analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
download:

yougamelauncher.zip

Full analysis: https://app.any.run/tasks/18764ed2-6054-42be-8bff-6f2b4d51be65
Verdict: Malicious activity
Analysis date: August 17, 2019, 20:28:33
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

3C66063A32EBF0D19AD746DFC167DCC1

SHA1:

A0BBDE7EC876802D54E3434ECAC2E6CC7DF250D4

SHA256:

0E8A50A612FB2A21C30348D749E59D971556BA51EAE93577DAA3A2B290637F96

SSDEEP:

98304:TkyOvcE8Rh4MP0GYn0tsiC5+fmq3HwD9PUKYpQFAA2xbBEJDFpx4a:CvcEQhlXe0tC5+WxPUVQwbuNj

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • YouGame.exe (PID: 3928)
      • YouGame.exe (PID: 3064)
      • SearchProtocolHost.exe (PID: 1000)

    • Application was dropped or rewritten from another process

      • YouGame.exe (PID: 3928)
      • YouGame.exe (PID: 3064)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3652)

  • INFO

    • Manual execution by user

      • YouGame.exe (PID: 3064)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2019:08:18 00:19:27
ZipCRC: 0x86b9f7ab
ZipCompressedSize: 3213763
ZipUncompressedSize: 6831616
ZipFileName: YouGame Launcher/php5ts.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
35
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start winrar.exe yougame.exe no specs searchprotocolhost.exe no specs yougame.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3652"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\yougamelauncher.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
3928"C:\Users\admin\AppData\Local\Temp\Rar$EXa3652.25619\YouGame Launcher\YouGame.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3652.25619\YouGame Launcher\YouGame.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
1000"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
3064"C:\Users\admin\Desktop\YouGame.exe" C:\Users\admin\Desktop\YouGame.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Total events
510
Read events
486
Write events
24
Delete events
0

Modification events

(PID) Process:(3652) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3652) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3652) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\72\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3652) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\yougamelauncher.zip
(PID) Process:(3652) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3652) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3652) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3652) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3652) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Viewer
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF84000000840000004404000079020000
(PID) Process:(3652) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
Executable files
3
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
3652WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3652.27896\YouGame Launcher\php5ts.dll —
MD5:—
SHA256:—
3652WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3652.27896\YouGame Launcher\YouGame.exe —
MD5:—
SHA256:—
3652WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3652.25619\YouGame Launcher\YouGame.exeexecutable
MD5:0B72A14FD4531B90754E255BD98ABCA6
SHA256:9A559967C52A01CFF86B5B23A2FB1E0DDF00C7D0E90E04C2775491F532F39111
3928YouGame.exeC:\Users\admin\AppData\Local\Temp\PSE20\0b72a14fd4531b90754e255bd98abca6\php.initext
MD5:6A40C247FBCD22D14261FA55F6A16858
SHA256:A337F139CF6AA502AFF68E7A948A62D2BCE9CCEF3E2709B603BA6528BFD23C87
3652WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3652.25619\YouGame Launcher\php5ts.dllexecutable
MD5:C9AFF68F6673FAE7580527E8C76805B6
SHA256:9B2C8B8C4CEC301C4303F58CA4E8B261D516F10FEB24573B092DFCCC263BAEA4
3652WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa3652.25114\php5ts.dllexecutable
MD5:C9AFF68F6673FAE7580527E8C76805B6
SHA256:9B2C8B8C4CEC301C4303F58CA4E8B261D516F10FEB24573B092DFCCC263BAEA4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
yougamelauncher.zip