File name:

horvig4.rar

Full analysis: https://app.any.run/tasks/e86734f3-006c-42d9-8acb-0c2b029dbdd5
Verdict: Malicious activity
Analysis date: May 25, 2020, 22:12:49
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
Indicators:
MIME: application/x-rar
File info: RAR archive data, v4, os: Win32
MD5:

F2FACFAA83604D519D016455EC1A7F3E

SHA1:

9E226839A22F6529680C257696591B7F31C3CF1D

SHA256:

18531FE4AF886AEE917657D284FF4376449AA9B42E4412EF53FC2059C2223715

SSDEEP:

49152:XH/VSHdLvieHiVzvMLw9b7MR9rjfVwJAODzX/n4fUOgVRNXKY6KJ:XH/s9LKBzELPXdwJ9HPUUOg7p36KJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • HorviG.exe (PID: 2844)
      • HorviG.exe (PID: 3128)
      • stockfish (PID: 1840)

  • SUSPICIOUS

    • Creates files in the program directory

      • HorviG.Setup.exe (PID: 3612)
      • HorviGUI.Setup.En.exe (PID: 1356)
      • firefox.exe (PID: 3808)

    • Creates a software uninstall entry

      • HorviG.Setup.exe (PID: 3612)
      • HorviGUI.Setup.En.exe (PID: 1356)

    • Creates files in the user directory

      • HorviGUI.Setup.En.exe (PID: 1356)
      • HorviG.Setup.exe (PID: 3612)

    • Executable content was dropped or overwritten

      • HorviG.exe (PID: 2844)
      • HorviG.Setup.exe (PID: 3612)
      • HorviGUI.Setup.En.exe (PID: 1356)
      • HorviG_chessbot.exe (PID: 2488)

    • Executed via COM

      • DllHost.exe (PID: 3968)
      • DllHost.exe (PID: 2880)

    • Checks for external IP

      • firefox.exe (PID: 3808)

    • Starts application with an unusual extension

      • HorviG_chessbot.exe (PID: 2488)

  • INFO

    • Manual execution by user

      • HorviG.Setup.exe (PID: 3612)
      • HorviGUI.Setup.En.exe (PID: 1356)
      • firefox.exe (PID: 1064)
      • HorviG.Setup.exe (PID: 2692)
      • HorviG_chessbot.exe (PID: 2456)
      • HorviGUI.Setup.En.exe (PID: 2248)
      • HorviGUI.Setup.En.exe (PID: 3244)
      • HorviGUI.Setup.En.exe (PID: 2376)
      • HorviG_chessbot.exe (PID: 2488)

    • Reads CPU info

      • firefox.exe (PID: 3808)

    • Application launched itself

      • firefox.exe (PID: 3808)

    • Reads Internet Cache Settings

      • firefox.exe (PID: 3808)
      • firefox.exe (PID: 2856)
      • pingsender.exe (PID: 2776)

    • Reads settings of System Certificates

      • pingsender.exe (PID: 2776)

    • Creates files in the user directory

      • firefox.exe (PID: 3808)

    • Changes settings of System certificates

      • pingsender.exe (PID: 2776)

    • Adds / modifies Windows certificates

      • pingsender.exe (PID: 2776)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v-4.x) (58.3)
.rar | RAR compressed archive (gen) (41.6)

EXIF

ZIP

CompressedSize: 4476
UncompressedSize: 7763
OperatingSystem: Win32
ModifyDate: 2016:09:30 22:23:13
PackingMethod: Normal
ArchivedFileName: horvig4\example\example\1_top_left.png
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
80
Monitored processes
21
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start winrar.exe no specs horvig.setup.exe no specs horvig.setup.exe horvig.exe horvig_chessbot.exe no specs horvigui.setup.en.exe no specs horvigui.setup.en.exe horvig.exe no specs firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe firefox.exe firefox.exe horvigui.setup.en.exe no specs horvigui.setup.en.exe horvig_chessbot.exe PhotoViewer.dll no specs stockfish no specs pingsender.exe PhotoViewer.dll no specs

Process information

PID
CMD
Path
Indicators
Parent process
1064"C:\Program Files\Mozilla Firefox\firefox.exe" C:\Program Files\Mozilla Firefox\firefox.exe—explorer.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
68.0.1
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
1356"C:\Users\admin\Desktop\horvig4\HorviGUI.Setup.En.exe" C:\Users\admin\Desktop\horvig4\HorviGUI.Setup.En.exe
explorer.exe
User:
admin
Company:
r u b o a r d m a n
Integrity Level:
HIGH
Description:
HorviGUI 1.1 Installation
Exit code:
0
Version:
1.1
Modules
Images
c:\users\admin\desktop\horvig4\horvigui.setup.en.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1388"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\horvig4.rar"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1840"C:\Users\admin\AppData\Local\Temp\stockfish"C:\Users\admin\AppData\Local\Temp\stockfish—HorviG_chessbot.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\stockfish
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
2248"C:\Users\admin\Desktop\horvig4\HorviGUI.Setup.En.exe" C:\Users\admin\Desktop\horvig4\HorviGUI.Setup.En.exe—explorer.exe
User:
admin
Company:
r u b o a r d m a n
Integrity Level:
MEDIUM
Description:
HorviGUI 1.1 Installation
Exit code:
3221226540
Version:
1.1
Modules
Images
c:\users\admin\desktop\horvig4\horvigui.setup.en.exe
c:\systemroot\system32\ntdll.dll
2376"C:\Users\admin\Desktop\horvig4\HorviGUI.Setup.En.exe" C:\Users\admin\Desktop\horvig4\HorviGUI.Setup.En.exe—explorer.exe
User:
admin
Company:
r u b o a r d m a n
Integrity Level:
MEDIUM
Description:
HorviGUI 1.1 Installation
Exit code:
3221226540
Version:
1.1
Modules
Images
c:\windows\system32\wininet.dll
c:\windows\system32\normaliz.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
c:\windows\system32\oleaut32.dll
c:\users\admin\desktop\horvig4\horvigui.setup.en.exe
c:\windows\system32\version.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\rsaenh.dll
2456"C:\Users\admin\Desktop\horvig4\HorviG_chessbot.exe" C:\Users\admin\Desktop\horvig4\HorviG_chessbot.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\horvig4\horvig_chessbot.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winmm.dll
2488"C:\Users\admin\Desktop\horvig4\HorviG_chessbot.exe" C:\Users\admin\Desktop\horvig4\HorviG_chessbot.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\horvig4\horvig_chessbot.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winmm.dll
2688"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3808.0.1633103919\1450614377" -parentBuildID 20190717172542 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 3808 "\\.\pipe\gecko-crash-server-pipe.3808" 1152 gpuC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
1
Version:
68.0.1
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
2692"C:\Users\admin\Desktop\horvig4\HorviG.Setup.exe" C:\Users\admin\Desktop\horvig4\HorviG.Setup.exe—explorer.exe
User:
admin
Company:
nagyzolie@gmail.com
Integrity Level:
MEDIUM
Description:
Chessbot HorviG (cracked) 1.00 Installation
Exit code:
3221226540
Version:
1.00
Modules
Images
c:\users\admin\desktop\horvig4\horvig.setup.exe
c:\systemroot\system32\ntdll.dll
Total events
4 257
Read events
1 168
Write events
2 072
Delete events
1 017

Modification events

(PID) Process:(1388) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1388) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1388) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1388) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12D\52C64B7E
Operation:writeName:@C:\Windows\system32\NetworkExplorer.dll,-1
Value:
Network
(PID) Process:(1388) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\horvig4.rar
(PID) Process:(1388) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1388) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1388) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1388) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1388) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000304000037020000
Executable files
11
Suspicious files
155
Text files
83
Unknown types
113

Dropped files

PID
Process
Filename
Type
1388WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1388.12821\horvig4\example\example\1_top_left.png —
MD5:—
SHA256:—
1388WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1388.12821\horvig4\example\example\2_right_bottom.png —
MD5:—
SHA256:—
1388WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1388.12821\horvig4\example\example\example.png —
MD5:—
SHA256:—
1388WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1388.12821\horvig4\HorviG.Setup.exe —
MD5:—
SHA256:—
1388WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1388.12821\horvig4\HorviGUI.Setup.En.exe —
MD5:—
SHA256:—
1388WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1388.12821\horvig4\HorviG_chessbot.exe —
MD5:—
SHA256:—
1388WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1388.12821\horvig4\readme.txt —
MD5:—
SHA256:—
1388WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1388.12821\horvig4\robot.ini —
MD5:—
SHA256:—
3612HorviG.Setup.exeC:\Users\admin\AppData\Local\Temp\$inst\temp_0.tmp —
MD5:—
SHA256:—
3612HorviG.Setup.exeC:\Program Files\HorviG\ReadMe\ReadMe.txttext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
20
TCP/UDP connections
60
DNS requests
156
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3808
firefox.exe
GET
301
104.22.3.187:80
http://whoer.net/
US
—
—
shared
3808
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
3808
firefox.exe
POST
200
172.217.18.99:80
http://ocsp.pki.goog/gts1o1
US
der
471 b
whitelisted
3808
firefox.exe
POST
200
172.217.18.99:80
http://ocsp.pki.goog/gts1o1
US
der
471 b
whitelisted
3808
firefox.exe
POST
200
151.139.128.14:80
http://ocsp.sectigo.com/
US
der
471 b
whitelisted
3808
firefox.exe
POST
200
172.217.18.99:80
http://ocsp.pki.goog/gts1o1
US
der
472 b
whitelisted
3808
firefox.exe
POST
200
172.217.18.99:80
http://ocsp.pki.goog/gts1o1
US
der
471 b
whitelisted
3808
firefox.exe
POST
200
5.45.205.243:80
http://yandex.ocsp-responder.com/
RU
der
1.51 Kb
whitelisted
3808
firefox.exe
POST
200
172.217.18.99:80
http://ocsp.pki.goog/gts1o1
US
der
472 b
whitelisted
3808
firefox.exe
POST
200
172.217.18.99:80
http://ocsp.pki.goog/gts1o1
US
der
472 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3808
firefox.exe
2.16.107.40:80
detectportal.firefox.com
Akamai International B.V.
—
malicious
3808
firefox.exe
52.41.191.52:443
detectportal.firefox.com
Amazon.com, Inc.
US
unknown
3808
firefox.exe
52.10.33.105:443
push.services.mozilla.com
Amazon.com, Inc.
US
malicious
3808
firefox.exe
143.204.201.119:443
snippets.cdn.mozilla.net
—
US
suspicious
3808
firefox.exe
143.204.201.102:443
firefox.settings.services.mozilla.com
—
US
suspicious
3808
firefox.exe
172.217.21.234:443
safebrowsing.googleapis.com
Google Inc.
US
whitelisted
3808
firefox.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3808
firefox.exe
172.217.18.99:80
ocsp.pki.goog
Google Inc.
US
whitelisted
3808
firefox.exe
143.204.201.62:443
firefox.settings.services.mozilla.com
—
US
suspicious
3808
firefox.exe
216.58.207.36:443
www.google.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
detectportal.firefox.com
  • 34.211.106.52
  • 52.26.114.88
  • 52.41.191.52
  • 2.16.107.58
  • 2.16.107.40
whitelisted
a1089.dscd.akamai.net
  • 2.16.107.58
  • 2.16.107.40
whitelisted
search.services.mozilla.com
  • 52.41.191.52
  • 52.26.114.88
  • 34.211.106.52
whitelisted
search.r53-2.services.mozilla.com
  • —
whitelisted
push.services.mozilla.com
  • 52.10.33.105
whitelisted
autopush.prod.mozaws.net
  • 52.10.33.105
whitelisted
tiles.services.mozilla.com
  • —
whitelisted
snippets.cdn.mozilla.net
  • 143.204.201.119
  • 143.204.201.68
  • 143.204.201.83
  • 143.204.201.78
whitelisted
d228z91au11ukj.cloudfront.net
  • 143.204.201.78
  • 143.204.201.83
  • 143.204.201.68
  • 143.204.201.119
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted

Threats

PID
Process
Class
Message
1052
svchost.exe
Potentially Bad Traffic
ET INFO Observed DNS Query to .cloud TLD
1052
svchost.exe
Potentially Bad Traffic
ET INFO Observed DNS Query to .cloud TLD
1052
svchost.exe
Potentially Bad Traffic
ET INFO Observed DNS Query to .cloud TLD
1052
svchost.exe
Potentially Bad Traffic
ET INFO Observed DNS Query to .cloud TLD
3808
firefox.exe
Potential Corporate Privacy Violation
ET POLICY Possible External IP Lookup whoer.net
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
horvig4.rar