe (PID: 2520)
      • Phoenix_Keylogger.exe (PID: 3608)
      • crack.exe (PID: 984)

    • Checks proxy server information

      • Phoenix Keylogger.exe (PID: 1608)

    • Reads the computer name

      • Phoenix Keylogger.exe (PID: 1608)
      • crack.exe (PID: 2520)
      • crack.exe (PID: 984)
      • Phoenix_Keylogger.exe (PID: 3608)

    • Creates files or folders in the user directory

      • crack.exe (PID: 2520)

    • Create files in a temporary directory

      • Phoenix_Keylogger.exe (PID: 3608)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2023:09:15 01:50:20
ZipCRC: 0xa1b24adb
ZipCompressedSize: 19
ZipUncompressedSize: 19
ZipFileName: Phoenix Keylogger/Password.txt
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
56
Monitored processes
7
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe no specs notepad.exe no specs phoenix keylogger.exe crack.exe phoenix_keylogger.exe crack.exe notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
984"C:\Users\admin\Desktop\crack.exe" C:\Users\admin\Desktop\crack.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\crack.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1608"C:\Users\admin\Desktop\Phoenix Keylogger.exe" C:\Users\admin\Desktop\Phoenix Keylogger.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\phoenix keylogger.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\sfc_os.dll
1864"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\Phoenix Keylogger\Password.txtC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2144"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Phoenix Keylogger.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2520"C:\Users\admin\Desktop\crack.exe" C:\Users\admin\Desktop\crack.exe
Phoenix Keylogger.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\crack.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3608"C:\Users\admin\Desktop\Phoenix_Keylogger.exe" C:\Users\admin\Desktop\Phoenix_Keylogger.exe
explorer.exe
User:
admin
Company:
Phoenix Keylogger
Integrity Level:
HIGH
Description:
Phoenix Keylogger
Exit code:
4294967295
Version:
2.1.0.0
Modules
Images
c:\users\admin\desktop\phoenix_keylogger.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3760"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\key.txtC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
1 641
Read events
1 612
Write events
29
Delete events
0

Modification events

(PID) Process:(2144) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2144) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2144) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2144) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(2144) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2144) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2144) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2144) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2144) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
(PID) Process:(2144) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\General
Operation:writeName:LastFolder
Value:
C:\Users\admin\Desktop
Executable files
20
Suspicious files
7
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
1608Phoenix Keylogger.exeC:\Users\admin\Desktop\MetroFramework.dllexecutable
MD5:34EA7F7D66563F724318E322FF08F4DB
SHA256:C2C12D31B4844E29DE31594FC9632A372A553631DE0A0A04C8AF91668E37CF49
2144WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2144.42384\Phoenix Keylogger\Phoenix Keylogger.exeexecutable
MD5:B36E6664467C33A83FB27582C3AD7B47
SHA256:0F36B3D2BA6A8F5C88E2C6746AB01728A7124612DDD23094E8F520DD790763E6
1608Phoenix Keylogger.exeC:\Users\admin\Desktop\key.txttext
MD5:97081F7E6DF7E1DD599E072A71CDF0FF
SHA256:83BD7D42C9964AAFD2B4FBA13A299FF800C541C6C35DB960BF9C929C4EA192E6
1608Phoenix Keylogger.exeC:\Users\admin\Desktop\IconExtractor.dllexecutable
MD5:36B46C48D2FBCDF839F0BB96BA20B386
SHA256:02707BE9D1E86187D99ED2DC91DF6335D093FBEC1EE4B65B5DC16161615EC2F9
2144WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2144.42384\Phoenix Keylogger\Password.txttext
MD5:74C1D4C44F8B390B493A4328332D079B
SHA256:D62B8A03A0EE992D25266B477ED200B15F7AF793319A5A914B9FBC4680E1BAB6
1608Phoenix Keylogger.exeC:\Users\admin\Desktop\dnlib.dllexecutable
MD5:754A721EE1F1869394EC24212BBD7F30
SHA256:A07EAF627F7CE270B0622DAD29BFCD6F8A9BC49701802F4ED2455FFEE7BC7307
1608Phoenix Keylogger.exeC:\Users\admin\Desktop\learn all kind of hacking.urlbinary
MD5:7ADE4A739CBD8F44D0EF52A2F1BC6E7B
SHA256:CC7649ED53C65E4851ACE414529564FE16801BB2BED4CB15588BFD6B4AC13616
1608Phoenix Keylogger.exeC:\Users\admin\Desktop\gbpast - Login.urlbinary
MD5:4A4F5BE9370E206241BB73BFC2367F3C
SHA256:210F2EE620FE51ACDBE59BBA7BB4ACBDE397034818B09156F6F0874B016A5B18
1608Phoenix Keylogger.exeC:\Users\admin\Desktop\bhatrussia.urlbinary
MD5:96CEC2FF3BC1281C3B541D549538C9FB
SHA256:CD064A6F7AA46315DEA10E6D73BC0416C4954BC8C3FEE19A39A2C88C49F3E8AE
1608Phoenix Keylogger.exeC:\Users\admin\Desktop\Home - cybergoons.urlbinary
MD5:EF51820E228C5BBCF9AABE92E747782E
SHA256:59AC2D12EA4559253FA25F2D367F75B7689BB7B772965101903063F646AE9B4D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Phoenix Keylogger.zip