analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

VR_1.2.0.zip

Full analysis: https://app.any.run/tasks/918a7290-9c7d-4f9b-831b-9ec03ec56810
Verdict: Malicious activity
Analysis date: September 30, 2020, 02:17:38
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
opendir
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

775DEEDB30E5C52C90F708D7284FB85B

SHA1:

87A724A186925326CD839BF48A2F545A14A6602C

SHA256:

1645F945BF477252FE1B4D89EA31CA7A2A8E7B26A08855A35FD70ACE15C8ABA8

SSDEEP:

98304:mcOtX8surz4S1BnFzl4D3WPxAkqTzRFWhmN0N:HOtXsrcS1BnP47mxAPTSx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 3888)
      • VR.exe (PID: 2752)
      • VR.exe (PID: 1208)

    • Application was dropped or rewritten from another process

      • VR.exe (PID: 1208)
      • VR.exe (PID: 2752)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1684)

    • Uses RUNDLL32.EXE to load library

      • VR.exe (PID: 1208)
      • VR.exe (PID: 2752)

    • Creates files in the user directory

      • rundll32.exe (PID: 3160)

    • Reads Internet Cache Settings

      • rundll32.exe (PID: 3160)

  • INFO

    • Manual execution by user

      • VR.exe (PID: 1208)
      • VR.exe (PID: 2752)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2020:05:06 19:38:13
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: VR 1.2.0/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
6
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe searchprotocolhost.exe no specs vr.exe rundll32.exe vr.exe rundll32.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1684"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\VR_1.2.0.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
3888"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe4_ Global\UsGthrCtrlFltPipeMssGthrPipe4 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
1208"C:\Users\admin\Desktop\VR 1.2.0\VR.exe" C:\Users\admin\Desktop\VR 1.2.0\VR.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
WindowsFormsApp1
Version:
1.0.0.0
3160C:\Windows\system32\rundll32.exe C:\Windows\system32\gameux.dll,GameUXShim {c69b7a85-0b83-401b-881a-3df6a3934000};C:\Users\admin\Desktop\VR 1.2.0\VR.exe;1208C:\Windows\system32\rundll32.exe
VR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2752"C:\Users\admin\Desktop\VR 1.2.0\VR.exe" C:\Users\admin\Desktop\VR 1.2.0\VR.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
WindowsFormsApp1
Version:
1.0.0.0
3688C:\Windows\system32\rundll32.exe C:\Windows\system32\gameux.dll,GameUXShim {c69b7a85-0b83-401b-881a-3df6a3934000};C:\Users\admin\Desktop\VR 1.2.0\VR.exe;2752C:\Windows\system32\rundll32.exe—VR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
1 097
Read events
1 051
Write events
46
Delete events
0

Modification events

(PID) Process:(1684) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1684) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1684) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1684) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\VR_1.2.0.zip
(PID) Process:(1684) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1684) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1684) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1684) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1684) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13B\52C64B7E
Operation:writeName:@C:\Windows\system32\notepad.exe,-469
Value:
Text Document
(PID) Process:(1684) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\DialogEditHistory\ExtrPath
Operation:writeName:0
Value:
C:\Users\admin\Desktop
Executable files
9
Suspicious files
0
Text files
2
Unknown types
3

Dropped files

PID
Process
Filename
Type
1684WinRAR.exeC:\Users\admin\Desktop\VR 1.2.0\Anarchy.dllexecutable
MD5:8D5437EA6D950E82FBB8EEC088DE8D3E
SHA256:E6254AE1C6F7906C874897570DB4E8AEFF95091049056557AA304A1B4FC1E171
1684WinRAR.exeC:\Users\admin\Desktop\VR 1.2.0\MetroSuite 2.0.dllexecutable
MD5:5EE9F67FE5FC7F5E12452CCC1F264388
SHA256:00CEC7945BE290CF35A2DA6A9C5C3E3630D454D32EBC34B52D6EA2CB2F85DB66
1684WinRAR.exeC:\Users\admin\Desktop\VR 1.2.0\MetroFramework.dllexecutable
MD5:EADE3A0C93F4A4539CBFB7DA94632ABF
SHA256:FFBECA7CAF4AF85AD5A1245C6D91296EFC2B24A28CC95A5AF31DF1660FF9F895
1684WinRAR.exeC:\Users\admin\Desktop\VR 1.2.0\README.txttext
MD5:EDFDA6A3AFC9FD989046C777C5E198C0
SHA256:505BD46C798D79BEC2B4C7131F383DDA8C0DABC5223D2C75FB8A328C8E624B7D
1684WinRAR.exeC:\Users\admin\Desktop\VR 1.2.0\settings\proxies.txttext
MD5:E55C50FECB0B288E43B6EE4A23CAF191
SHA256:D38AF3692CB065DCABD935EDC535BC6D3BF8041F924EF64AEBDBB451BD1E7F9D
1684WinRAR.exeC:\Users\admin\Desktop\VR 1.2.0\VR.exeexecutable
MD5:ED8F0D99F811BCD22EC064A5B0CAF40A
SHA256:3A8AA7F4172BD7D174B009C30509519306449274292D1A3CDF2044B0D95186FD
1684WinRAR.exeC:\Users\admin\Desktop\VR 1.2.0\Newtonsoft.Json.Schema.dllexecutable
MD5:9C4CA74DF958F8CBEC953FE756245B73
SHA256:D27E6413382FB31FA30D1AB95C956284C4F8B1C1834CF22B79A83C894F5A8DD0
1684WinRAR.exeC:\Users\admin\Desktop\VR 1.2.0\FlatUI.dllexecutable
MD5:B63F5C816F8799857B9B8F95B6E2A9B0
SHA256:058C926A8818479B06AB9402F2A6C85EB0F64626C2956102D6699AD413AFE2FB
1684WinRAR.exeC:\Users\admin\Desktop\VR 1.2.0\DarkUI.dllexecutable
MD5:B6B8464FF0134F035F0DBEF4130A36BB
SHA256:4A6CE472A481560F3004FD4FD19952F96E1F8F96078168166792450CA005EA33
3160rundll32.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games\Vietnam Med+Evac™.lnklnk
MD5:7FEF83CAFC2562DC4E0E9C7F03B82D41
SHA256:B597D444FA95C002487950C1FF6CFA3DD4156C8CBCFCB90766600FBA3594DDF6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
5
DNS requests
3
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3160
rundll32.exe
GET
—
65.55.186.115:80
http://movie.metaservices.microsoft.com/locater/WMServiceLocater.asmx/GetServiceLocationsForClient?locale=en-US&clientType=VISTA_GAMES&clientVersion=6.1.2
US
—
—
whitelisted
3160
rundll32.exe
GET
302
104.111.238.86:80
http://go.microsoft.com/fwlink?linkid=30219&locale=en-US&clientType=VISTA_GAMES&clientVersion=6.1.2
NL
—
—
whitelisted
2752
VR.exe
GET
200
145.14.144.222:80
http://voidata.000webhostapp.com/voidraider/newestVersion
US
text
5 b
shared
1208
VR.exe
GET
404
145.14.144.222:80
http://voidata.000webhostapp.com/voidraider/updateState
US
html
13.1 Kb
shared
2752
VR.exe
GET
404
145.14.144.222:80
http://voidata.000webhostapp.com/voidraider/updateState
US
html
13.1 Kb
shared
1208
VR.exe
GET
200
145.14.144.222:80
http://voidata.000webhostapp.com/voidraider/newestVersion
US
text
5 b
shared
1208
VR.exe
GET
200
145.14.144.222:80
http://voidata.000webhostapp.com/voidraider/whitelist
US
text
221 b
shared
2752
VR.exe
GET
200
145.14.144.222:80
http://voidata.000webhostapp.com/voidraider/whitelist
US
text
221 b
shared
1208
VR.exe
GET
200
145.14.144.222:80
http://voidata.000webhostapp.com/voidraider/whitelist
US
text
221 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3160
rundll32.exe
65.55.186.115:80
movie.metaservices.microsoft.com
Microsoft Corporation
US
whitelisted
3160
rundll32.exe
104.111.238.86:80
go.microsoft.com
Akamai International B.V.
NL
whitelisted
2752
VR.exe
145.14.144.222:80
voidata.000webhostapp.com
Hostinger International Limited
US
shared
1208
VR.exe
145.14.144.222:80
voidata.000webhostapp.com
Hostinger International Limited
US
shared
—
—
145.14.144.222:80
voidata.000webhostapp.com
Hostinger International Limited
US
shared

DNS requests

Domain
IP
Reputation
go.microsoft.com
  • 104.111.238.86
whitelisted
movie.metaservices.microsoft.com
  • 65.55.186.115
whitelisted
voidata.000webhostapp.com
  • 145.14.144.222
shared

Threats

PID
Process
Class
Message
—
—
Not Suspicious Traffic
ET INFO Observed Free Hosting Domain (*.000webhostapp .com in DNS Lookup)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
VR_1.2.0.zip