File name:

brutus-aet2-darknet.zip

Full analysis: https://app.any.run/tasks/6815f273-b4da-4388-9313-d983af1a9302
Verdict: Malicious activity
Analysis date: December 11, 2021, 13:28:28
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

0663525EC99A1BCEBD9C8ABE398B6828

SHA1:

E356D0FC6A920A010E990288ABC670B94FBBEB2A

SHA256:

017E705BF6E5EBB4FDE25AF315DCC561813520F0C2687DB47E93D1DD5D6C099F

SSDEEP:

6144:65B5F+q8+Q1qPtNpwi5E3c+Awo0GyRdlRH+pg4mexfdVn7iPw8aVCJ7QgY/:6Hn+F+QMpwi3+vJGy3lJlTeLi48YCVQf

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • BrutusA2.exe (PID: 2236)
      • BrutusA2.exe (PID: 760)

  • SUSPICIOUS

    • Checks supported languages

      • WinRAR.exe (PID: 1252)
      • BrutusA2.exe (PID: 2236)
      • BrutusA2.exe (PID: 760)

    • Reads the computer name

      • WinRAR.exe (PID: 1252)
      • BrutusA2.exe (PID: 760)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1252)

    • Reads default file associations for system extensions

      • WinRAR.exe (PID: 1252)
      • WINWORD.EXE (PID: 2492)

    • Drops a file with too old compile date

      • WinRAR.exe (PID: 1252)

    • Application launched itself

      • WINWORD.EXE (PID: 2492)

    • Starts Microsoft Office Application

      • WINWORD.EXE (PID: 2492)

  • INFO

    • Manual execution by user

      • BrutusA2.exe (PID: 2236)
      • NOTEPAD.EXE (PID: 3576)
      • NOTEPAD.EXE (PID: 2044)
      • WINWORD.EXE (PID: 2492)
      • NOTEPAD.EXE (PID: 1740)
      • BrutusA2.exe (PID: 760)

    • Checks supported languages

      • NOTEPAD.EXE (PID: 3576)
      • NOTEPAD.EXE (PID: 2044)
      • WINWORD.EXE (PID: 2492)
      • WINWORD.EXE (PID: 1728)
      • NOTEPAD.EXE (PID: 1740)

    • Reads the computer name

      • WINWORD.EXE (PID: 2492)
      • WINWORD.EXE (PID: 1728)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2492)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 1728)
      • WINWORD.EXE (PID: 2492)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: BrutusA2.exe
ZipUncompressedSize: 679424
ZipCompressedSize: 322330
ZipCRC: 0xf7266f15
ZipModifyDate: 2000:01:28 17:13:17
ZipCompression: Deflated
ZipBitFlag: 0x0001
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
50
Monitored processes
8
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe brutusa2.exe no specs notepad.exe no specs notepad.exe no specs winword.exe no specs winword.exe no specs notepad.exe no specs brutusa2.exe

Process information

PID
CMD
Path
Indicators
Parent process
760"C:\Users\admin\Desktop\hi everyone lol\BrutusA2.exe" C:\Users\admin\Desktop\hi everyone lol\BrutusA2.exe
Explorer.EXE
User:
admin
Company:
HooBie Inc.
Integrity Level:
MEDIUM
Description:
Brutus AET 2
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\hi everyone lol\brutusa2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1252"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\brutus-aet2-darknet.zip"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1728"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /EmbeddingC:\Program Files\Microsoft Office\Office14\WINWORD.EXE—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
1740"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\hi everyone lol\users.txtC:\Windows\system32\NOTEPAD.EXE—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2044"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\hi everyone lol\words.txtC:\Windows\system32\NOTEPAD.EXE—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2236"C:\Users\admin\Desktop\hi everyone lol\BrutusA2.exe" C:\Users\admin\Desktop\hi everyone lol\BrutusA2.exe—Explorer.EXE
User:
admin
Company:
HooBie Inc.
Integrity Level:
MEDIUM
Description:
Brutus AET 2
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\hi everyone lol\brutusa2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\sechost.dll
c:\windows\system32\gdi32.dll
2492"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\hi everyone lol\readme.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
3576"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\hi everyone lol\users.txtC:\Windows\system32\NOTEPAD.EXE—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\rpcrt4.dll
Total events
5 582
Read events
5 408
Write events
134
Delete events
40

Modification events

(PID) Process:(1252) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1252) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1252) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1252) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(1252) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(1252) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\brutus-aet2-darknet.zip
(PID) Process:(1252) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1252) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1252) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1252) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
1
Suspicious files
4
Text files
6
Unknown types
7

Dropped files

PID
Process
Filename
Type
2492WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR9EE9.tmp.cvr —
MD5:—
SHA256:—
2492WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\readme.doc.LNKlnk
MD5:—
SHA256:—
2492WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:—
SHA256:—
2492WINWORD.EXEC:\Users\admin\Desktop\hi everyone lol\~$readme.docpgc
MD5:—
SHA256:—
2492WINWORD.EXEC:\Users\admin\AppData\Local\Temp\OICE_1BFCFB6B-6661-4523-9612-4834AD0098B3.0\msoA3BB.tmpcompressed
MD5:B5802F4892DA80FE22DA82DDFD930D41
SHA256:EDC269996E5EA42D132A0843A308BE725E71839578D415E642D4D5F63B376738
1728WINWORD.EXEC:\Users\admin\AppData\Local\Temp\OICE_1BFCFB6B-6661-4523-9612-4834AD0098B3.0\~DF025BD29551F17A0F.TMPgmc
MD5:BF619EAC0CDF3F68D496EA9344137E8B
SHA256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
2492WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~DFDC86CE3E382CBAAE.TMPgmc
MD5:BF619EAC0CDF3F68D496EA9344137E8B
SHA256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
1252WinRAR.exeC:\Users\admin\Desktop\hi everyone lol\readme.docdocument
MD5:B39751C0E43DF8CA438EFD616B7F9075
SHA256:73B918319AE01F6DF5AA648C76FE099DD25A13653F8F0B13CDEF5118A46F175F
1252WinRAR.exeC:\Users\admin\Desktop\hi everyone lol\NetBus.badtext
MD5:190972127D2E2A813DC42166E2DC0F8E
SHA256:F779FE0C6BAE424075EF0A051C9E94151264F05597A2ED14D21197AC705854AC
1252WinRAR.exeC:\Users\admin\Desktop\hi everyone lol\words.txttext
MD5:BBA19F7F6DAABE778853D9A114F7C103
SHA256:27E098CC4806123BDBEE62CD8A0A484BBC19671673CBFB0956EEE894175D8280
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
20
TCP/UDP connections
23
DNS requests
2
Threats
22

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
760
BrutusA2.exe
HEAD
308
128.116.123.3:80
http://roblox.com/
US
—
—
whitelisted
760
BrutusA2.exe
HEAD
308
128.116.123.3:80
http://roblox.com/
US
—
—
whitelisted
760
BrutusA2.exe
HEAD
308
128.116.123.3:80
http://roblox.com/
US
—
—
whitelisted
760
BrutusA2.exe
HEAD
308
128.116.123.3:80
http://roblox.com/
US
—
—
whitelisted
760
BrutusA2.exe
HEAD
308
128.116.123.3:80
http://roblox.com/
US
—
—
whitelisted
760
BrutusA2.exe
HEAD
308
128.116.123.3:80
http://roblox.com/
US
—
—
whitelisted
760
BrutusA2.exe
HEAD
308
128.116.123.3:80
http://roblox.com/
US
—
—
whitelisted
760
BrutusA2.exe
HEAD
308
128.116.123.3:80
http://roblox.com/
US
—
—
whitelisted
760
BrutusA2.exe
HEAD
308
128.116.123.3:80
http://roblox.com/
US
—
—
whitelisted
760
BrutusA2.exe
HEAD
308
128.116.123.3:80
http://roblox.com/
US
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
128.116.123.3:80
roblox.com
University Corporation for Atmospheric Research
US
suspicious
760
BrutusA2.exe
128.116.123.3:80
roblox.com
University Corporation for Atmospheric Research
US
suspicious
760
BrutusA2.exe
128.116.123.3:110
roblox.com
University Corporation for Atmospheric Research
US
suspicious

DNS requests

Domain
IP
Reputation
roblox.com
  • 128.116.123.3
whitelisted

Threats

PID
Process
Class
Message
760
BrutusA2.exe
Potential Corporate Privacy Violation
ET POLICY Outgoing Basic Auth Base64 HTTP Password detected unencrypted
760
BrutusA2.exe
Attempted Information Leak
ET SCAN Brutus Scan Outbound
760
BrutusA2.exe
Attempted Information Leak
ET SCAN Brutus Scan Outbound
760
BrutusA2.exe
Attempted Information Leak
ET SCAN Brutus Scan Outbound
760
BrutusA2.exe
Attempted Information Leak
ET SCAN Brutus Scan Outbound
760
BrutusA2.exe
Attempted Information Leak
ET SCAN Brutus Scan Outbound
760
BrutusA2.exe
Attempted Information Leak
ET SCAN Brutus Scan Outbound
760
BrutusA2.exe
Attempted Information Leak
ET SCAN Brutus Scan Outbound
760
BrutusA2.exe
Attempted Information Leak
ET SCAN Brutus Scan Outbound
760
BrutusA2.exe
Attempted Information Leak
ET SCAN Brutus Scan Outbound
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
brutus-aet2-darknet.zip