| File name: | Purchase Order.tar |
| Full analysis: | https://app.any.run/tasks/717bd7bf-4b79-4d26-b9c4-dd1d67dc92c1 |
| Verdict: | Malicious activity |
| Threats: | A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools. |
| Analysis date: | June 21, 2025, 03:47:09 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-tar |
| File info: | POSIX tar archive (GNU) |
| MD5: | 1EA1A92A8D0A79B48C1C1C7F27239B69 |
| SHA1: | C54D0B4EBDFA7D2A50715C1EE92EA6AFC27A41D8 |
| SHA256: | 4793B5AD77A25A94754FF54FF8AEA511B1FE6E23BB24A00B550AF0E5979AC9D1 |
| SSDEEP: | 24576:RJFUSAT892GNYRW5m7SkslgyNs0+6M1B/tTLsLObqR0K7udGyuP8nRAQzs:RJFUSAT892GNYRW5m7SkslgyNf+6M1B6 |
MALICIOUS
Generic archive extractor
- WinRAR.exe (PID: 3488)
Uses Task Scheduler to run other applications
- Purchase Order.exe (PID: 6104)
Actions looks like stealing of personal data
- RegSvcs.exe (PID: 1336)
Steals credentials from Web Browsers
- RegSvcs.exe (PID: 1336)
SNAKEKEYLOGGER has been detected (SURICATA)
- RegSvcs.exe (PID: 1336)
SUSPICIOUS
Executing commands from a ".bat" file
- WinRAR.exe (PID: 3488)
Reads security settings of Internet Explorer
- WinRAR.exe (PID: 3488)
- Purchase Order.exe (PID: 6104)
Starts CMD.EXE for commands execution
- WinRAR.exe (PID: 3488)
Executable content was dropped or overwritten
- Purchase Order.exe (PID: 6104)
The process verifies whether the antivirus software is installed
- RegSvcs.exe (PID: 1336)
Checks for external IP
- svchost.exe (PID: 2200)
- RegSvcs.exe (PID: 1336)
INFO
Manual execution by a user
- Purchase Order.exe (PID: 6104)
Reads the machine GUID from the registry
- Purchase Order.exe (PID: 6104)
- RegSvcs.exe (PID: 1336)
Reads the computer name
- Purchase Order.exe (PID: 6104)
- MpCmdRun.exe (PID: 5764)
- MpCmdRun.exe (PID: 6732)
- MpCmdRun.exe (PID: 3800)
- RegSvcs.exe (PID: 1336)
Checks supported languages
- Purchase Order.exe (PID: 6104)
- MpCmdRun.exe (PID: 5764)
- RegSvcs.exe (PID: 1336)
- MpCmdRun.exe (PID: 6732)
- MpCmdRun.exe (PID: 3800)
Executable content was dropped or overwritten
- WinRAR.exe (PID: 3488)
Create files in a temporary directory
- MpCmdRun.exe (PID: 5764)
- Purchase Order.exe (PID: 6104)
.NET Reactor protector has been detected
- Purchase Order.exe (PID: 6104)
Creates files or folders in the user directory
- Purchase Order.exe (PID: 6104)
Process checks computer location settings
- Purchase Order.exe (PID: 6104)
Reads the software policy settings
- RegSvcs.exe (PID: 1336)
- slui.exe (PID: 1480)
Disables trace logs
- RegSvcs.exe (PID: 1336)
Checks proxy server information
- RegSvcs.exe (PID: 1336)
- slui.exe (PID: 1480)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .tar | | | TAR - Tape ARchive (100) |
|---|
Total processes
149
Monitored processes
16
Malicious processes
2
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1336 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Purchase Order.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft .NET Services Installation Utility Version: 4.8.9037.0 built by: NET481REL1 Modules
| |||||||||||||||
| 1480 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | svchost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1488 | C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\Rar$VR3488.1130\Rar$Scan67867.bat" " | C:\Windows\System32\cmd.exe | — | WinRAR.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2072 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2200 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2468 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3488 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Purchase Order.tar" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.91.0 Modules
| |||||||||||||||
| 3800 | "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\admin\AppData\Local\Temp\Rar$VR3488.1130" | C:\Program Files\Windows Defender\MpCmdRun.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Malware Protection Command Line Utility Exit code: 2 Version: 4.18.1909.6 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4040 | C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\Rar$VR3488.45233\Rar$Scan8894.bat" " | C:\Windows\System32\cmd.exe | — | WinRAR.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4708 | C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\Rar$VR3488.49136\Rar$Scan47921.bat" " | C:\Windows\System32\cmd.exe | — | WinRAR.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
4 506
Read events
4 481
Write events
25
Delete events
0
Modification events
| (PID) Process: | (3488) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 3 |
Value: C:\Users\admin\Desktop\preferences.zip | |||
| (PID) Process: | (3488) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\chromium_ext.zip | |||
| (PID) Process: | (3488) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\omni_23_10_2024_.zip | |||
| (PID) Process: | (3488) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\Purchase Order.tar | |||
| (PID) Process: | (3488) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (3488) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (3488) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (3488) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (3488) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\VirusScan |
| Operation: | write | Name: | DefScanner |
Value: Windows Defender | |||
| (PID) Process: | (1336) RegSvcs.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32 |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
Executable files
4
Suspicious files
0
Text files
5
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6104 | Purchase Order.exe | C:\Users\admin\AppData\Local\Temp\tmp9C9D.tmp | xml | |
MD5:5C5FCE97C03DA4F696E537A3427D6D33 | SHA256:773C54D7FA1E6963AE0BEF2AD0B39169BB3A7E9F9D138A11E33A5244541FCE83 | |||
| 3488 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$VR3488.1130\Purchase Order.tar\Purchase Order.exe | executable | |
MD5:F5047234349C5B1D5D421671A3FD4DB6 | SHA256:11DA44857ECA257BFBEBCBD1558987A27FF67FFFE12EA8BA2A8BA472ABF9E2C0 | |||
| 6104 | Purchase Order.exe | C:\Users\admin\AppData\Roaming\vTbRew.exe | executable | |
MD5:F5047234349C5B1D5D421671A3FD4DB6 | SHA256:11DA44857ECA257BFBEBCBD1558987A27FF67FFFE12EA8BA2A8BA472ABF9E2C0 | |||
| 3488 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$VR3488.49136\Purchase Order.tar\Purchase Order.exe | executable | |
MD5:F5047234349C5B1D5D421671A3FD4DB6 | SHA256:11DA44857ECA257BFBEBCBD1558987A27FF67FFFE12EA8BA2A8BA472ABF9E2C0 | |||
| 3488 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$VR3488.1130\Rar$Scan67867.bat | text | |
MD5:16B04D27676EEE6725EB7F00E548CE43 | SHA256:DD9CE39429F5006264F238990AA9D5C7EF1A7999B61E239BBF8433C006AB7C9F | |||
| 5764 | MpCmdRun.exe | C:\Users\admin\AppData\Local\Temp\MpCmdRun.log | text | |
MD5:C2DD0185D712494F570A437D89A228DA | SHA256:33BB1FD430F09C609A6C2F78199445DBA1600CD811AE593414D7E5B9B08A3C79 | |||
| 3488 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$VR3488.45233\Purchase Order.tar\Purchase Order.exe | executable | |
MD5:F5047234349C5B1D5D421671A3FD4DB6 | SHA256:11DA44857ECA257BFBEBCBD1558987A27FF67FFFE12EA8BA2A8BA472ABF9E2C0 | |||
| 3488 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$VR3488.45233\Rar$Scan8894.bat | text | |
MD5:AF967FED1DC315B6B1D289C8640E4EFF | SHA256:13771DF691E0581199F47F79EA71691741C612ABA71427AF09DA0E20703DFCC5 | |||
| 3488 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$VR3488.49136\Rar$Scan47921.bat | text | |
MD5:58E47E7568969E90B88FD630C2B3E229 | SHA256:2EDB02868408F934D01356E79A7BE8B1B161010D4646D8ACB05693B8469FD0EE | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
31
DNS requests
18
Threats
7
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
892 | svchost.exe | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
1336 | RegSvcs.exe | GET | 200 | 132.226.8.169:80 | http://checkip.dyndns.org/ | unknown | — | — | whitelisted |
1336 | RegSvcs.exe | GET | 200 | 132.226.8.169:80 | http://checkip.dyndns.org/ | unknown | — | — | whitelisted |
5944 | MoUsoCoreWorker.exe | GET | 200 | 23.53.40.178:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5944 | MoUsoCoreWorker.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
6344 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
6344 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
2940 | svchost.exe | GET | 200 | 23.209.209.135:80 | http://x1.c.lencr.org/ | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
1268 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
5944 | MoUsoCoreWorker.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
7052 | RUXIMICS.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
2336 | svchost.exe | 172.211.123.249:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
892 | svchost.exe | 40.126.31.2:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
892 | svchost.exe | 2.17.190.73:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
1336 | RegSvcs.exe | 132.226.8.169:80 | checkip.dyndns.org | ORACLE-BMC-31898 | JP | whitelisted |
5944 | MoUsoCoreWorker.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
nexusrules.officeapps.live.com |
| whitelisted |
checkip.dyndns.org |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
reallyfreegeoip.org |
| malicious |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2200 | svchost.exe | Device Retrieving External IP Address Detected | ET DYN_DNS External IP Lookup Domain in DNS Query (checkip .dyndns .org) |
1336 | RegSvcs.exe | Device Retrieving External IP Address Detected | ET INFO External IP Lookup - checkip.dyndns.org |
1336 | RegSvcs.exe | Device Retrieving External IP Address Detected | ET INFO 404/Snake/Matiex Keylogger Style External IP Check |
2200 | svchost.exe | Device Retrieving External IP Address Detected | INFO [ANY.RUN] External IP Address Lookup Domain (reallyfreegeoip .org) |
2200 | svchost.exe | Misc activity | ET INFO External IP Address Lookup Domain in DNS Lookup (reallyfreegeoip .org) |
1336 | RegSvcs.exe | Misc activity | ET INFO External IP Lookup Service Domain (reallyfreegeoip .org) in TLS SNI |
1336 | RegSvcs.exe | Device Retrieving External IP Address Detected | ET INFO External IP Lookup - checkip.dyndns.org |