File name:

Chipso.rar

Full analysis: https://app.any.run/tasks/f4892f99-ba76-4a15-bad8-b5d23ea7e8d4
Verdict: Malicious activity
Analysis date: October 26, 2019, 20:20:19
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v4, os: Win32
MD5:

E3F51A6AF1913AD76DA67AC43E001F9D

SHA1:

623C59AA7C9CA226318BFFB12552E00CF841ECA7

SHA256:

266A5C6B6FE74301238E977333B5C3D4EB76D016CBA72CE4D8B9EB46A8424F58

SSDEEP:

49152:uYUj67PMxadRwr5vy94+BY04MT5fx2JaUJnDL:uFj2MEd2r5K9n91pEhJf

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 3488)
      • tmp1.jpg (PID: 2356)
      • Chips.exe (PID: 1028)
      • explorer.exe (PID: 352)

    • Application was dropped or rewritten from another process

      • Chipso-crc.exe (PID: 2856)
      • tmp2.exe (PID: 3948)
      • tmp1.jpg (PID: 2356)
      • emv.exe (PID: 2968)
      • Chips.exe (PID: 1028)

    • Changes the autorun value in the registry

      • tmp2.exe (PID: 3948)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1972)
      • Chipso-crc.exe (PID: 2856)
      • tmp2.exe (PID: 3948)

    • Starts application with an unusual extension

      • cmd.exe (PID: 2236)

    • Creates files in the user directory

      • tmp2.exe (PID: 3948)

    • Starts CMD.EXE for commands execution

      • Chipso-crc.exe (PID: 2856)

    • Starts itself from another location

      • tmp2.exe (PID: 3948)

    • Reads default file associations for system extensions

      • explorer.exe (PID: 352)

  • INFO

    • Manual execution by user

      • Chipso-crc.exe (PID: 2856)
      • Chips.exe (PID: 1028)

    • Dropped object may contain Bitcoin addresses

      • Chipso-crc.exe (PID: 2856)
      • tmp2.exe (PID: 3948)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v-4.x) (58.3)
.rar | RAR compressed archive (gen) (41.6)

EXIF

ZIP

CompressedSize: 36569
UncompressedSize: 67584
OperatingSystem: Win32
ModifyDate: 2010:11:20 23:53:26
PackingMethod: Normal
ArchivedFileName: chipso\asycfilt.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
10
Malicious processes
7
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start winrar.exe searchprotocolhost.exe no specs chipso-crc.exe cmd.exe no specs tmp1.jpg no specs cmd.exe no specs tmp2.exe emv.exe no specs chips.exe no specs explorer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
352C:\Windows\Explorer.EXEC:\Windows\explorer.exe——
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\winanr.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
1028"C:\Users\admin\Desktop\chipso\Chips.exe" C:\Users\admin\Desktop\chipso\Chips.exe—explorer.exe
User:
admin
Company:
Personal
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.00
Modules
Images
c:\users\admin\desktop\chipso\chips.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\desktop\chipso\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1972"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Chipso.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2236C:\Windows\system32\cmd.exe /c start %temp%\tmp1.jpgC:\Windows\system32\cmd.exe—Chipso-crc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2356C:\Users\admin\AppData\Local\Temp\tmp1.jpg C:\Users\admin\AppData\Local\Temp\tmp1.jpg—cmd.exe
User:
admin
Company:
HackTheWorld
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.00.0122
Modules
Images
c:\users\admin\appdata\local\temp\tmp1.jpg
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2408C:\Windows\system32\cmd.exe /c start %temp%\tmp2.exeC:\Windows\system32\cmd.exe—Chipso-crc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2856"C:\Users\admin\Desktop\chipso\Chipso-crc.exe" C:\Users\admin\Desktop\chipso\Chipso-crc.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\chipso\chipso-crc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\apphelp.dll
2968"C:\Users\admin\AppData\Local\Drpbx\emv.exe" C:\Users\admin\AppData\Local\Temp\tmp2.exeC:\Users\admin\AppData\Local\Drpbx\emv.exe—tmp2.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Chip Writer
Exit code:
0
Version:
37.0.2.5583
Modules
Images
c:\users\admin\appdata\local\drpbx\emv.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3488"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3948C:\Users\admin\AppData\Local\Temp\tmp2.exe C:\Users\admin\AppData\Local\Temp\tmp2.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Chip Writer
Exit code:
0
Version:
37.0.2.5583
Modules
Images
c:\users\admin\appdata\local\temp\tmp2.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
2 197
Read events
2 115
Write events
82
Delete events
0

Modification events

(PID) Process:(1972) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1972) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1972) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1972) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Chipso.rar
(PID) Process:(1972) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1972) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1972) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1972) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(352) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rar\OpenWithList
Operation:writeName:a
Value:
WinRAR.exe
(PID) Process:(352) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rar\OpenWithList
Operation:writeName:MRUList
Value:
a
Executable files
25
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
1972WinRAR.exeC:\Users\admin\Desktop\chipso\Chipso-crc.exeexecutable
MD5:—
SHA256:—
1972WinRAR.exeC:\Users\admin\Desktop\chipso\comdlg32.ocxexecutable
MD5:D76F0EAB36F83A31D411AEAF70DA7396
SHA256:46F4FDB12C30742FF4607876D2F36CF432CDC7EC3D2C99097011448FC57E997C
1972WinRAR.exeC:\Users\admin\Desktop\chipso\COMCAT.DLLexecutable
MD5:3B180DA2B50B954A55FE37AFBA58D428
SHA256:96D04CDFAF4F4D7B8722B139A15074975D4C244302F78034B7BE65DF1A92FD03
1972WinRAR.exeC:\Users\admin\Desktop\chipso\GPPcScConnectionPlugin.dllexecutable
MD5:2F99E012379E8C950B0BDE761C5CCA0F
SHA256:5D84EC3F8DEE7438B0049D5DC201A68A99F3E471A4C9ACAC48DD7F67F89FD178
1972WinRAR.exeC:\Users\admin\Desktop\chipso\asycfilt.dllexecutable
MD5:088CF5B6380FB9002F2A4246F812225D
SHA256:3E7205FEBC5B2432EE3655CD71D630A5D5EA609995F43053B1B5EB8917C46453
1972WinRAR.exeC:\Users\admin\Desktop\chipso\Chips.exeexecutable
MD5:—
SHA256:—
1972WinRAR.exeC:\Users\admin\Desktop\chipso\grvchp.initext
MD5:—
SHA256:—
2356tmp1.jpgC:\Users\admin\AppData\Local\Temp\~DFF2E71ACA18C6D042.TMP —
MD5:—
SHA256:—
1972WinRAR.exeC:\Users\admin\Desktop\chipso\msvbvm60.dllexecutable
MD5:5343A19C618BC515CEB1695586C6C137
SHA256:2246B4FEAE199408EA66D4A90C1589026F4A5800CE5A28E583B94506A8A73DCE
1972WinRAR.exeC:\Users\admin\Desktop\chipso\stdole2.tlbexecutable
MD5:89F4D0DD6606A2FE15931E6888DBBC8D
SHA256:513D9F6DB0D993DB6D720DF1FF4FED2C6A9B067522CDEE389CA40D3B618B6A55
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Chipso.rar