File name:

0FF1C3 2022 - by Diekrolo.rar

Full analysis: https://app.any.run/tasks/b6cf150d-6c4b-4ede-b7ff-f2861433614e
Verdict: Malicious activity
Analysis date: March 22, 2024, 15:31:25
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

4C8A417BBAD244C232332F496DF87AC3

SHA1:

E244B243D71517B1040C7A38FB3528005233F8C7

SHA256:

1A9E29A335B77226168D360AEBA6CDDF7624A6E3D5E57F191113D3BE3DE2F7E4

SSDEEP:

196608:YbFJuGasTuE2o38nuRodHzUFehlJ+VLclTgJ2dMFzPENPp9TRyOmxO2736fAljy:YbvuGasBVhodHze2wVLclTXd8jexLP/r

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • OInstall.exe (PID: 2832)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 1836)
      • OInstall.exe (PID: 2832)

    • Executable content was dropped or overwritten

      • OInstall.exe (PID: 2832)

    • Uses REG/REGEDIT.EXE to modify registry

      • OInstall.exe (PID: 2832)

    • Probably download files using WebClient

      • OInstall.exe (PID: 2832)

    • Starts POWERSHELL.EXE for commands execution

      • OInstall.exe (PID: 2832)

    • Reads the Internet Settings

      • powershell.exe (PID: 2576)
      • powershell.exe (PID: 764)

    • Unusual connection from system programs

      • powershell.exe (PID: 2576)
      • powershell.exe (PID: 764)

    • The Powershell connects to the Internet

      • powershell.exe (PID: 2576)
      • powershell.exe (PID: 764)

  • INFO

    • Manual execution by a user

      • OInstall.exe (PID: 796)
      • OInstall.exe (PID: 2832)

    • Checks supported languages

      • OInstall.exe (PID: 2832)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 1836)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1836)

    • Reads Environment values

      • OInstall.exe (PID: 2832)

    • Reads the computer name

      • OInstall.exe (PID: 2832)

    • Create files in a temporary directory

      • expand.exe (PID: 3496)

    • Creates files in the program directory

      • OInstall.exe (PID: 2832)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
52
Monitored processes
8
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details

Process information

PID
CMD
Path
Indicators
Parent process
764"powershell" -command "& { (New-Object Net.WebClient).DownloadFile('http://officecdn.microsoft.com/pr/5030841d-c919-4594-8d2d-84ae4f96e58e/Office/Data/16.0.14332.20651/i320.cab', 'C:\Users\admin\AppData\Local\Temp\over656502\i320.cab') }"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
OInstall.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
796"C:\Users\admin\Desktop\0FF1C3 2021 - by Diekrolo\M1CR0S0F7 0FF1C3 2021 (LICENCIA PERPETUA) -S.M\OInstall.exe" C:\Users\admin\Desktop\0FF1C3 2021 - by Diekrolo\M1CR0S0F7 0FF1C3 2021 (LICENCIA PERPETUA) -S.M\OInstall.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Office 2013-2021 C2R Install
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\0ff1c3 2021 - by diekrolo\m1cr0s0f7 0ff1c3 2021 (licencia perpetua) -s.m\oinstall.exe
c:\windows\system32\ntdll.dll
1556"C:\Windows\System32\reg.exe" add HKLM\Software\Policies\Microsoft\Office\16.0\Common\OfficeUpdate /v UpdateBranch /d PerpetualVL2021 /fC:\Windows\System32\reg.exe—OInstall.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1836"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\0FF1C3 2022 - by Diekrolo.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2172"powershell" -command "& { Get-Content C:\Users\admin\AppData\Local\Temp\over656502\VersionDescriptor.xml | Set-Content -Encoding ASCII v32.txt }C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—OInstall.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2576"powershell" -command "& { (New-Object Net.WebClient).DownloadFile('http://officecdn.microsoft.com/pr/5030841d-c919-4594-8d2d-84ae4f96e58e/Office/Data/v32.cab', 'C:\Users\admin\AppData\Local\Temp\over656502\v32.cab') }"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
OInstall.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2832"C:\Users\admin\Desktop\0FF1C3 2021 - by Diekrolo\M1CR0S0F7 0FF1C3 2021 (LICENCIA PERPETUA) -S.M\OInstall.exe" C:\Users\admin\Desktop\0FF1C3 2021 - by Diekrolo\M1CR0S0F7 0FF1C3 2021 (LICENCIA PERPETUA) -S.M\OInstall.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
Office 2013-2021 C2R Install
Exit code:
0
Modules
Images
c:\users\admin\desktop\0ff1c3 2021 - by diekrolo\m1cr0s0f7 0ff1c3 2021 (licencia perpetua) -s.m\oinstall.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
3496"expand" v32.cab -F:VersionDescriptor.xml C:\Users\admin\AppData\Local\Temp\over656502C:\Windows\System32\expand.exe—OInstall.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
LZ Expansion Utility
Exit code:
0
Version:
6.1.7601.24535 (win7sp1_ldr_escrow.191105-1059)
Modules
Images
c:\windows\system32\expand.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\cabinet.dll
Total events
10 852
Read events
10 837
Write events
15
Delete events
0

Modification events

(PID) Process:(1836) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1836) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1836) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1836) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(1836) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(1836) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(1836) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\0FF1C3 2022 - by Diekrolo.rar
(PID) Process:(1836) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1836) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1836) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
6
Suspicious files
7
Text files
7
Unknown types
2

Dropped files

PID
Process
Filename
Type
1836WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1836.48644\0FF1C3 2021 - by Diekrolo\M1CR0S0F7 0FF1C3 2021 (LICENCIA PERPETUA) -S.M\autorun.infbinary
MD5:EAD673A9A0A0A2C61FCFD638E5F7504B
SHA256:552BE66ED2C0B22D4A413CA262C95E356292813F9F44D1F719D0EB8A70997E6D
1836WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1836.48644\0FF1C3 2021 - by Diekrolo\M1CR0S0F7 0FF1C3 2021 (LICENCIA PERPETUA) -S.M\files\Configure.xmltext
MD5:B474E3044557BCC7234CCECCC11CC583
SHA256:830443E7A9664F6E3C4CEE8537DCAF6119300DF6DAE475C6AC28107267518AE9
1836WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1836.48644\0FF1C3 2021 - by Diekrolo\M1CR0S0F7 0FF1C3 2021 (LICENCIA PERPETUA) -S.M\files\x86\cleanospp.exeexecutable
MD5:5FD363D52D04AC200CD24F3BCC903200
SHA256:3FDEFE2AD092A9A7FE0EDF0AC4DC2DE7E5B9CE6A0804F6511C06564194966CF9
1836WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1836.48644\0FF1C3 2021 - by Diekrolo\M1CR0S0F7 0FF1C3 2021 (LICENCIA PERPETUA) -S.M\files\x64\msvcr100.dllexecutable
MD5:DF3CA8D16BDED6A54977B30E66864D33
SHA256:1D1A1AE540BA132F998D60D3622F0297B6E86AE399332C3B47462D7C0F560A36
1836WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1836.48644\0FF1C3 2021 - by Diekrolo\M1CR0S0F7 0FF1C3 2021 (LICENCIA PERPETUA) -S.M\files\Uninstall.xmltext
MD5:364F86F97324EA82FE0D142CD01CF6DD
SHA256:09D5B42140BAB13165BA97FBD0E77792304C3C93555BE02C3DCE21A7A69C66DD
1836WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1836.48644\0FF1C3 2021 - by Diekrolo\M1CR0S0F7 0FF1C3 2021 (LICENCIA PERPETUA) -S.M\files\x64\cleanospp.exeexecutable
MD5:162AB955CB2F002A73C1530AA796477F
SHA256:5CE462E5F34065FC878362BA58617FAB28C22D631B9D836DDDCF43FB1AD4DE6E
1836WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1836.48644\0FF1C3 2021 - by Diekrolo\M1CR0S0F7 0FF1C3 2021 (LICENCIA PERPETUA) -S.M\files\x86\msvcr100.dllexecutable
MD5:BF38660A9125935658CFA3E53FDC7D65
SHA256:60C06E0FA4449314DA3A0A87C1A9D9577DF99226F943637E06F61188E5862EFA
3496expand.exeC:\Users\admin\AppData\Local\Temp\over656502\VersionDescriptor.xmlxml
MD5:F5555F5AA75FC1CA091C8EB4811BB415
SHA256:F4D9B60880A0BF4CEFA7BB881C14E5EA58A433AFAEBFBE518F19C220561174A2
2576powershell.exeC:\Users\admin\AppData\Local\Temp\over656502\v32.cabcompressed
MD5:F4286D28990BE875812DCA145C35F491
SHA256:106ACA26AD12A02DB59730E5F501FE427520FB46945F2634D3E4E9D6BB218565
2576powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivedbf
MD5:446DD1CF97EABA21CF14D03AEBC79F27
SHA256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
6
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2576
powershell.exe
GET
200
72.247.154.195:80
http://officecdn.microsoft.com/pr/5030841d-c919-4594-8d2d-84ae4f96e58e/Office/Data/v32.cab
DE
compressed
10.9 Kb
unknown
764
powershell.exe
GET
—
72.247.154.195:80
http://officecdn.microsoft.com/pr/5030841d-c919-4594-8d2d-84ae4f96e58e/Office/Data/16.0.14332.20651/i320.cab
DE
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
unknown
—
—
224.0.0.252:5355
—
—
—
unknown
2576
powershell.exe
72.247.154.195:80
officecdn.microsoft.com
Akamai International B.V.
DE
unknown
764
powershell.exe
72.247.154.195:80
officecdn.microsoft.com
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
officecdn.microsoft.com
  • 72.247.154.195
  • 72.247.154.139
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
0FF1C3 2022 - by Diekrolo.rar