File name:

babel 4.0 BY OWL.rar

Full analysis: https://app.any.run/tasks/c7030c42-3626-456b-b2fa-b464a0f0090c
Verdict: Malicious activity
Analysis date: May 21, 2022, 05:07:33
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

7B843011F7144203DA5EE763B5196B8B

SHA1:

9B5A350A751D35A9DCA1CE84710FC7D2B75B3713

SHA256:

18E441F837E8EF19179ACE44349A3D248EC911FB77404DA2B039E88EC820FFA8

SSDEEP:

49152:srYqKOvK5bc2shNQAXVKkcpdwphOexS5WzYbarAmdgdyAoMbo:srYlOyRc2iyAlKxpdTICDerpKAX2o

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • msiexec.exe (PID: 2732)
      • msiexec.exe (PID: 2300)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2684)
      • msiexec.exe (PID: 2732)
      • msiexec.exe (PID: 2300)

    • Reads the computer name

      • WinRAR.exe (PID: 2684)
      • msiexec.exe (PID: 2300)
      • MsiExec.exe (PID: 2664)
      • MsiExec.exe (PID: 2692)
      • MsiExec.exe (PID: 3476)
      • filezilla.exe (PID: 1692)

    • Checks supported languages

      • WinRAR.exe (PID: 2684)
      • msiexec.exe (PID: 2300)
      • MsiExec.exe (PID: 2664)
      • MsiExec.exe (PID: 2692)
      • MsiExec.exe (PID: 3476)
      • filezilla.exe (PID: 1692)

    • Starts Microsoft Installer

      • WinRAR.exe (PID: 2684)

    • Reads Windows owner or organization settings

      • msiexec.exe (PID: 2732)
      • msiexec.exe (PID: 2300)

    • Reads the Windows organization settings

      • msiexec.exe (PID: 2732)
      • msiexec.exe (PID: 2300)

    • Drops a file with a compile date too recent

      • msiexec.exe (PID: 2732)
      • msiexec.exe (PID: 2300)

    • Executed as Windows Service

      • vssvc.exe (PID: 3336)

    • Reads Environment values

      • vssvc.exe (PID: 3336)

    • Creates files in the user directory

      • msiexec.exe (PID: 2300)
      • filezilla.exe (PID: 1692)

    • Creates files in the Windows directory

      • msiexec.exe (PID: 2300)

    • Creates a directory in Program Files

      • msiexec.exe (PID: 2300)

  • INFO

    • Checks supported languages

      • msiexec.exe (PID: 2732)
      • vssvc.exe (PID: 3336)

    • Reads the computer name

      • msiexec.exe (PID: 2732)
      • vssvc.exe (PID: 3336)

    • Application launched itself

      • msiexec.exe (PID: 2300)

    • Loads dropped or rewritten executable

      • MsiExec.exe (PID: 2664)
      • MsiExec.exe (PID: 2692)
      • MsiExec.exe (PID: 3476)
      • msiexec.exe (PID: 2300)

    • Creates files in the program directory

      • msiexec.exe (PID: 2300)
      • MsiExec.exe (PID: 3476)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 2300)

    • Searches for installed software

      • msiexec.exe (PID: 2300)

    • Reads settings of System Certificates

      • filezilla.exe (PID: 1692)

    • Manual execution by user

      • filezilla.exe (PID: 1692)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
8
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe msiexec.exe msiexec.exe msiexec.exe no specs vssvc.exe no specs msiexec.exe no specs msiexec.exe no specs filezilla.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1692"C:\Program Files\FileZilla FTP Client\filezilla.exe" C:\Program Files\FileZilla FTP Client\filezilla.exe—Explorer.EXE
User:
admin
Company:
FileZilla Project
Integrity Level:
MEDIUM
Description:
FileZilla FTP Client
Exit code:
0
Version:
3, 51, 0, 0
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\filezilla ftp client\filezilla.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\filezilla ftp client\libfzclient-private-3-51-0.dll
c:\program files\filezilla ftp client\libfilezilla-10.dll
c:\program files\filezilla ftp client\libgnutls-30.dll
c:\windows\system32\msvcrt.dll
c:\program files\filezilla ftp client\libgmp-10.dll
c:\windows\system32\user32.dll
2300C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\msiexec.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2664C:\Windows\system32\MsiExec.exe -Embedding A45F8C4EDCC98EC0B27DE1F1FCA52705 CC:\Windows\system32\MsiExec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\usp10.dll
2684"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\babel 4.0 BY OWL.rar"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
2692C:\Windows\system32\MsiExec.exe -Embedding 0EA4C7F4C0C238D09F3CDEC4F50F2986C:\Windows\system32\MsiExec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2732"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\Rar$EXb2684.31592\babel_x86_4.0.0.0.msi" C:\Windows\System32\msiexec.exe
WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3336C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3476C:\Windows\system32\MsiExec.exe -Embedding 49C124C67143273F5E55ADCED9B1E9B6 E Global\MSI0000C:\Windows\system32\MsiExec.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
7 172
Read events
6 878
Write events
282
Delete events
12

Modification events

(PID) Process:(2684) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2684) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2684) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2684) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2684) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2684) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\babel 4.0 BY OWL.rar
(PID) Process:(2684) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2684) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2684) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2684) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
15
Suspicious files
7
Text files
11
Unknown types
4

Dropped files

PID
Process
Filename
Type
2300msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
2300msiexec.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:—
SHA256:—
2300msiexec.exeC:\System Volume Information\SPP\OnlineMetadataCache\{a244dd3d-07a2-40ba-b864-217996d3f009}_OnDiskSnapshotPropbinary
MD5:—
SHA256:—
2300msiexec.exeC:\Users\admin\AppData\Local\Temp\~DF8F3BFEAE569098D5.TMPgmc
MD5:—
SHA256:—
2692MsiExec.exeC:\Users\admin\AppData\Local\Temp\CFGE428.tmpxml
MD5:17AF548F88A3199AA8A63A72201F470F
SHA256:A558DBE555749CD3BDD62060FDBBA72720C4F4A186D5870B977ED2ACF9721D9E
2732msiexec.exeC:\Users\admin\AppData\Local\Temp\MSIBE61.tmpexecutable
MD5:DEF1669123BC5BD8E9A3A93E7F68B58C
SHA256:82BBA027D920FAC29385C1A6752F2337A3AE4B1944A29A72D2864017ABEAA8D9
2664MsiExec.exeC:\Users\admin\AppData\Local\Temp\CFGBE50.tmpxml
MD5:17AF548F88A3199AA8A63A72201F470F
SHA256:A558DBE555749CD3BDD62060FDBBA72720C4F4A186D5870B977ED2ACF9721D9E
2300msiexec.exeC:\Windows\Installer\10e0cd.msiexecutable
MD5:31C4DF7E1828B1DDD9E4844974932C50
SHA256:3C2A5970A483C50E58BF5FB669C6415A48D3782A5B2B996982ED9A823672CCEC
2300msiexec.exeC:\Windows\Installer\MSIE3CA.tmpexecutable
MD5:DEF1669123BC5BD8E9A3A93E7F68B58C
SHA256:82BBA027D920FAC29385C1A6752F2337A3AE4B1944A29A72D2864017ABEAA8D9
2300msiexec.exeC:\Windows\Installer\10e0ce.ipibinary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
babel 4.0 BY OWL.rar