| File name: | ScrapeBox v2.0.0.84 Cracked.rar.zip |
| Full analysis: | https://app.any.run/tasks/315bf976-b9de-4a58-9ac5-f27e0951e6c4 |
| Verdict: | Malicious activity |
| Threats: | Orcus is a modular Remote Access Trojan with some unusual functions. This RAT enables attackers to create plugins using a custom development library and offers a robust core feature set that makes it one of the most dangerous malicious programs in its class. |
| Analysis date: | December 17, 2023, 06:11:37 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v2.0 to extract |
| MD5: | 7B05700CEDFC15D56EF1559D585532E1 |
| SHA1: | E9B4AB75D6B1BE50C030F313833EAA3FA4837415 |
| SHA256: | 01E4776A11C093C32D5AABA82AE4D669DE7A837A3BCBB4E367FAF0A1B747D518 |
| SSDEEP: | 24576:wFryfwPY/GfFhcR+L8GZ6LF9a2o5yFJvIGgmQ0aYyHPRK:wFryfwPY/GfFhcR+L8GZ6LF02o5yF9IM |
MALICIOUS
Starts Visual C# compiler
- ScrapeBox v2.0.0.84.exe (PID: 2020)
- ScrapeBox v2.0.0.84.exe (PID: 2128)
Orcus is detected
- ScrapeBox v2.0.0.84.exe (PID: 2020)
- ScrapeBox v2.0.0.84.exe (PID: 2128)
- Orcus.exe (PID: 1728)
Drops the executable file immediately after the start
- csc.exe (PID: 492)
- ScrapeBox v2.0.0.84.exe (PID: 2128)
- csc.exe (PID: 1824)
ORCUS has been detected (YARA)
- Orcus.exe (PID: 1728)
SUSPICIOUS
Application launched itself
- WinRAR.exe (PID: 2124)
- ScrapeBox v2.0.0.84.exe (PID: 2020)
Uses .NET C# to load dll
- ScrapeBox v2.0.0.84.exe (PID: 2020)
- ScrapeBox v2.0.0.84.exe (PID: 2128)
Reads the Internet Settings
- ScrapeBox v2.0.0.84.exe (PID: 2020)
- ScrapeBox v2.0.0.84.exe (PID: 2128)
Starts itself from another location
- ScrapeBox v2.0.0.84.exe (PID: 2128)
INFO
Reads the machine GUID from the registry
- ScrapeBox v2.0.0.84.exe (PID: 2020)
- csc.exe (PID: 492)
- cvtres.exe (PID: 784)
- ScrapeBox v2.0.0.84.exe (PID: 2128)
- csc.exe (PID: 1824)
- cvtres.exe (PID: 1732)
- Orcus.exe (PID: 1728)
Drops the executable file immediately after the start
- WinRAR.exe (PID: 2088)
Checks supported languages
- ScrapeBox v2.0.0.84.exe (PID: 2020)
- csc.exe (PID: 492)
- cvtres.exe (PID: 784)
- csc.exe (PID: 1824)
- ScrapeBox v2.0.0.84.exe (PID: 2128)
- Orcus.exe (PID: 1728)
- cvtres.exe (PID: 1732)
Create files in a temporary directory
- ScrapeBox v2.0.0.84.exe (PID: 2020)
- csc.exe (PID: 492)
- ScrapeBox v2.0.0.84.exe (PID: 2128)
- csc.exe (PID: 1824)
- cvtres.exe (PID: 1732)
- cvtres.exe (PID: 784)
Reads the computer name
- ScrapeBox v2.0.0.84.exe (PID: 2020)
- Orcus.exe (PID: 1728)
- ScrapeBox v2.0.0.84.exe (PID: 2128)
Creates files or folders in the user directory
- ScrapeBox v2.0.0.84.exe (PID: 2020)
Creates files in the program directory
- ScrapeBox v2.0.0.84.exe (PID: 2128)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Orcus
(PID) Process(1728) Orcus.exe
C2 (1)127.0.0.1:10134
Keys
AESc1409156d5263156a70da33a5edeed842c6211ec73e78d061a42b8b79d3c889b
Salt
Options
AutostartBuilderProperty
AutostartMethodDisable
TaskSchedulerTaskNameOrcus
TaskHighestPrivilegestrue
RegistryHiddenStarttrue
RegistryKeyNameOrcus
TryAllAutostartMethodsOnFailtrue
ChangeAssemblyInformationBuilderProperty
ChangeAssemblyInformationfalse
AssemblyTitlenull
AssemblyDescriptionnull
AssemblyCompanyNamenull
AssemblyProductNamenull
AssemblyCopyrightnull
AssemblyTrademarksnull
AssemblyProductVersion1.0.0.0
AssemblyFileVersion1.0.0.0
ChangeCreationDateBuilderProperty
IsEnabledfalse
NewCreationDate2019-10-29T20:58:14.2812428+02:00
ChangeIconBuilderProperty
ChangeIconfalse
IconPathnull
ClientTagBuilderProperty
ClientTagnull
DataFolderBuilderProperty
Path%appdata%\Orcus
DefaultPrivilegesBuilderProperty
RequireAdministratorRightsfalse
DisableInstallationPromptBuilderProperty
IsDisabledfalse
FrameworkVersionBuilderProperty
FrameworkVersionNET35
HideFileBuilderProperty
HideFilefalse
InstallationLocationBuilderProperty
Path%programfiles%\Orcus\Orcus.exe
InstallBuilderProperty
Installtrue
KeyloggerBuilderProperty
IsEnabledfalse
MutexBuilderProperty
Mutex3869f62ea43243589f85c060feacc528
ProxyBuilderProperty
ProxyOptionNone
ProxyAddressnull
ProxyPort1080
ProxyType2
ReconnectDelayProperty
Delay10000
RequireAdministratorPrivilegesInstallerBuilderProperty
RequireAdministratorPrivilegestrue
RespawnTaskBuilderProperty
IsEnabledfalse
TaskNameOrcus Respawner
ServiceBuilderProperty
Installfalse
SetRunProgramAsAdminFlagBuilderProperty
SetFlagfalse
WatchdogBuilderProperty
IsEnabledfalse
NameOrcusWatchdog.exe
WatchdogLocationAppData
PreventFileDeletionfalse
Plugins
PluginNameDisable Webcam Lights
PluginVersion1.0
ResourceNamee2c012dfd9a34995b5ce0be5a0f97525
ResourceTypeClientPlugin
Guide6ee5674-bb94-46c7-8bbc-5729af6e2c28
TRiD
| .zip | | | ZIP compressed archive (100) |
|---|
EXIF
ZIP
| ZipRequiredVersion: | 788 |
|---|---|
| ZipBitFlag: | 0x0001 |
| ZipCompression: | None |
| ZipModifyDate: | 2023:12:17 06:10:46 |
| ZipCRC: | 0xf5a696af |
| ZipCompressedSize: | 583840 |
| ZipUncompressedSize: | 583840 |
| ZipFileName: | ScrapeBox v2.0.0.84 Cracked.rar |
Total processes
47
Monitored processes
10
Malicious processes
5
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 492 | "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\_hzvaukw.cmdline" | C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe | — | ScrapeBox v2.0.0.84.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Visual C# Command Line Compiler Exit code: 0 Version: 8.0.50727.5483 (Win7SP1GDR.050727-5400) Modules
| |||||||||||||||
| 784 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES8C2F.tmp" "c:\Users\admin\AppData\Local\Temp\CSC8C2E.tmp" | C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe | — | csc.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft® Resource File To COFF Object Conversion Utility Exit code: 0 Version: 8.00.50727.5003 (Win7SP1GDR.050727-5400) Modules
| |||||||||||||||
| 1356 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIb2124.500\ScrapeBox v2.0.0.84 Cracked.rar" | C:\Program Files\WinRAR\WinRAR.exe | — | WinRAR.exe | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
| 1728 | "C:\Program Files\Orcus\Orcus.exe" | C:\Program Files\Orcus\Orcus.exe | ScrapeBox v2.0.0.84.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Version: 1.0.0.0 Modules
Orcus(PID) Process(1728) Orcus.exe C2 (1)127.0.0.1:10134 Keys AESc1409156d5263156a70da33a5edeed842c6211ec73e78d061a42b8b79d3c889b Salt Options AutostartBuilderProperty AutostartMethodDisable TaskSchedulerTaskNameOrcus TaskHighestPrivilegestrue RegistryHiddenStarttrue RegistryKeyNameOrcus TryAllAutostartMethodsOnFailtrue ChangeAssemblyInformationBuilderProperty ChangeAssemblyInformationfalse AssemblyTitlenull AssemblyDescriptionnull AssemblyCompanyNamenull AssemblyProductNamenull AssemblyCopyrightnull AssemblyTrademarksnull AssemblyProductVersion1.0.0.0 AssemblyFileVersion1.0.0.0 ChangeCreationDateBuilderProperty IsEnabledfalse NewCreationDate2019-10-29T20:58:14.2812428+02:00 ChangeIconBuilderProperty ChangeIconfalse IconPathnull ClientTagBuilderProperty ClientTagnull DataFolderBuilderProperty Path%appdata%\Orcus DefaultPrivilegesBuilderProperty RequireAdministratorRightsfalse DisableInstallationPromptBuilderProperty IsDisabledfalse FrameworkVersionBuilderProperty FrameworkVersionNET35 HideFileBuilderProperty HideFilefalse InstallationLocationBuilderProperty Path%programfiles%\Orcus\Orcus.exe InstallBuilderProperty Installtrue KeyloggerBuilderProperty IsEnabledfalse MutexBuilderProperty Mutex3869f62ea43243589f85c060feacc528 ProxyBuilderProperty ProxyOptionNone ProxyAddressnull ProxyPort1080 ProxyType2 ReconnectDelayProperty Delay10000 RequireAdministratorPrivilegesInstallerBuilderProperty RequireAdministratorPrivilegestrue RespawnTaskBuilderProperty IsEnabledfalse TaskNameOrcus Respawner ServiceBuilderProperty Installfalse SetRunProgramAsAdminFlagBuilderProperty SetFlagfalse WatchdogBuilderProperty IsEnabledfalse NameOrcusWatchdog.exe WatchdogLocationAppData PreventFileDeletionfalse Plugins PluginNameDisable Webcam Lights PluginVersion1.0 ResourceNamee2c012dfd9a34995b5ce0be5a0f97525 ResourceTypeClientPlugin Guide6ee5674-bb94-46c7-8bbc-5729af6e2c28 | |||||||||||||||
| 1732 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RESA044.tmp" "c:\Users\admin\AppData\Local\Temp\CSCA043.tmp" | C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe | — | csc.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft® Resource File To COFF Object Conversion Utility Exit code: 0 Version: 8.00.50727.5003 (Win7SP1GDR.050727-5400) Modules
| |||||||||||||||
| 1824 | "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\l3itm0jb.cmdline" | C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe | — | ScrapeBox v2.0.0.84.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Visual C# Command Line Compiler Exit code: 0 Version: 8.0.50727.5483 (Win7SP1GDR.050727-5400) Modules
| |||||||||||||||
| 2020 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa2088.2578\ScrapeBox v2.0.0.84 Cracked\ScrapeBox v2.0.0.84.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa2088.2578\ScrapeBox v2.0.0.84 Cracked\ScrapeBox v2.0.0.84.exe | WinRAR.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 2088 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIb2124.1598\ScrapeBox v2.0.0.84 Cracked.rar" | C:\Program Files\WinRAR\WinRAR.exe | — | WinRAR.exe | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
| 2124 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\ScrapeBox v2.0.0.84 Cracked.rar.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
| 2128 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa2088.2578\ScrapeBox v2.0.0.84 Cracked\ScrapeBox v2.0.0.84.exe" /wait | C:\Users\admin\AppData\Local\Temp\Rar$EXa2088.2578\ScrapeBox v2.0.0.84 Cracked\ScrapeBox v2.0.0.84.exe | ScrapeBox v2.0.0.84.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
Total events
4 487
Read events
4 415
Write events
72
Delete events
0
Modification events
| (PID) Process: | (2124) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (2124) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 3 |
Value: C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip | |||
| (PID) Process: | (2124) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\phacker.zip | |||
| (PID) Process: | (2124) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\Win7-KB3191566-x86.zip | |||
| (PID) Process: | (2124) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip | |||
| (PID) Process: | (2124) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (2124) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (2124) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (2124) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (2124) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
Executable files
4
Suspicious files
7
Text files
12
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2124 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DIb2124.500\ScrapeBox v2.0.0.84 Cracked.rar | compressed | |
MD5:05D40D1DBB5BEEBEB27883EFDE5A88D4 | SHA256:9D2400E7A1F7C452916960EC8B04E1C8C7EAEFAA7B3B046113F234153AF35A62 | |||
| 492 | csc.exe | C:\Users\admin\AppData\Local\Temp\CSC8C2E.tmp | binary | |
MD5:142C9912027FF75FAAECB240B2E84F5E | SHA256:19390114B42F6ED6E6453B994F01EC8E4372F1D0D0CAA3D7938859E3AFC7F57F | |||
| 2088 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa2088.2578\ScrapeBox v2.0.0.84 Cracked\block-list.txt | text | |
MD5:DC7AB9888897071C7FAC87BB3438E28B | SHA256:68816E76B153C5FD1D9FC06D6DB72772FBD13232E1481BCF74493474B6E000F7 | |||
| 2020 | ScrapeBox v2.0.0.84.exe | C:\Users\admin\AppData\Local\Temp\_hzvaukw.cmdline | text | |
MD5:5B831EF31C3249A63C3CB60E03C60DF5 | SHA256:1813164D2E6BD6B21BB0BB042BF09AB438B295C50C9379A0678B04B12B9E1E59 | |||
| 2088 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa2088.2578\ScrapeBox v2.0.0.84 Cracked\ScrapeBox v2.0.0.84.exe | executable | |
MD5:7FCB9CCB3AF51581B21CAAAC764222FB | SHA256:DAC431DA90D3FCCFC1DB4C0EC7BEEC303F6218A754C078CC4D5621AC1B787D3F | |||
| 2088 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa2088.2578\ScrapeBox v2.0.0.84 Cracked\log.txt | text | |
MD5:E9795E29304468A5B9C9FC8517331268 | SHA256:9DBB5B0F72A3005355B31E4E14B031040EC9D7E4C710D9737B7C3BF5413ED920 | |||
| 2124 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DIb2124.1598\ScrapeBox v2.0.0.84 Cracked.rar | compressed | |
MD5:05D40D1DBB5BEEBEB27883EFDE5A88D4 | SHA256:9D2400E7A1F7C452916960EC8B04E1C8C7EAEFAA7B3B046113F234153AF35A62 | |||
| 2088 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa2088.2578\ScrapeBox v2.0.0.84 Cracked\NLog.config | xml | |
MD5:073D7A3051DACAB30B6EB6468756AF8A | SHA256:89EF6ADE268F50F86B543DB939DF5DF2DBFD72503E8E3DC74F0866C6549C82D5 | |||
| 2020 | ScrapeBox v2.0.0.84.exe | C:\Users\admin\AppData\Local\Temp\_hzvaukw.0.cs | text | |
MD5:4B0981628A8D0E2DADA1F05A46A01337 | SHA256:09BA8868809FDC7040BE6F86979C94A3634D7A2713FF7199DD33E9AD5185A629 | |||
| 2088 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa2088.2578\ScrapeBox v2.0.0.84 Cracked\config.ini | ini | |
MD5:2152388780302946DAB15337ECFEAE05 | SHA256:D3527EBFB29B1AB7B02A50F47CEA3892527312FAEFDBCB8422A56F9DD97E03EE | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2
DNS requests
0
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |