analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

PO 0095421.g.z

Full analysis: https://app.any.run/tasks/54976e2d-50b1-408f-9182-6fa01d616738
Verdict: Malicious activity
Analysis date: February 18, 2019, 10:03:37
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

535A5B693CD25424F48AC760FBC74E42

SHA1:

BC529A45CEC857059193785760C6EDE987E3FB20

SHA256:

0C7556738DA31BED268D804A26469A1064E301E766B313060F3916AD5F6CC03C

SSDEEP:

6144:/WhPgQPvYoDNAnnSoI5UZ8mCgYlhEeiF1J909G4ItKWy5wKQu3r:/cPgQPvdD0n7sUjchEe4zF+5wrub

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • PO 0095421.exe (PID: 2824)
      • PO 0095421.exe (PID: 3664)
      • PO 0095421.exe (PID: 4088)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2964)
    • Application launched itself

      • PO 0095421.exe (PID: 2824)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
34
Monitored processes
4
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe po 0095421.exe no specs po 0095421.exe no specs po 0095421.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2964"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\PO 0095421.g.z.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
2824"C:\Users\admin\Desktop\PO 0095421.exe" C:\Users\admin\Desktop\PO 0095421.exeexplorer.exe
User:
admin
Company:
buy
Integrity Level:
MEDIUM
Description:
TOX
Exit code:
0
Version:
1.09.0004
3664"C:\Users\admin\Desktop\PO 0095421.exe" C:\Users\admin\Desktop\PO 0095421.exeexplorer.exe
User:
admin
Company:
buy
Integrity Level:
MEDIUM
Description:
TOX
Version:
1.09.0004
4088C:\Users\admin\Desktop\PO 0095421.exe" C:\Users\admin\Desktop\PO 0095421.exePO 0095421.exe
User:
admin
Company:
buy
Integrity Level:
MEDIUM
Description:
TOX
Version:
1.09.0004
Total events
422
Read events
414
Write events
8
Delete events
0

Modification events

(PID) Process:(2964) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2964) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2964) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2964) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\PO 0095421.g.z.rar
(PID) Process:(2964) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2964) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2964) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2964) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
1
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2824PO 0095421.exeC:\Users\admin\AppData\Local\Temp\~DFEEA6B8EAFDDED333.TMPbinary
MD5:7C16D8200035D49E76CE5A1F1A2F6AFA
SHA256:9D772560606397DDDE5D4AD1CB57E8871209CB5ABA0448BE721C675949D31372
2964WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2964.24405\PO 0095421.exeexecutable
MD5:2E60F7C02C034A00A75FCF0D6DBDC208
SHA256:8989C13D992BFB3C389D581B1C8612C54A8EC0698480ED35031ADBCFDF41A2E1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info