File name:

faa.7z

Full analysis: https://app.any.run/tasks/7e98b2d5-392e-4967-a9c9-0819e16dcf1b
Verdict: Malicious activity
Analysis date: July 29, 2024, 17:32:10
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
pastebin
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

A198FEDDD7167C62B242DE19A850351A

SHA1:

A7562754AA3B6F6B513EE86B80707986A94D7348

SHA256:

33923F0ED3C744E43CC216DBB46E1C5E97020A7069C2A8CA8CD5A1B65BD1F20F

SSDEEP:

98304:SYLtr7NHb2Gy71Ob+l8emVMbW1NtWdbXn3rV5QH0BTY04Sm2qMXf7KSYTkpvFgTR:p48jz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 7032)

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • WinRAR.exe (PID: 6648)

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 6648)

    • Creates file in the systems drive root

      • WinRAR.exe (PID: 7032)

    • Reads security settings of Internet Explorer

      • RPS-420 RAT.exe (PID: 3108)

    • The process checks if it is being run in the virtual environment

      • RPS-420 RAT.exe (PID: 3108)

    • Reads the BIOS version

      • RPS-420 RAT.exe (PID: 3108)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6648)
      • WinRAR.exe (PID: 7032)

    • Manual execution by a user

      • WinRAR.exe (PID: 6648)
      • RPS-420 RAT.exe (PID: 3108)

    • Reads the machine GUID from the registry

      • RPS-420 RAT.exe (PID: 3108)

    • Reads the computer name

      • RPS-420 RAT.exe (PID: 3108)

    • Disables trace logs

      • RPS-420 RAT.exe (PID: 3108)

    • Checks proxy server information

      • RPS-420 RAT.exe (PID: 3108)

    • Checks supported languages

      • RPS-420 RAT.exe (PID: 3108)

    • Reads the software policy settings

      • RPS-420 RAT.exe (PID: 3108)

    • Reads Environment values

      • RPS-420 RAT.exe (PID: 3108)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 6648)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
141
Monitored processes
4
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe slui.exe no specs winrar.exe rps-420 rat.exe

Process information

PID
CMD
Path
Indicators
Parent process
3076C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
3108"C:\Users\admin\Desktop\fa\RPS-420 RAT.exe" C:\Users\admin\Desktop\fa\RPS-420 RAT.exe
explorer.exe
User:
admin
Company:
RPS-420
Integrity Level:
MEDIUM
Description:
RPS-420 RAT
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\fa\rps-420 rat.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\mscoree.dll
6648"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Desktop\fa.7z" C:\Users\admin\Desktop\fa\C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
7032"C:\Program Files\WinRAR\WinRAR.exe" C:\faa.7zC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
Total events
6 910
Read events
6 873
Write events
37
Delete events
0

Modification events

(PID) Process:(7032) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(7032) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(7032) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(7032) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\faa.7z
(PID) Process:(7032) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7032) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(7032) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(7032) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6648) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(6648) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
Executable files
23
Suspicious files
31
Text files
257
Unknown types
1

Dropped files

PID
Process
Filename
Type
7032WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7032.15474\Hiddenz's.dllbinary
MD5:72881E6A1566625E53DA55F10BCB20FF
SHA256:15AA4CE55B93978E055539E4BF2F62FB06B77AE7E89CE7AE73F7217DB0D681D7
7032WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7032.15474\cGeoIp.dllexecutable
MD5:6D6E172E7965D1250A4A6F8A0513AA9F
SHA256:D1DDD15E9C727A5ECF78D3918C17AEE0512F5B181AD44952686BEB89146E6BD0
7032WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7032.15474\Hiddenz's HVNC.dllbinary
MD5:F6B210209A44D2D04D2A246CAABB4A45
SHA256:3A09193B6DEBE1C9BE2B16CAD932450E2D407F233A720C2B435A9F73FCC0E452
7032WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7032.15474\FontAwesome.Sharp.dllexecutable
MD5:F47EB5427819C89DBE76F392BE46AA95
SHA256:02AFB53D63005AD511A7FB8C2F7A41D68ED83FD41F15AEF3C491F1E87B095C8E
7032WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7032.15474\HiddenzHVNC.exeexecutable
MD5:579439D86DEA124561640C1D7D8C1876
SHA256:08BE60F97B00EA1A2C5885E62D8C412FF082E9406CC04A1767BD6340160DC757
7032WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7032.15474\dnlib.dllexecutable
MD5:D9E08EC1C571D8139255CF305E3FEF40
SHA256:48F144F744A9CE60659EE8CC7094610252AECBABF95492FBC612DB919D144918
6648WinRAR.exeC:\Users\admin\Desktop\fa\AdvancedOptions.initext
MD5:0313B427BB08C8B24A0E9EDFC6099ACD
SHA256:9F4F5F60426010DB2165D2F5C0F6069F96B056DC7F1E264432B98B09FE0B81BD
6648WinRAR.exeC:\Users\admin\Desktop\fa\Flags\ae.pngimage
MD5:09CE31C648D538E45713FFF6BB96E3FA
SHA256:A5F07E254C0564F8C03FEEC2786E7649E751477CA08163744B7419AFB6680534
6648WinRAR.exeC:\Users\admin\Desktop\fa\Flags\an.pngimage
MD5:7F3E5F95255F9DBFD090F287E06F46C8
SHA256:463E3132A43D367B0B3527B5DF29481DB0E60B03F1A3F71E7508E35932F27E0E
6648WinRAR.exeC:\Users\admin\Desktop\fa\Flags\--.pngimage
MD5:DF38A5600F8BF82663B45BD483E47D1D
SHA256:C327FD59D6016C4DCD90D6F7C388B366EF8954BE80508F57C92A0DE555B5A175
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
48
DNS requests
22
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4424
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6860
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
5368
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5368
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
4132
OfficeClickToRun.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
4424
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4424
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
3676
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
996
svchost.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
131.253.33.254:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
—
—
2.23.209.177:443
www.bing.com
Akamai International B.V.
GB
unknown
6012
MoUsoCoreWorker.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5900
slui.exe
20.83.72.98:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6572
RUXIMICS.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
488
slui.exe
20.83.72.98:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3952
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 2.23.209.177
  • 2.23.209.187
  • 2.23.209.179
  • 2.23.209.185
  • 2.23.209.176
  • 2.23.209.150
  • 2.23.209.133
  • 2.23.209.182
  • 2.23.209.140
  • 104.126.37.128
  • 104.126.37.184
  • 104.126.37.130
  • 104.126.37.136
  • 104.126.37.186
  • 104.126.37.137
  • 104.126.37.179
  • 104.126.37.170
  • 104.126.37.131
whitelisted
google.com
  • 216.58.206.78
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
whitelisted
fp-afd-nocache-ccp.azureedge.net
  • 13.107.246.45
whitelisted
login.live.com
  • 40.126.31.69
  • 20.190.159.4
  • 40.126.31.67
  • 20.190.159.73
  • 20.190.159.23
  • 20.190.159.68
  • 20.190.159.0
  • 20.190.159.2
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
fd.api.iris.microsoft.com
  • 20.223.36.55
whitelisted
arc.msn.com
  • 20.103.156.88
whitelisted
th.bing.com
  • 104.126.37.144
  • 104.126.37.186
  • 104.126.37.153
  • 104.126.37.145
  • 104.126.37.130
  • 104.126.37.179
  • 104.126.37.128
  • 104.126.37.139
  • 104.126.37.152
whitelisted

Threats

PID
Process
Class
Message
2284
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Online Pastebin Text Storage
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
faa.7z