analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Uccam.rar

Full analysis: https://app.any.run/tasks/b0dc7e97-c1d1-40a4-90fd-2e909c1ce746
Verdict: Malicious activity
Analysis date: July 13, 2020, 06:35:14
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

AB0165C09EBC0297C8327FFA7E6C6D1F

SHA1:

886A70C08E90B7D6ED21EC1B2871A5276202DEA7

SHA256:

092171BB23BB03DE6A605B41956C2E1658C531F573AD087BF8F563D7A91AB803

SSDEEP:

6144:JhMdwJg+sE5UgCHkz0ncMppNq0kuCp/sOXFsUyU2Q2+nyTdyAF:JhCYrCHkoncwkfKOByBQ3nyNF

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • aykaf.exe (PID: 1416)
      • aykaf.exe (PID: 2520)
      • aykaf.exe (PID: 4064)

    • Changes the autorun value in the registry

      • explorer.exe (PID: 2628)

    • Loads the Task Scheduler COM API

      • explorer.exe (PID: 2628)
      • schtasks.exe (PID: 2528)

    • Uses Task Scheduler to run other applications

      • explorer.exe (PID: 2628)

  • SUSPICIOUS

    • Application launched itself

      • aykaf.exe (PID: 2520)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1496)

    • Reads Internet Cache Settings

      • explorer.exe (PID: 2628)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
6
Malicious processes
2
Suspicious processes
3

Behavior graph

Click at the process to see the details
drop and start start winrar.exe aykaf.exe no specs aykaf.exe no specs explorer.exe aykaf.exe no specs schtasks.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1496"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Uccam.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
2520"C:\Users\admin\AppData\Local\Temp\Rar$EXb1496.46789\Uccam\aykaf.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb1496.46789\Uccam\aykaf.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
4064C:\Users\admin\AppData\Local\Temp\Rar$EXb1496.46789\Uccam\aykaf.exe /CC:\Users\admin\AppData\Local\Temp\Rar$EXb1496.46789\Uccam\aykaf.exe—aykaf.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2628C:\Windows\explorer.exeC:\Windows\explorer.exe
aykaf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1416"C:\Users\admin\AppData\Local\Temp\Rar$EXb1496.46789\Uccam\aykaf.exe" /WC:\Users\admin\AppData\Local\Temp\Rar$EXb1496.46789\Uccam\aykaf.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
111
2528"C:\Windows\system32\schtasks.exe" /create /tn {C12565E3-7E71-4686-962C-CCDF2D8D62DF} /tr "\"C:\Users\admin\AppData\Local\Temp\Rar$EXb1496.46789\Uccam\aykaf.exe\"" /sc HOURLY /mo 5 /FC:\Windows\system32\schtasks.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
603
Read events
569
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
6
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
1496WinRAR.exeC:\Users\admin\AppData\Local\Temp\__rar_1496.364 —
MD5:—
SHA256:—
1496WinRAR.exeC:\Users\admin\AppData\Local\Temp\Uccam.rarcompressed
MD5:D2D7903A87C7201C50115A34139F3AA0
SHA256:EE186DB3970342600EC1CFBCF8D292FB5D36F8FBBEDA342C6043F662DADE2A0E
1496WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb1496.46789\Uccam\aykaf.datbinary
MD5:8390AB91BA3BED2B19A63CB3AA820D91
SHA256:6008DF00CC6A28AC9381BC35E2CD02EE77A009E2393C4BC1D287DB6632D3BBB1
2628explorer.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb1496.46789\Uccam\aykaf.datbinary
MD5:5FBCDC7A11A1548BD2C026D7368C9BA4
SHA256:9E492C1EE60C3E92EB6488DAEE33FDAD8E8C0E495970C84F9D748746A139E1E5
1496WinRAR.exeC:\Users\admin\AppData\Local\Temp\Uccam.bak1496.371compressed
MD5:D2D7903A87C7201C50115A34139F3AA0
SHA256:EE186DB3970342600EC1CFBCF8D292FB5D36F8FBBEDA342C6043F662DADE2A0E
1496WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb1496.46789\Uccam\aykaf.exeexecutable
MD5:5DF04BBD9818E0F7167D3FB21FDA0E3D
SHA256:E383F6D7A926BAA77BE9914E9FA69669E9A4C5CE774B3515A268691B553D6B41
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
10
DNS requests
3
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2628
explorer.exe
GET
301
85.93.89.6:80
http://www.ip-adress.com/
DE
html
234 b
shared
2628
explorer.exe
GET
301
85.93.89.6:80
http://www.ip-adress.com/
DE
html
234 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2628
explorer.exe
68.116.183.68:443
—
Charter Communications
US
unknown
2628
explorer.exe
85.93.89.6:80
www.ip-adress.com
Host Europe GmbH
DE
malicious
2628
explorer.exe
23.49.13.33:7000
—
Akamai International B.V.
US
whitelisted
2628
explorer.exe
85.93.89.6:443
www.ip-adress.com
Host Europe GmbH
DE
malicious

DNS requests

Domain
IP
Reputation
www.ip-adress.com
  • 85.93.89.6
  • 207.38.89.115
  • 209.126.124.166
  • 85.93.88.251
shared
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

PID
Process
Class
Message
2628
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] External IP (possible Qbot)
2628
explorer.exe
Potential Corporate Privacy Violation
POLICY [PTsecurity] External IP Address Check
2628
explorer.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
2628
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] External IP (possible Qbot)
2628
explorer.exe
Potential Corporate Privacy Violation
POLICY [PTsecurity] External IP Address Check
2628
explorer.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Uccam.rar