File name:

0FF1C3 2022 - by Diekrolo.rar

Full analysis: https://app.any.run/tasks/b6cf150d-6c4b-4ede-b7ff-f2861433614e
Verdict: Malicious activity
Analysis date: March 22, 2024, 15:31:25
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

4C8A417BBAD244C232332F496DF87AC3

SHA1:

E244B243D71517B1040C7A38FB3528005233F8C7

SHA256:

1A9E29A335B77226168D360AEBA6CDDF7624A6E3D5E57F191113D3BE3DE2F7E4

SSDEEP:

196608:YbFJuGasTuE2o38nuRodHzUFehlJ+VLclTgJ2dMFzPENPp9TRyOmxO2736fAljy:YbvuGasBVhodHze2wVLclTXd8jexLP/r

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • OInstall.exe (PID: 2832)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 1836)
      • OInstall.exe (PID: 2832)

    • Executable content was dropped or overwritten

      • OInstall.exe (PID: 2832)

    • Uses REG/REGEDIT.EXE to modify registry

      • OInstall.exe (PID: 2832)

    • Starts POWERSHELL.EXE for commands execution

      • OInstall.exe (PID: 2832)

    • Probably download files using WebClient

      • OInstall.exe (PID: 2832)

    • Reads the Internet Settings

      • powershell.exe (PID: 2576)
      • powershell.exe (PID: 764)

    • Unusual connection from system programs

      • powershell.exe (PID: 2576)
      • powershell.exe (PID: 764)

    • The Powershell connects to the Internet

      • powershell.exe (PID: 2576)
      • powershell.exe (PID: 764)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1836)

    • Manual execution by a user

      • OInstall.exe (PID: 796)
      • OInstall.exe (PID: 2832)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 1836)

    • Checks supported languages

      • OInstall.exe (PID: 2832)

    • Reads Environment values

      • OInstall.exe (PID: 2832)

    • Reads the computer name

      • OInstall.exe (PID: 2832)

    • Create files in a temporary directory

      • expand.exe (PID: 3496)

    • Creates files in the program directory

      • OInstall.exe (PID: 2832)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
52
Monitored processes
8
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe oinstall.exe no specs oinstall.exe reg.exe no specs powershell.exe expand.exe no specs powershell.exe no specs powershell.exe

Process information

PID
CMD
Path
Indicators
Parent process
764"powershell" -command "& { (New-Object Net.WebClient).DownloadFile('http://officecdn.microsoft.com/pr/5030841d-c919-4594-8d2d-84ae4f96e58e/Office/Data/16.0.14332.20651/i320.cab', 'C:\Users\admin\AppData\Local\Temp\over656502\i320.cab') }"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
OInstall.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
796"C:\Users\admin\Desktop\0FF1C3 2021 - by Diekrolo\M1CR0S0F7 0FF1C3 2021 (LICENCIA PERPETUA) -S.M\OInstall.exe" C:\Users\admin\Desktop\0FF1C3 2021 - by Diekrolo\M1CR0S0F7 0FF1C3 2021 (LICENCIA PERPETUA) -S.M\OInstall.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Office 2013-2021 C2R Install
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\0ff1c3 2021 - by diekrolo\m1cr0s0f7 0ff1c3 2021 (licencia perpetua) -s.m\oinstall.exe
c:\windows\system32\ntdll.dll
1556"C:\Windows\System32\reg.exe" add HKLM\Software\Policies\Microsoft\Office\16.0\Common\OfficeUpdate /v UpdateBranch /d PerpetualVL2021 /fC:\Windows\System32\reg.exe—OInstall.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1836"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\0FF1C3 2022 - by Diekrolo.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2172"powershell" -command "& { Get-Content C:\Users\admin\AppData\Local\Temp\over656502\VersionDescriptor.xml | Set-Content -Encoding ASCII v32.txt }C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—OInstall.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2576"powershell" -command "& { (New-Object Net.WebClient).DownloadFile('http://officecdn.microsoft.com/pr/5030841d-c919-4594-8d2d-84ae4f96e58e/Office/Data/v32.cab', 'C:\Users\admin\AppData\Local\Temp\over656502\v32.cab') }"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
OInstall.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2832"C:\Users\admin\Desktop\0FF1C3 2021 - by Diekrolo\M1CR0S0F7 0FF1C3 2021 (LICENCIA PERPETUA) -S.M\OInstall.exe" C:\Users\admin\Desktop\0FF1C3 2021 - by Diekrolo\M1CR0S0F7 0FF1C3 2021 (LICENCIA PERPETUA) -S.M\OInstall.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
Office 2013-2021 C2R Install
Exit code:
0
Modules
Images
c:\users\admin\desktop\0ff1c3 2021 - by diekrolo\m1cr0s0f7 0ff1c3 2021 (licencia perpetua) -s.m\oinstall.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
3496"expand" v32.cab -F:VersionDescriptor.xml C:\Users\admin\AppData\Local\Temp\over656502C:\Windows\System32\expand.exe—OInstall.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
LZ Expansion Utility
Exit code:
0
Version:
6.1.7601.24535 (win7sp1_ldr_escrow.191105-1059)
Modules
Images
c:\windows\system32\expand.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\cabinet.dll
Total events
10 852
Read events
10 837
Write events
15
Delete events
0

Modification events

(PID) Process:(1836) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1836) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1836) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1836) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(1836) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(1836) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(1836) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\0FF1C3 2022 - by Diekrolo.rar
(PID) Process:(1836) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1836) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1836) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
6
Suspicious files
7
Text files
7
Unknown types
2

Dropped files

PID
Process
Filename
Type
1836WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1836.48644\0FF1C3 2021 - by Diekrolo\M1CR0S0F7 0FF1C3 2021 (LICENCIA PERPETUA) -S.M\autorun.infbinary
MD5:EAD673A9A0A0A2C61FCFD638E5F7504B
SHA256:552BE66ED2C0B22D4A413CA262C95E356292813F9F44D1F719D0EB8A70997E6D
1836WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1836.48644\0FF1C3 2021 - by Diekrolo\M1CR0S0F7 0FF1C3 2021 (LICENCIA PERPETUA) -S.M\files\x64\cleanospp.exeexecutable
MD5:162AB955CB2F002A73C1530AA796477F
SHA256:5CE462E5F34065FC878362BA58617FAB28C22D631B9D836DDDCF43FB1AD4DE6E
1836WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1836.48644\0FF1C3 2021 - by Diekrolo\M1CR0S0F7 0FF1C3 2021 (LICENCIA PERPETUA) -S.M\files\x64\msvcr100.dllexecutable
MD5:DF3CA8D16BDED6A54977B30E66864D33
SHA256:1D1A1AE540BA132F998D60D3622F0297B6E86AE399332C3B47462D7C0F560A36
1836WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1836.48644\0FF1C3 2021 - by Diekrolo\M1CR0S0F7 0FF1C3 2021 (LICENCIA PERPETUA) -S.M\files\Configure.xmltext
MD5:B474E3044557BCC7234CCECCC11CC583
SHA256:830443E7A9664F6E3C4CEE8537DCAF6119300DF6DAE475C6AC28107267518AE9
1836WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1836.48644\0FF1C3 2021 - by Diekrolo\M1CR0S0F7 0FF1C3 2021 (LICENCIA PERPETUA) -S.M\files\Uninstall.xmltext
MD5:364F86F97324EA82FE0D142CD01CF6DD
SHA256:09D5B42140BAB13165BA97FBD0E77792304C3C93555BE02C3DCE21A7A69C66DD
2832OInstall.exeC:\Users\admin\Desktop\0FF1C3 2021 - by Diekrolo\M1CR0S0F7 0FF1C3 2021 (LICENCIA PERPETUA) -S.M\files\setup.exeexecutable
MD5:072A2EFEA576956E465AFF2492A1C7F4
SHA256:EE3875ABD5D49A1891C8818820F61A1E5D0382DF37B5A5B72E175B2B6C70A9C2
2576powershell.exeC:\Users\admin\AppData\Local\Temp\3wu2klp0.ldm.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
2576powershell.exeC:\Users\admin\AppData\Local\Temp\wpiwc3qg.41y.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
2832OInstall.exeC:\Users\admin\Desktop\0FF1C3 2021 - by Diekrolo\M1CR0S0F7 0FF1C3 2021 (LICENCIA PERPETUA) -S.M\files\Configure.xmltext
MD5:46E1E8D09A83D74AEC992C9401CC9341
SHA256:740CDAFDC7C7859263469982D178E3A02D87077F4EC0B2789A9B22FA0F710886
2576powershell.exeC:\Users\admin\AppData\Local\Temp\over656502\v32.cabcompressed
MD5:F4286D28990BE875812DCA145C35F491
SHA256:106ACA26AD12A02DB59730E5F501FE427520FB46945F2634D3E4E9D6BB218565
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
6
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2576
powershell.exe
GET
200
72.247.154.195:80
http://officecdn.microsoft.com/pr/5030841d-c919-4594-8d2d-84ae4f96e58e/Office/Data/v32.cab
unknown
compressed
10.9 Kb
—
764
powershell.exe
GET
—
72.247.154.195:80
http://officecdn.microsoft.com/pr/5030841d-c919-4594-8d2d-84ae4f96e58e/Office/Data/16.0.14332.20651/i320.cab
unknown
—
—
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
unknown
—
—
224.0.0.252:5355
—
—
—
unknown
2576
powershell.exe
72.247.154.195:80
officecdn.microsoft.com
Akamai International B.V.
DE
unknown
764
powershell.exe
72.247.154.195:80
officecdn.microsoft.com
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
officecdn.microsoft.com
  • 72.247.154.195
  • 72.247.154.139
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
0FF1C3 2022 - by Diekrolo.rar