analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

http://cran.rstudio.com/bin/windows/contrib/3.1/ggplot2_2.1.0.zip

Full analysis: https://app.any.run/tasks/ced9fc78-d00f-41fa-90c7-ed192a71901d
Verdict: Malicious activity
Analysis date: September 18, 2019, 20:39:05
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

13960647AD3C2D9C1C7DC33DBECC24CD

SHA1:

A9D5EA7EC900410D268EF75D8A801BAD367F2640

SHA256:

2485D2B66FB207D86123045DFC2F28A4FC398311885089A65F1ECC835B00D39C

SSDEEP:

3:N1KdXMdACLBKTKNdWpjDVn:CedAIBKTeWTn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Application launched itself

      • WinRAR.exe (PID: 3036)

    • Uses RUNDLL32.EXE to load library

      • WinRAR.exe (PID: 3036)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 3448)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3448)

    • Changes internet zones settings

      • iexplore.exe (PID: 3448)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3448)
      • iexplore.exe (PID: 4080)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
48
Monitored processes
17
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe winrar.exe no specs rundll32.exe no specs notepad.exe no specs rundll32.exe no specs notepad.exe no specs winrar.exe no specs rundll32.exe no specs rundll32.exe no specs notepad.exe no specs rundll32.exe no specs notepad.exe no specs rundll32.exe no specs notepad.exe no specs rundll32.exe no specs notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3448"C:\Program Files\Internet Explorer\iexplore.exe" "http://cran.rstudio.com/bin/windows/contrib/3.1/ggplot2_2.1.0.zip"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
4080"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3448 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3036"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\KTFML36Z\ggplot2_2.1.0[1].zip"C:\Program Files\WinRAR\WinRAR.exe—iexplore.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3812"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\Rar$DIa3036.18431\DESCRIPTIONC:\Windows\system32\rundll32.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2256"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\Temp\Rar$DIa3036.18431\DESCRIPTIONC:\Windows\system32\NOTEPAD.EXE—rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3380"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\Rar$DIa3036.21350\ggplot2C:\Windows\system32\rundll32.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
304"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\Temp\Rar$DIa3036.21350\ggplot2C:\Windows\system32\NOTEPAD.EXE—rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2076"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\Rar$DIa3036.22570\ggplot2.rdxC:\Program Files\WinRAR\WinRAR.exe—WinRAR.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
2592"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\Rar$DIa3036.24230\README.mdC:\Windows\system32\rundll32.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1968"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\Rar$DIa3036.24941\NAMESPACEC:\Windows\system32\rundll32.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
4 416
Read events
3 968
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
3
Text files
13
Unknown types
4

Dropped files

PID
Process
Filename
Type
3448iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFFFD287A34600E537.TMP —
MD5:—
SHA256:—
3448iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\favicon[1].ico —
MD5:—
SHA256:—
3448iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
3448iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF0C84AC8AE049638F.TMP —
MD5:—
SHA256:—
3448iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{642364E3-DA54-11E9-B86F-5254004A04AF}.dat —
MD5:—
SHA256:—
3448iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012019091820190919\index.datdat
MD5:D5FF0844E6974880466DE77FE85B87D4
SHA256:89EA84DF040D4C174E898E61793E0C5E1257E5A3A8A281F677191D918FB2038F
4080iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.datdat
MD5:095C90DD029EB73010987AE027F21466
SHA256:19A18FA60C6DCA49ABDE70D6C08F546C301ED682333EB0AD15381E15D039DD0E
4080iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\KTFML36Z\ggplot2_2.1.0[1].zipcompressed
MD5:63452237B350CCAC9DE041B420344CD6
SHA256:FDA7EA075FBDBDF2E63BF8D60A49A6CBFCA8796724B4C388C5AB85802C15A7C5
3036WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa3036.18431\DESCRIPTIONtext
MD5:A4319DF17B7D5FA9918112A049408E96
SHA256:32054CA82B344AA86E821AAC4E4BF90628656AC13B745E653CBB912AB64A569A
4080iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\JavaDeployReg.logtext
MD5:CB48A89F0EB30A06EBE9FC4617594F62
SHA256:4C22C5C198749121B59DF51870D5E67D989166F074F6016FAA9502BF398E9041
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
2
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4080
iexplore.exe
GET
200
52.85.183.22:80
http://cran.rstudio.com/bin/windows/contrib/3.1/ggplot2_2.1.0.zip
US
compressed
1.90 Mb
shared
3448
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3448
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
4080
iexplore.exe
52.85.183.22:80
cran.rstudio.com
Amazon.com, Inc.
US
unknown

DNS requests

Domain
IP
Reputation
cran.rstudio.com
  • 52.85.183.22
  • 52.85.183.177
  • 52.85.183.225
  • 52.85.183.66
shared
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
http://cran.rstudio.com/bin/windows/contrib/3.1/ggplot2_2.1.0.zip