| File name: | GABB.rar |
| Full analysis: | https://app.any.run/tasks/517b802f-066a-4c20-9e60-319cef4f79b6 |
| Verdict: | Malicious activity |
| Analysis date: | August 08, 2020, 10:43:30 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-rar |
| File info: | RAR archive data, v5 |
| MD5: | FBEE6A0BD53009B50CBA431E02A6A4EB |
| SHA1: | F05C81373972B28DD81A7DC2C29131B68DB8F0F4 |
| SHA256: | 3185430BEEBCFCCD395D7D269805AE95C120C5E2FFC033B8A49684DFCB29F371 |
| SSDEEP: | 24576:EKakz7yELA37lPxV4y5N0OcyV2ceBL+kYtqQFy/FVNek0r19/:7akPyELAlv4y5JpJFqwx1B |
MALICIOUS
Application was dropped or rewritten from another process
- GABB.exe (PID: 692)
- GABB.exe (PID: 296)
- GABB.exe (PID: 3000)
- GABB.exe (PID: 820)
- GABB.exe (PID: 4092)
Changes the autorun value in the registry
- GABB.exe (PID: 692)
- GABB.exe (PID: 296)
- GABB.exe (PID: 3000)
Changes settings of System certificates
- GABB.exe (PID: 3000)
Loads dropped or rewritten executable
- explorer.exe (PID: 356)
SUSPICIOUS
Executable content was dropped or overwritten
- WinRAR.exe (PID: 1228)
- GABB.exe (PID: 296)
- explorer.exe (PID: 356)
Checks for external IP
- GABB.exe (PID: 296)
- GABB.exe (PID: 692)
- GABB.exe (PID: 3000)
Adds / modifies Windows certificates
- GABB.exe (PID: 3000)
INFO
Manual execution by user
- GABB.exe (PID: 692)
- GABB.exe (PID: 296)
- GABB.exe (PID: 3000)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .rar | | | RAR compressed archive (v5.0) (61.5) |
|---|---|---|
| .rar | | | RAR compressed archive (gen) (38.4) |
Total processes
53
Monitored processes
8
Malicious processes
4
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 296 | "C:\Users\admin\Desktop\GABB.exe" | C:\Users\admin\Desktop\GABB.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 356 | C:\Windows\Explorer.EXE | C:\Windows\explorer.exe | — | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 692 | "C:\Users\admin\Desktop\GABB.exe" | C:\Users\admin\Desktop\GABB.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 820 | "C:\Users\admin\AppData\Local\Temp\GABB.exe" | C:\Users\admin\AppData\Local\Temp\GABB.exe | — | GABB.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 3221225781 Modules
| |||||||||||||||
| 1228 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\GABB.rar" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 Modules
| |||||||||||||||
| 3000 | "C:\Users\admin\Desktop\GABB.exe" | C:\Users\admin\Desktop\GABB.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 3944 | "C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\Temp\GABB.ini | C:\Windows\system32\NOTEPAD.EXE | — | GABB.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Notepad Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 4092 | "C:\Users\admin\Desktop\New folder\GABB.exe" | C:\Users\admin\Desktop\New folder\GABB.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Version: 1.0.0.0 | |||||||||||||||
Total events
4 695
Read events
4 536
Write events
158
Delete events
1
Modification events
| (PID) Process: | (1228) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (1228) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (1228) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\137\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (1228) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\137\52C64B7E |
| Operation: | write | Name: | @C:\Windows\system32\NetworkExplorer.dll,-1 |
Value: Network | |||
| (PID) Process: | (1228) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\GABB.rar | |||
| (PID) Process: | (1228) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (1228) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (1228) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (1228) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (356) explorer.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rar\OpenWithList |
| Operation: | write | Name: | a |
Value: WinRAR.exe | |||
Executable files
8
Suspicious files
0
Text files
4
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1228 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa1228.26630\GABB.ini | text | |
MD5:— | SHA256:— | |||
| 356 | explorer.exe | C:\Users\admin\Desktop\GABB.ini | text | |
MD5:— | SHA256:— | |||
| 356 | explorer.exe | C:\Users\admin\Desktop\GABB.exe | executable | |
MD5:— | SHA256:— | |||
| 356 | explorer.exe | C:\Users\admin\Desktop\New folder\GABB.exe | executable | |
MD5:— | SHA256:— | |||
| 356 | explorer.exe | C:\Users\admin\Desktop\New folder\GABB.ini | text | |
MD5:— | SHA256:— | |||
| 296 | GABB.exe | C:\Users\admin\AppData\Local\Temp\GABB.ini | text | |
MD5:— | SHA256:— | |||
| 1228 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa1228.26630\GABB.exe | executable | |
MD5:— | SHA256:— | |||
| 356 | explorer.exe | C:\Users\admin\Desktop\GDLL.dll | executable | |
MD5:8A12CB004CDBAAA80114F3C183848EFD | SHA256:92C1C18666563DF90CCA6C49CDA917B569061AE23ECD1556148E231CD6420517 | |||
| 1228 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa1228.26630\GDLL.dll | executable | |
MD5:8A12CB004CDBAAA80114F3C183848EFD | SHA256:92C1C18666563DF90CCA6C49CDA917B569061AE23ECD1556148E231CD6420517 | |||
| 356 | explorer.exe | C:\Users\admin\Desktop\New folder\GDLL.dll | executable | |
MD5:8A12CB004CDBAAA80114F3C183848EFD | SHA256:92C1C18666563DF90CCA6C49CDA917B569061AE23ECD1556148E231CD6420517 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
9
DNS requests
2
Threats
7
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
296 | GABB.exe | GET | 200 | 116.202.55.106:80 | http://icanhazip.com/ | IN | text | 14 b | shared |
296 | GABB.exe | GET | 200 | 116.202.55.106:80 | http://icanhazip.com/ | IN | text | 14 b | shared |
3000 | GABB.exe | GET | 200 | 116.202.55.106:80 | http://icanhazip.com/ | IN | text | 14 b | shared |
3000 | GABB.exe | GET | 200 | 116.202.55.106:80 | http://icanhazip.com/ | IN | text | 14 b | shared |
692 | GABB.exe | GET | 200 | 116.202.55.106:80 | http://icanhazip.com/ | IN | text | 14 b | shared |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 116.202.55.106:80 | icanhazip.com | 334,Udyog Vihar | IN | malicious |
296 | GABB.exe | 116.202.55.106:80 | icanhazip.com | 334,Udyog Vihar | IN | malicious |
692 | GABB.exe | 116.202.55.106:80 | icanhazip.com | 334,Udyog Vihar | IN | malicious |
3000 | GABB.exe | 116.202.55.106:80 | icanhazip.com | 334,Udyog Vihar | IN | malicious |
296 | GABB.exe | 104.27.142.46:443 | nusumu.wtf | Cloudflare Inc | US | malicious |
3000 | GABB.exe | 104.27.142.46:443 | nusumu.wtf | Cloudflare Inc | US | malicious |
692 | GABB.exe | 104.27.142.46:443 | nusumu.wtf | Cloudflare Inc | US | malicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
icanhazip.com |
| shared |
nusumu.wtf |
| unknown |
Threats
PID | Process | Class | Message |
|---|---|---|---|
692 | GABB.exe | Attempted Information Leak | ET POLICY IP Check Domain (icanhazip. com in HTTP Host) |
296 | GABB.exe | Attempted Information Leak | ET POLICY IP Check Domain (icanhazip. com in HTTP Host) |
296 | GABB.exe | Attempted Information Leak | ET POLICY IP Check Domain (icanhazip. com in HTTP Host) |
3000 | GABB.exe | Attempted Information Leak | ET POLICY IP Check Domain (icanhazip. com in HTTP Host) |
3000 | GABB.exe | Attempted Information Leak | ET POLICY IP Check Domain (icanhazip. com in HTTP Host) |
692 | GABB.exe | Attempted Information Leak | ET POLICY IP Check Domain (icanhazip. com in HTTP Host) |
— | — | Attempted Information Leak | ET POLICY IP Check Domain (icanhazip. com in HTTP Host) |