analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

DoppelVirus.rar

Full analysis: https://app.any.run/tasks/2be5583f-6549-42c8-964b-37cb67dc97ea
Verdict: Malicious activity
Analysis date: December 05, 2022, 20:01:05
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

F8046215A13324EDCD05E8638576749E

SHA1:

A1B1D740116899756922AD50AFC384CCCF8AD176

SHA256:

3124B4A081A85FA01FFDB0037E0BF3D1969228B12DDC9CCC939F59A2D9FE947C

SSDEEP:

393216:wvPlvD+Hz+fZGA5sHsFqg95dKGvQS9GtjAkrYnale:wlqTxsFq89vQYSjAkrYale

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • DoppelVirus.exe (PID: 2020)

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 2588)
      • DoppelVirus.exe (PID: 2020)
      • Explorer.EXE (PID: 1084)

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1636)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 1636)

    • Drops a file that was compiled in debug mode

      • WinRAR.exe (PID: 1636)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
4
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe searchprotocolhost.exe no specs doppelvirus.exe explorer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1636"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\DoppelVirus.rar"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
2588"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\system32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7601.24542 (win7sp1_ldr_escrow.191209-2211)
2020"C:\Users\admin\Desktop\DoppelVirus\DoppelVirus.exe" C:\Users\admin\Desktop\DoppelVirus\DoppelVirus.exe
Explorer.EXE
User:
admin
Integrity Level:
HIGH
Exit code:
3762504530
Version:
1.0.7417.41804
1084C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE——
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
6 549
Read events
6 427
Write events
122
Delete events
0

Modification events

(PID) Process:(1636) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1636) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1636) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1636) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(1636) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(1636) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\DoppelVirus.rar
(PID) Process:(1636) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1636) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1636) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1636) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
4
Suspicious files
0
Text files
5
Unknown types
3

Dropped files

PID
Process
Filename
Type
1084Explorer.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\DoppelVirus.rar.lnklnk
MD5:252B54675D0FBF09DD3B49E0AFD938A8
SHA256:D646AD67C60D0A659013ABB37C1F3D7F861FE85C5D9AD128D7699C3A0F05DF61
1084Explorer.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\290532160612e071.automaticDestinations-msautomaticdestinations-ms
MD5:9DF5C9EE666E9D693923E42696E18C87
SHA256:B34AA9409C4B81162DF1DAFB905B0D70A4439565F8A729EB8BCF5F90A1213015
1084Explorer.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\1b4dd67f29cb1962.automaticDestinations-msautomaticdestinations-ms
MD5:AD52324A92719C4CD9AADB4A6FD15A60
SHA256:A7FAF676E99C5033E7E43C1B1D09EDE85C977D650A36CE7964FC0B93D96DEA73
1636WinRAR.exeC:\Users\admin\Desktop\DoppelVirus\READ ME.txttext
MD5:D8BCDE5CC107BB1487A57749D0CCADCC
SHA256:613184F8FADDC8B941F51D18FD4627451BCDB99A67AEABABA0A3D1D37A5272FF
1636WinRAR.exeC:\Users\admin\Desktop\DoppelVirus\MegaApiClient.dllexecutable
MD5:6A88231451604297D32727C6EF8612C9
SHA256:01E460DABA9F00F4C6B8E97AF0651339BD4E9AC9BD5E3EBFD2B95086DC522080
1636WinRAR.exeC:\Users\admin\Desktop\DoppelVirus\Newtonsoft.Json.dllexecutable
MD5:8F81C9520104B730C25D90A9DD511148
SHA256:F1F01B3474B92D6E1C3D6ADFAE74EE0EA0EBA6E9935565FE2317686D80A2E886
1636WinRAR.exeC:\Users\admin\Desktop\DoppelVirus\DotNetZip.xmlxml
MD5:AFFC560C09C60B437D6ABE245691CDC8
SHA256:A55C1ACD3FE400A5CA2B988D838E3EBFA3C561B7657ADB6D994E27636369E5D1
1636WinRAR.exeC:\Users\admin\Desktop\DoppelVirus\Newtonsoft.Json.xmlxml
MD5:928ED37DB61C1E98A2831C8C01F6157C
SHA256:39F6A4DB1BE658D6BAFF643FA05AAE7809139D9665475BFCA10D37DCA3384F21
1636WinRAR.exeC:\Users\admin\Desktop\DoppelVirus\DoppelVirus.exeexecutable
MD5:D219F7D1189912C96BB536E74D0FEB7C
SHA256:AD96874E8772874D652C21C0B66559D82DC0D9A539C2E298539A929838BB654C
1636WinRAR.exeC:\Users\admin\Desktop\DoppelVirus\MegaApiClient.xmlxml
MD5:D68C609E8FE32DEDBC977F2DB8666803
SHA256:452E3C2C8F461D0D12660DDBCD55413B422309C34DD4DE8C59F6003F43178AA5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
5
DNS requests
8
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2020
DoppelVirus.exe
66.203.125.14:443
g.api.mega.co.nz
Datacenter Luxembourg S.A.
LU
unknown
—
—
66.203.125.15:443
g.api.mega.co.nz
Datacenter Luxembourg S.A.
LU
unknown
2020
DoppelVirus.exe
66.203.125.13:443
g.api.mega.co.nz
Datacenter Luxembourg S.A.
LU
unknown
2020
DoppelVirus.exe
66.203.125.12:443
g.api.mega.co.nz
Datacenter Luxembourg S.A.
LU
unknown
2020
DoppelVirus.exe
66.203.125.11:443
g.api.mega.co.nz
Datacenter Luxembourg S.A.
LU
unknown

DNS requests

Domain
IP
Reputation
g.api.mega.co.nz
  • 66.203.125.14
  • 66.203.125.13
  • 66.203.125.12
  • 66.203.125.15
  • 66.203.125.11
shared
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
DoppelVirus.rar