File name:

0FF1C3 2022 - by Diekrolo.rar

Full analysis: https://app.any.run/tasks/b6cf150d-6c4b-4ede-b7ff-f2861433614e
Verdict: Malicious activity
Analysis date: March 22, 2024, 15:31:25
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

4C8A417BBAD244C232332F496DF87AC3

SHA1:

E244B243D71517B1040C7A38FB3528005233F8C7

SHA256:

1A9E29A335B77226168D360AEBA6CDDF7624A6E3D5E57F191113D3BE3DE2F7E4

SSDEEP:

196608:YbFJuGasTuE2o38nuRodHzUFehlJ+VLclTgJ2dMFzPENPp9TRyOmxO2736fAljy:YbvuGasBVhodHze2wVLclTXd8jexLP/r

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • OInstall.exe (PID: 2832)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 1836)
      • OInstall.exe (PID: 2832)

    • Executable content was dropped or overwritten

      • OInstall.exe (PID: 2832)

    • Unusual connection from system programs

      • powershell.exe (PID: 2576)
      • powershell.exe (PID: 764)

    • Probably download files using WebClient

      • OInstall.exe (PID: 2832)

    • Reads the Internet Settings

      • powershell.exe (PID: 2576)
      • powershell.exe (PID: 764)

    • Uses REG/REGEDIT.EXE to modify registry

      • OInstall.exe (PID: 2832)

    • The Powershell connects to the Internet

      • powershell.exe (PID: 2576)
      • powershell.exe (PID: 764)

    • Starts POWERSHELL.EXE for commands execution

      • OInstall.exe (PID: 2832)

  • INFO

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 1836)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1836)

    • Manual execution by a user

      • OInstall.exe (PID: 2832)
      • OInstall.exe (PID: 796)

    • Reads the computer name

      • OInstall.exe (PID: 2832)

    • Reads Environment values

      • OInstall.exe (PID: 2832)

    • Checks supported languages

      • OInstall.exe (PID: 2832)

    • Create files in a temporary directory

      • expand.exe (PID: 3496)

    • Creates files in the program directory

      • OInstall.exe (PID: 2832)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
52
Monitored processes
8
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe oinstall.exe no specs oinstall.exe reg.exe no specs powershell.exe expand.exe no specs powershell.exe no specs powershell.exe

Process information

PID
CMD
Path
Indicators
Parent process
764"powershell" -command "& { (New-Object Net.WebClient).DownloadFile('http://officecdn.microsoft.com/pr/5030841d-c919-4594-8d2d-84ae4f96e58e/Office/Data/16.0.14332.20651/i320.cab', 'C:\Users\admin\AppData\Local\Temp\over656502\i320.cab') }"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
OInstall.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
796"C:\Users\admin\Desktop\0FF1C3 2021 - by Diekrolo\M1CR0S0F7 0FF1C3 2021 (LICENCIA PERPETUA) -S.M\OInstall.exe" C:\Users\admin\Desktop\0FF1C3 2021 - by Diekrolo\M1CR0S0F7 0FF1C3 2021 (LICENCIA PERPETUA) -S.M\OInstall.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Office 2013-2021 C2R Install
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\0ff1c3 2021 - by diekrolo\m1cr0s0f7 0ff1c3 2021 (licencia perpetua) -s.m\oinstall.exe
c:\windows\system32\ntdll.dll
1556"C:\Windows\System32\reg.exe" add HKLM\Software\Policies\Microsoft\Office\16.0\Common\OfficeUpdate /v UpdateBranch /d PerpetualVL2021 /fC:\Windows\System32\reg.exe—OInstall.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1836"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\0FF1C3 2022 - by Diekrolo.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2172"powershell" -command "& { Get-Content C:\Users\admin\AppData\Local\Temp\over656502\VersionDescriptor.xml | Set-Content -Encoding ASCII v32.txt }C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—OInstall.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2576"powershell" -command "& { (New-Object Net.WebClient).DownloadFile('http://officecdn.microsoft.com/pr/5030841d-c919-4594-8d2d-84ae4f96e58e/Office/Data/v32.cab', 'C:\Users\admin\AppData\Local\Temp\over656502\v32.cab') }"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
OInstall.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2832"C:\Users\admin\Desktop\0FF1C3 2021 - by Diekrolo\M1CR0S0F7 0FF1C3 2021 (LICENCIA PERPETUA) -S.M\OInstall.exe" C:\Users\admin\Desktop\0FF1C3 2021 - by Diekrolo\M1CR0S0F7 0FF1C3 2021 (LICENCIA PERPETUA) -S.M\OInstall.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
Office 2013-2021 C2R Install
Exit code:
0
Modules
Images
c:\users\admin\desktop\0ff1c3 2021 - by diekrolo\m1cr0s0f7 0ff1c3 2021 (licencia perpetua) -s.m\oinstall.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
3496"expand" v32.cab -F:VersionDescriptor.xml C:\Users\admin\AppData\Local\Temp\over656502C:\Windows\System32\expand.exe—OInstall.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
LZ Expansion Utility
Exit code:
0
Version:
6.1.7601.24535 (win7sp1_ldr_escrow.191105-1059)
Modules
Images
c:\windows\system32\expand.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\cabinet.dll
Total events
10 852
Read events
10 837
Write events
15
Delete events
0

Modification events

(PID) Process:(1836) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1836) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1836) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1836) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(1836) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(1836) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(1836) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\0FF1C3 2022 - by Diekrolo.rar
(PID) Process:(1836) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1836) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1836) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
6
Suspicious files
7
Text files
7
Unknown types
2

Dropped files

PID
Process
Filename
Type
1836WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1836.48644\0FF1C3 2021 - by Diekrolo\M1CR0S0F7 0FF1C3 2021 (LICENCIA PERPETUA) -S.M\files\x64\msvcr100.dllexecutable
MD5:DF3CA8D16BDED6A54977B30E66864D33
SHA256:1D1A1AE540BA132F998D60D3622F0297B6E86AE399332C3B47462D7C0F560A36
1836WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1836.48644\0FF1C3 2021 - by Diekrolo\M1CR0S0F7 0FF1C3 2021 (LICENCIA PERPETUA) -S.M\files\x86\cleanospp.exeexecutable
MD5:5FD363D52D04AC200CD24F3BCC903200
SHA256:3FDEFE2AD092A9A7FE0EDF0AC4DC2DE7E5B9CE6A0804F6511C06564194966CF9
1836WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1836.48644\0FF1C3 2021 - by Diekrolo\M1CR0S0F7 0FF1C3 2021 (LICENCIA PERPETUA) -S.M\files\x64\cleanospp.exeexecutable
MD5:162AB955CB2F002A73C1530AA796477F
SHA256:5CE462E5F34065FC878362BA58617FAB28C22D631B9D836DDDCF43FB1AD4DE6E
1836WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1836.48644\0FF1C3 2021 - by Diekrolo\M1CR0S0F7 0FF1C3 2021 (LICENCIA PERPETUA) -S.M\files\Configure.xmltext
MD5:B474E3044557BCC7234CCECCC11CC583
SHA256:830443E7A9664F6E3C4CEE8537DCAF6119300DF6DAE475C6AC28107267518AE9
1836WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1836.48644\0FF1C3 2021 - by Diekrolo\M1CR0S0F7 0FF1C3 2021 (LICENCIA PERPETUA) -S.M\OInstall.exeexecutable
MD5:EBC58647462AD9C76395EF451064D115
SHA256:414155BF11893EC64BA0F4FFB7DE92885090845A0761CF8F6743462AA5991D5E
2832OInstall.exeC:\Users\admin\Desktop\0FF1C3 2021 - by Diekrolo\M1CR0S0F7 0FF1C3 2021 (LICENCIA PERPETUA) -S.M\files\setup.exeexecutable
MD5:072A2EFEA576956E465AFF2492A1C7F4
SHA256:EE3875ABD5D49A1891C8818820F61A1E5D0382DF37B5A5B72E175B2B6C70A9C2
2172powershell.exeC:\Users\admin\AppData\Local\Temp\a1iks2ke.kqy.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
2576powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivedbf
MD5:446DD1CF97EABA21CF14D03AEBC79F27
SHA256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
2576powershell.exeC:\Users\admin\AppData\Local\Temp\3wu2klp0.ldm.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
2832OInstall.exeC:\Users\admin\Desktop\0FF1C3 2021 - by Diekrolo\M1CR0S0F7 0FF1C3 2021 (LICENCIA PERPETUA) -S.M\files\Configure.xmltext
MD5:46E1E8D09A83D74AEC992C9401CC9341
SHA256:740CDAFDC7C7859263469982D178E3A02D87077F4EC0B2789A9B22FA0F710886
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
6
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
764
powershell.exe
GET
—
72.247.154.195:80
http://officecdn.microsoft.com/pr/5030841d-c919-4594-8d2d-84ae4f96e58e/Office/Data/16.0.14332.20651/i320.cab
unknown
—
—
unknown
2576
powershell.exe
GET
200
72.247.154.195:80
http://officecdn.microsoft.com/pr/5030841d-c919-4594-8d2d-84ae4f96e58e/Office/Data/v32.cab
unknown
compressed
10.9 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
unknown
—
—
224.0.0.252:5355
—
—
—
unknown
2576
powershell.exe
72.247.154.195:80
officecdn.microsoft.com
Akamai International B.V.
DE
unknown
764
powershell.exe
72.247.154.195:80
officecdn.microsoft.com
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
officecdn.microsoft.com
  • 72.247.154.195
  • 72.247.154.139
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
0FF1C3 2022 - by Diekrolo.rar