Edit tour

Windows Analysis Report
MDE_File_Sample_dd251a99f008f79c12fdc42e4eeef2e8bc0263b4.zip

Overview

General Information

Sample name:MDE_File_Sample_dd251a99f008f79c12fdc42e4eeef2e8bc0263b4.zip
Analysis ID:1671065
MD5:b921616e83f0614e2bd0b58b26b68969
SHA1:eee7b23b56a8297f92900d441e1945b5c10b9f47
SHA256:6a0335aaa0e658e018904f634839a0a455dd0589bc8f182a88220cee474383c6
Infos:

Detection

Score:2
Range:0 - 100
Confidence:60%

Signatures

Allocates memory with a write watch (potentially for evading sandboxes)
Creates a process in suspended mode (likely to inject code)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
May sleep (evasive loops) to hinder dynamic analysis

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
  • System is w10x64
  • unarchiver.exe (PID: 7504 cmdline: "C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Desktop\MDE_File_Sample_dd251a99f008f79c12fdc42e4eeef2e8bc0263b4.zip" MD5: 16FF3CC6CC330A08EED70CBC1D35F5D2)
    • 7za.exe (PID: 7664 cmdline: "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\4zcyeayl.1dm" "C:\Users\user\Desktop\MDE_File_Sample_dd251a99f008f79c12fdc42e4eeef2e8bc0263b4.zip" MD5: 77E556CDFDC5C592F5C46DB4127C6F4C)
      • conhost.exe (PID: 7700 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cleanup
No configs have been found
No yara matches
No Sigma rule has matched
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: C:\Windows\SysWOW64\unarchiver.exeFile opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dllJump to behavior
Source: classification engineClassification label: clean2.winZIP@4/1@0/0
Source: C:\Windows\SysWOW64\unarchiver.exeMutant created: NULL
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7700:120:WilError_03
Source: C:\Windows\SysWOW64\unarchiver.exeFile created: C:\Users\user\AppData\Local\Temp\unarchiver.logJump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: unknownProcess created: C:\Windows\SysWOW64\unarchiver.exe "C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Desktop\MDE_File_Sample_dd251a99f008f79c12fdc42e4eeef2e8bc0263b4.zip"
Source: C:\Windows\SysWOW64\unarchiver.exeProcess created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\4zcyeayl.1dm" "C:\Users\user\Desktop\MDE_File_Sample_dd251a99f008f79c12fdc42e4eeef2e8bc0263b4.zip"
Source: C:\Windows\SysWOW64\7za.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\unarchiver.exeProcess created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\4zcyeayl.1dm" "C:\Users\user\Desktop\MDE_File_Sample_dd251a99f008f79c12fdc42e4eeef2e8bc0263b4.zip"Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\SysWOW64\7za.exeSection loaded: 7z.dllJump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exeFile opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dllJump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exeFile opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dllJump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exeMemory allocated: F20000 memory reserve | memory write watchJump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exeMemory allocated: 2C20000 memory reserve | memory write watchJump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exeMemory allocated: F20000 memory commit | memory reserve | memory write watchJump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exeWindow / User API: threadDelayed 2228Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exeWindow / User API: threadDelayed 7742Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe TID: 7912Thread sleep count: 2228 > 30Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe TID: 7912Thread sleep time: -1114000s >= -30000sJump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe TID: 7912Thread sleep count: 7742 > 30Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe TID: 7912Thread sleep time: -3871000s >= -30000sJump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exeMemory allocated: page read and write | page guardJump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exeProcess created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\4zcyeayl.1dm" "C:\Users\user\Desktop\MDE_File_Sample_dd251a99f008f79c12fdc42e4eeef2e8bc0263b4.zip"Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
DLL Side-Loading
11
Process Injection
2
Virtualization/Sandbox Evasion
OS Credential Dumping2
Virtualization/Sandbox Evasion
Remote ServicesData from Local SystemData ObfuscationExfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
DLL Side-Loading
1
Disable or Modify Tools
LSASS Memory1
Application Window Discovery
Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)11
Process Injection
Security Account Manager2
System Information Discovery
SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
DLL Side-Loading
NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1671065 Sample: MDE_File_Sample_dd251a99f00... Startdate: 22/04/2025 Architecture: WINDOWS Score: 2 6 unarchiver.exe 4 2->6         started        process3 8 7za.exe 2 6->8         started        process4 10 conhost.exe 8->10         started       

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
No Antivirus matches
No Antivirus matches
No Antivirus matches
No Antivirus matches
No Antivirus matches
No contacted domains info
No contacted IP infos
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1671065
Start date and time:2025-04-22 15:18:07 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 3m 47s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:default.jbs
Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:12
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • EGA enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Sample name:MDE_File_Sample_dd251a99f008f79c12fdc42e4eeef2e8bc0263b4.zip
Detection:CLEAN
Classification:clean2.winZIP@4/1@0/0
Cookbook Comments:
  • Found application associated with file extension: .zip
  • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
  • Excluded IPs from analysis (whitelisted): 184.29.183.29, 20.109.210.53, 150.171.28.254
  • Excluded domains from analysis (whitelisted): c2a9c95e369881c67228a6591cac2686.clo.footprintdns.com, ax-ring.msedge.net, fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, e16604.dscf.akamaiedge.net, c.pki.goog, fe3cr.delivery.mp.microsoft.com
  • Not all processes where analyzed, report is missing behavior information
  • Report size getting too big, too many NtQueryValueKey calls found.
TimeTypeDescription
09:19:30API Interceptor1152959x Sleep call for process: unarchiver.exe modified
No context
No context
No context
No context
No context
Process:C:\Windows\SysWOW64\unarchiver.exe
File Type:ASCII text, with CRLF line terminators
Category:dropped
Size (bytes):2630
Entropy (8bit):5.102123493476543
Encrypted:false
SSDEEP:48:Dr7yEXfIfGb0fG0fGpafGHZifG0fGp37yfGbOfGC7yfG8fG/fG0fG0fGmjfG0fGq:Dr7ySQr3H0i3y7yUOP7yfy33R3E3ReoK
MD5:16B74ADC06C86D4F612593EE35A966CC
SHA1:E2998DE10E0EB26129BCDA224FDF913593F4A087
SHA-256:58E2F3C2753736E8FCE986719234707795B7DE04FF831422DDCE97258EC09B7A
SHA-512:03BD1A6A99B6502EC358A334AFD0F0B5FC52BEFA8A37CC4EA56DE36E80BA26C19B0B0014D11E581DB1C00021145B4B6E1F329A8B538EC8E1BC2B43CB2D79E995
Malicious:false
Reputation:low
Preview:04/22/2025 9:18 AM: Unpack: C:\Users\user\Desktop\MDE_File_Sample_dd251a99f008f79c12fdc42e4eeef2e8bc0263b4.zip..04/22/2025 9:18 AM: Tmp dir: C:\Users\user\AppData\Local\Temp\4zcyeayl.1dm..04/22/2025 9:18 AM: Received from standard error: ERROR: Wrong password : Driesmans en Co NV .pdf..04/22/2025 9:18 AM: Received from standard out: 7-Zip 18.05 (x86) : Copyright (c) 1999-2018 Igor Pavlov : 2018-04-30..04/22/2025 9:18 AM: Received from standard out: ..04/22/2025 9:18 AM: Received from standard out: Scanning the drive for archives:..04/22/2025 9:18 AM: Received from standard out: 1 file, 86642 bytes (85 KiB)..04/22/2025 9:18 AM: Received from standard out: ..04/22/2025 9:18 AM: Received from standard out: Extracting archive: C:\Users\user\Desktop\MDE_File_Sample_dd251a99f008f79c12fdc42e4eeef2e8bc0263b4.zip..04/22/2025 9:18 AM: Received from standard out: --..04/22/2025 9:18 AM: Received from standard out: Path = C:\Users\user\Desktop\MDE_File_Sample_dd251a99f008f79c12fdc42e4eeef2
File type:Zip archive data, at least v2.0 to extract, compression method=deflate
Entropy (8bit):7.997694369811437
TrID:
  • ZIP compressed archive (8000/1) 100.00%
File name:MDE_File_Sample_dd251a99f008f79c12fdc42e4eeef2e8bc0263b4.zip
File size:86'642 bytes
MD5:b921616e83f0614e2bd0b58b26b68969
SHA1:eee7b23b56a8297f92900d441e1945b5c10b9f47
SHA256:6a0335aaa0e658e018904f634839a0a455dd0589bc8f182a88220cee474383c6
SHA512:7d078af9fa62790c1a0db4e539321643aadcbe07cd42c13023454e7a62858439633d5d9eb9791d335cc1d2b37f1d1f23627e5c737f51c7d7a0fe72aaf9cf5e24
SSDEEP:1536:JtmF/calsT6DmPWiPRzOZdVMvUXghA77IjKuedSc6hzwFivDEU/DF:JyUEs+mPWoNOZAswi77C/eadL7F
TLSH:C883129CE585C5E335F44651B887156CE893267BF4C63EC06D0BB78CBCA9A929E84307
File Content Preview:PK........4j.Z<....Q........$.Driesmans en Co NV .pdf.. ..........H\......H\......H\.......G.~.B......G..E...I..J....[.U.7.et..R.r...ek4...r..........3[.7.=W1..&G.......UQs......k:P.........Y...a.Zz.D.....g..%.../.....:.8..B.......'.:].y.;.o.O.........m..
Icon Hash:90cececece8e8eb0
No network behavior found
050100s020406080100

Click to jump to process

050100s0.0051015MB

Click to jump to process

  • File
  • Registry

Click to dive into process behavior distribution

Target ID:1
Start time:09:18:57
Start date:22/04/2025
Path:C:\Windows\SysWOW64\unarchiver.exe
Wow64 process (32bit):true
Commandline:"C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Desktop\MDE_File_Sample_dd251a99f008f79c12fdc42e4eeef2e8bc0263b4.zip"
Imagebase:0x570000
File size:12'800 bytes
MD5 hash:16FF3CC6CC330A08EED70CBC1D35F5D2
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high
Has exited:false

Target ID:3
Start time:09:18:57
Start date:22/04/2025
Path:C:\Windows\SysWOW64\7za.exe
Wow64 process (32bit):true
Commandline:"C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\4zcyeayl.1dm" "C:\Users\user\Desktop\MDE_File_Sample_dd251a99f008f79c12fdc42e4eeef2e8bc0263b4.zip"
Imagebase:0x340000
File size:289'792 bytes
MD5 hash:77E556CDFDC5C592F5C46DB4127C6F4C
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high
Has exited:true

Target ID:5
Start time:09:18:57
Start date:22/04/2025
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff7e2000000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high
Has exited:true

No disassembly