analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Electron_rbxscript.com.rar

Full analysis: https://app.any.run/tasks/a7db57f1-9bb6-45ad-80b9-a0751814954d
Verdict: Malicious activity
Analysis date: January 15, 2022, 01:26:47
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

2ABA670302A8D03D1E48C963B8A70B2E

SHA1:

AE6C232DD66D0E84D3C7155ED9543DAE7741F2EF

SHA256:

355D241C0973EC51A4FCD36D5262BF584101AF286FD5723D09DEA45785BECFB3

SSDEEP:

98304:dkyLTMtVNNlUzu7xpoQkxXVeDQaK8Kge2ERahU:dFnYVFULXtQC

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • JITStarter.exe (PID: 2260)
      • JITStarter.exe (PID: 852)
      • Electron.exe (PID: 3624)

    • Loads dropped or rewritten executable

      • Electron.exe (PID: 3624)
      • WerFault.exe (PID: 400)

  • SUSPICIOUS

    • Reads the computer name

      • WinRAR.exe (PID: 3444)
      • JITStarter.exe (PID: 2260)
      • Electron.exe (PID: 3624)

    • Checks supported languages

      • WinRAR.exe (PID: 3444)
      • JITStarter.exe (PID: 2260)
      • Electron.exe (PID: 3624)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3444)
      • Electron.exe (PID: 3624)
      • JITStarter.exe (PID: 2260)

    • Drops a file with a compile date too recent

      • JITStarter.exe (PID: 2260)

    • Starts CMD.EXE for commands execution

      • JITStarter.exe (PID: 2260)

    • Searches for installed software

      • JITStarter.exe (PID: 2260)

    • Drops a file that was compiled in debug mode

      • JITStarter.exe (PID: 2260)
      • Electron.exe (PID: 3624)

    • Reads Environment values

      • Electron.exe (PID: 3624)

    • Creates files in the program directory

      • WerFault.exe (PID: 400)

  • INFO

    • Reads the computer name

      • cmd.exe (PID: 2760)
      • cmd.exe (PID: 1236)
      • WerFault.exe (PID: 400)

    • Checks supported languages

      • cmd.exe (PID: 1236)
      • cmd.exe (PID: 2760)
      • WerFault.exe (PID: 400)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
48
Monitored processes
7
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start drop and start start drop and start winrar.exe jitstarter.exe no specs jitstarter.exe cmd.exe no specs cmd.exe no specs electron.exe werfault.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3444"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Electron_rbxscript.com.rar"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
852"C:\Users\admin\AppData\Local\Temp\Rar$EXa3444.17126\Electron (rbxscript.com)\JITStarter.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3444.17126\Electron (rbxscript.com)\JITStarter.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
2260"C:\Users\admin\AppData\Local\Temp\Rar$EXa3444.17126\Electron (rbxscript.com)\JITStarter.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3444.17126\Electron (rbxscript.com)\JITStarter.exe
WinRAR.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
1236/C NDP461-KB3102438-Web.exe /q /norestartC:\Windows\system32\cmd.exe—JITStarter.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2760/C dxwebsetup.exe /QC:\Windows\system32\cmd.exe—JITStarter.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3624"C:\Users\admin\AppData\Local\Temp\Rar$EXa3444.17126\Electron (rbxscript.com)\Electron.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3444.17126\Electron (rbxscript.com)\Electron.exe
JITStarter.exe
User:
admin
Company:
Electron
Integrity Level:
HIGH
Description:
ElectronUI
Exit code:
3762504530
Version:
1.0.0.0
400C:\Windows\system32\WerFault.exe -u -p 3624 -s 1320C:\Windows\system32\WerFault.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
4 036
Read events
3 978
Write events
0
Delete events
0

Modification events

No data
Executable files
3
Suspicious files
1
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
400WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_Electron.exe_b3fd8c5d92a93b6e69a4aff9d74dca28aa7537_019ea302\Report.wer —
MD5:—
SHA256:—
400WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\Electron.exe.3624.dmp —
MD5:—
SHA256:—
2260JITStarter.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3444.17126\Electron (rbxscript.com)\bin\uiversiontext
MD5:0AD8159E9F09D8DE8B4A2F03096992D8
SHA256:3EEB40BE4457BD6356BCEF190AE9A0895D905F8E0163A4F612C189924D9AC09B
2260JITStarter.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3444.17126\Electron (rbxscript.com)\tempcompressed
MD5:EA5A407CD74F9D59F0B71BDDD94E9B7A
SHA256:4F955BC0D87EAD5214B54F91E33AA575D0CE6FC3CE799D6AEEBEC3014CFA8917
2260JITStarter.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3444.17126\Electron (rbxscript.com)\Electron.exeexecutable
MD5:8282E036239B6CA794A3D168F39BE1BA
SHA256:7CCBA660B226F31EE8A113C5B608F009CE5B821F133E56BEA82F496103B92EA4
3444WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3444.17126\Electron (rbxscript.com)\JITStarter.exeexecutable
MD5:3EA2FE52A7A3D2BB5348DE947CD3B663
SHA256:E5116F3776384A01FE95DDAB61B360931AC41B1CEDA9D9007D8C5F6804F93770
3444WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3444.17126\Electron (rbxscript.com)\HowToUse.txttext
MD5:21670A30885B42C14899543948369351
SHA256:6523078ACA59F46D4FB4EC12A2B4C3E7204D175E2BE3AE464234E4428BB78012
3444WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3444.17126\Electron (rbxscript.com)\README_IMPORTANT.txttext
MD5:BE80472E9D39D3F63FC3627F3BC9C2E6
SHA256:4C62BB303A204E8B4B8A9CA8DFF49134201A8F0EBBFF72096EE132451438BA88
3624Electron.exeC:\Users\admin\AppData\Local\Temp\fe18e516-f12f-4073-bf13-52a839118bfb\GunaDotNetRT.dllexecutable
MD5:9AF5EB006BB0BAB7F226272D82C896C7
SHA256:77DC05A6BDA90757F66552EE3F469B09F1E00732B4EDCA0F542872FB591ED9DB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
8
DNS requests
5
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
996
lsass.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
996
lsass.exe
GET
200
13.107.4.50:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?647ec432d6354502
US
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
996
lsass.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2260
JITStarter.exe
172.67.175.197:443
ryos.best
—
US
suspicious
—
—
185.199.109.133:443
raw.githubusercontent.com
GitHub, Inc.
NL
malicious
2260
JITStarter.exe
104.21.17.113:443
ryos.best
Cloudflare Inc
US
unknown
996
lsass.exe
13.107.4.50:80
ctldl.windowsupdate.com
Microsoft Corporation
US
whitelisted

DNS requests

Domain
IP
Reputation
ryos.best
  • 104.21.17.113
  • 172.67.175.197
unknown
ctldl.windowsupdate.com
  • 13.107.4.50
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
cache.ryos.best
  • 172.67.175.197
  • 104.21.17.113
suspicious
raw.githubusercontent.com
  • 185.199.109.133
  • 185.199.111.133
  • 185.199.110.133
  • 185.199.108.133
shared

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Electron_rbxscript.com.rar