analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| File name: | Scrapebox.rar |
| Full analysis: | https://app.any.run/tasks/99be5cce-64af-4f03-93ab-520516237de7 |
| Verdict: | Malicious activity |
| Analysis date: | May 30, 2020, 03:16:11 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/x-rar |
| File info: | RAR archive data, v4, os: Win32 |
| MD5: | 4CF6E857D844D98571685DBE1983DBD1 |
| SHA1: | 6CBE2F0EDE9094DE431FD4AA84E98B3653276B19 |
| SHA256: | 15CFB08FECD25D2DED97199B23DC2561908E41AF438AC4A05AC4F5B1863912FD |
| SSDEEP: | 196608:aeg88uH128wo2CgnwbSzwDNEu+M52yqBPFeITUAOHZ2kKAYosike9:aegJ0b4wDNT+MmB9eIrHNAYjiz9 |
MALICIOUS
Loads dropped or rewritten executable
- SearchProtocolHost.exe (PID: 1420)
- scrapebox.exe (PID: 3708)
Application was dropped or rewritten from another process
- scrapebox.exe (PID: 3708)
SUSPICIOUS
Executable content was dropped or overwritten
- WinRAR.exe (PID: 3016)
INFO
Manual execution by user
- scrapebox.exe (PID: 3708)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .rar | | | RAR compressed archive (v-4.x) (58.3) |
|---|---|---|
| .rar | | | RAR compressed archive (gen) (41.6) |
EXIF
ZIP
| CompressedSize: | 51 |
|---|---|
| UncompressedSize: | - |
| OperatingSystem: | Win32 |
| ModifyDate: | 2014:09:03 05:49:19 |
| PackingMethod: | Stored |
| ArchivedFileName: | Configuration\cookies.dat |
Total processes
36
Monitored processes
3
Malicious processes
1
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 3016 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Scrapebox.rar" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 | ||||
| 1420 | "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe5_ Global\UsGthrCtrlFltPipeMssGthrPipe5 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" | C:\Windows\System32\SearchProtocolHost.exe | — | SearchIndexer.exe |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft Windows Search Protocol Host Version: 7.00.7600.16385 (win7_rtm.090713-1255) | ||||
| 3708 | "C:\Users\admin\Desktop\scrapebox.exe" | C:\Users\admin\Desktop\scrapebox.exe | explorer.exe | |
User: admin Company: Softtouch Software Design Integrity Level: MEDIUM Description: ScrapeBox Version: 1.16.3.0 | ||||
Total events
862
Read events
821
Write events
0
Delete events
0
Modification events
Executable files
7
Suspicious files
4
Text files
30
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3016 | WinRAR.exe | C:\Users\admin\Desktop\Configuration\engines.def | text | |
MD5:3B83770295AE8A6D0623B79EAAAFD270 | SHA256:75E1DD0CCDC7ED92B79F1DB037AC960884A84BD25C26A3D3B9D22C229903EB5D | |||
| 3016 | WinRAR.exe | C:\Users\admin\Desktop\Configuration\engines.dat | text | |
MD5:5CB7441D5601853B942279192CD2A760 | SHA256:865F7FCF868FA0CB65F56712D650C5C898547FDCE486732C4B81571F3C41F6E7 | |||
| 3016 | WinRAR.exe | C:\Users\admin\Desktop\Configuration\scrapebox.ini | text | |
MD5:049B5823CF43D3683AA11BCCF1764AF9 | SHA256:096CEA0EA6B36D1B01FC3117F4F35499EB744E1A159AE5775E423F30878CB6C3 | |||
| 3016 | WinRAR.exe | C:\Users\admin\Desktop\Configuration\scrapebox.bak | executable | |
MD5:73E6AFD4115E06F2B400F256372D592D | SHA256:0B6B68F8C297C883E652038B94B49C0FC7EDE36D33B83A20E4AE96E3EC51CB4D | |||
| 3016 | WinRAR.exe | C:\Users\admin\Desktop\Configuration\userproxysources.dat | text | |
MD5:D442850E2FF24F853FDCB9E8002AC79F | SHA256:4462C6A7F631A22E436C7EDA32D56EE97986C1E086362147E79BFB462ABEFFFA | |||
| 3016 | WinRAR.exe | C:\Users\admin\Desktop\Harvester_Sessions\Harvester_20130525_001230\batch0001.txt | text | |
MD5:22F400FA3F2B08DFAE63BB69F66D97CE | SHA256:23404008C9968843719583B9EA275BE155809202BF59129D2D3CEDECAEA86364 | |||
| 3016 | WinRAR.exe | C:\Users\admin\Desktop\Configuration\scrapebox.sil | binary | |
MD5:C146DFDE83549D697982C0A8B1C7D648 | SHA256:D5CD21105D6C65F4D75907820A32A77D724D3C87DB7D4CAFF3FAE9A5F618DCD7 | |||
| 3016 | WinRAR.exe | C:\Users\admin\Desktop\Configuration\scrapebox.ini.bak | text | |
MD5:049B5823CF43D3683AA11BCCF1764AF9 | SHA256:096CEA0EA6B36D1B01FC3117F4F35499EB744E1A159AE5775E423F30878CB6C3 | |||
| 3016 | WinRAR.exe | C:\Users\admin\Desktop\Configuration\proxymanager.ini | text | |
MD5:7C5D61AB188BD676CD2F23DCF29E6EB1 | SHA256:E45625F9284C7883223AEEF4F1C89FF1E3AD816CCD6F84A61BEDBFA6A1B3B614 | |||
| 3016 | WinRAR.exe | C:\Users\admin\Desktop\RSS Submission\Websites.txt | text | |
MD5:B3E8E7443CE03EDB0B312F6ACE957D73 | SHA256:89C35305634F409B229532BD63716A3D5EE3AD6A0A72748ACD61D0D02204B4FC | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
0
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3708 | scrapebox.exe | HEAD | — | 208.64.126.169:80 | http://208.64.126.169/lic/address1.php | US | — | — | suspicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3708 | scrapebox.exe | 208.64.126.169:80 | — | Black Lotus Communications | US | suspicious |