analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Debug.rar

Full analysis: https://app.any.run/tasks/00b6361c-11e1-49d8-842e-091385ab06fb
Verdict: Malicious activity
Analysis date: June 16, 2019, 11:04:30
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

210F829FFC9BD5B64908B24F4D1FBEA2

SHA1:

84EF4A6A008B627FA901E50CC2BD482ACCEFF001

SHA256:

1C378134A884D7487D07E6A3B34734B57FE1922573B7FC82D58843A4BC8C2CAC

SSDEEP:

3072:gnYjxwu/bdrWAlFcoYtGz90VY8pHWTTRpa:gY9F/vczox068WfW

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 1256)
      • Batch Virus Maker.exe (PID: 2060)
      • Batch Virus Maker.exe (PID: 1116)
      • explorer.exe (PID: 252)

    • Application was dropped or rewritten from another process

      • Batch Virus Maker.exe (PID: 2060)
      • Batch Virus Maker.exe (PID: 1116)

    • Starts NET.EXE to view/add/change user profiles

      • cmd.exe (PID: 4060)

  • SUSPICIOUS

    • Reads Internet Cache Settings

      • explorer.exe (PID: 252)

    • Creates files in the Windows directory

      • DllHost.exe (PID: 2720)

    • Executed via COM

      • DllHost.exe (PID: 2720)

    • Creates files in the user directory

      • explorer.exe (PID: 252)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2900)

    • Application launched itself

      • Batch Virus Maker.exe (PID: 2060)

    • Starts CMD.EXE for commands execution

      • explorer.exe (PID: 252)

  • INFO

    • Manual execution by user

      • Batch Virus Maker.exe (PID: 2060)
      • cmd.exe (PID: 4060)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
58
Monitored processes
20
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe fontview.exe no specs DllHost.exe no specs searchprotocolhost.exe no specs batch virus maker.exe no specs batch virus maker.exe no specs cmd.exe no specs explorer.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2900"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Debug.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
3480"C:\Windows\System32\fontview.exe" C:\Users\admin\AppData\Local\Temp\Rar$DIa2900.9882\Font.ttfC:\Windows\System32\fontview.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Font Viewer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2720C:\Windows\system32\DllHost.exe /Processid:{642EF9D6-48A5-476B-919A-A507CFD02C0F}C:\Windows\system32\DllHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1256"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe5_ Global\UsGthrCtrlFltPipeMssGthrPipe5 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
2060"C:\Users\admin\Desktop\Batch Virus Maker.exe" C:\Users\admin\Desktop\Batch Virus Maker.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Batch Virus Maker
Exit code:
0
Version:
1.0.0.0
1116"C:\Users\admin\Desktop\Batch Virus Maker.exe" C:\Users\admin\Desktop\Batch Virus Maker.exe—Batch Virus Maker.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Batch Virus Maker
Version:
1.0.0.0
4060cmd /c ""C:\Users\admin\Desktop\System32.bat" "C:\Windows\system32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
252C:\Windows\Explorer.EXEC:\Windows\explorer.exe—ctfmon.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
4024net user 326943054314172 /addC:\Windows\system32\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2276C:\Windows\system32\net1 user 326943054314172 /addC:\Windows\system32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Total events
5 819
Read events
5 675
Write events
0
Delete events
0

Modification events

No data
Executable files
4
Suspicious files
0
Text files
6
Unknown types
6

Dropped files

PID
Process
Filename
Type
1116Batch Virus Maker.exeC:\Users\admin\Desktop\System32.battext
MD5:260438E02B4F4ADA7613D1990B6657CA
SHA256:DEC55D349C78FAE23EF2A49F8AC29E4AF528744465561FFFF0AB5B626111FC71
2900WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2900.11621\Batch Virus Maker.exeexecutable
MD5:BAE426E784ABE42B6B6CFCC92900D802
SHA256:086FD3356323EB1815099006083F4BB46F042F7D2CDC97F2753F4D23BEB93759
252explorer.exeC:\Users\admin\Desktop\Batch Virus Maker.exeexecutable
MD5:BAE426E784ABE42B6B6CFCC92900D802
SHA256:086FD3356323EB1815099006083F4BB46F042F7D2CDC97F2753F4D23BEB93759
2900WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa2900.9882\Font.ttfttf
MD5:9C3F8E8826B7813FAD3FF5BF79F2004E
SHA256:D37903FA7A7C76488186EF2678D394A65B241820C4B30A0E154DD010D8B7150A
252explorer.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012019061620190617\index.datdat
MD5:2DBEDC9BA48C1558EA5ABFF6EF101BFD
SHA256:D8FD57A66957D42484361905C13718312843293F910671F4D76F613CC926EC70
252explorer.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\Debug.rar.lnklnk
MD5:73E4BD91B7D4AAE0AF105E18B882B9E3
SHA256:0C6F17DDE5BD9307305C8C0AB8A086A524BA651FBF7ADAFE7FA4549C0927CBF4
2720DllHost.exeC:\Windows\Fonts\Font.ttfttf
MD5:9C3F8E8826B7813FAD3FF5BF79F2004E
SHA256:D37903FA7A7C76488186EF2678D394A65B241820C4B30A0E154DD010D8B7150A
252explorer.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\1b4dd67f29cb1962.automaticDestinations-msautomaticdestinations-ms
MD5:8DA34FB306873FB4A9CD65C202BAFFEC
SHA256:6354A3BFAB0E2C5C2A2E7FB9678B90BEEFC391AE5CCFB493A3311643974F43FA
252explorer.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\290532160612e071.automaticDestinations-msautomaticdestinations-ms
MD5:8B1F58E49C9DCF6A71C49382C6961389
SHA256:E592909284A1DFCC9DB2ED6B1C1D10A65D0AFF8FAD99AE4067488BD9D2A83E66
4060cmd.exeC:\Users\admin\Desktop\28040.txttext
MD5:5C0F8E357D7EC63D20366C0A01C97F8D
SHA256:F7D5E958185E67CEC391582095E780D9BCB406B5B1204A78D68D4C12EFCFE169
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Debug.rar