analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

win_update_stop_setup.rar

Full analysis: https://app.any.run/tasks/38bb9a67-c8a9-456f-ab6a-8b2f5b9d04d4
Verdict: Malicious activity
Analysis date: August 17, 2019, 15:21:14
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

079583DC8279CC5F39B0B0A794FEF85A

SHA1:

062E7309DB5FF5BE2A2B9CEAC33E499216C3BEB1

SHA256:

48CCAFF9EED845E4B6F1392E23E54FC25C4050C631DEB2EA5E02D9A3F4CAA337

SSDEEP:

24576:JIXhd6RqiX3feqQouo3JUoJVcTu6KiwEvgtrYe8H/E/YIiSaRT:JwaXLQouUUoJ2ziWHMYIXa9

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • win_update_stop_setup.exe (PID: 3416)
      • WinUpdateStop.exe (PID: 3380)
      • win_update_stop_setup.exe (PID: 3684)
      • WinUpdateStop.exe (PID: 2588)

    • Modifies Windows security services settings

      • WinUpdateStop.exe (PID: 3380)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 4072)
      • cmd.exe (PID: 3744)
      • cmd.exe (PID: 3908)
      • cmd.exe (PID: 3792)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 2700)
      • schtasks.exe (PID: 2072)
      • schtasks.exe (PID: 3008)
      • schtasks.exe (PID: 2916)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • win_update_stop_setup.exe (PID: 3416)
      • win_update_stop_setup.exe (PID: 3684)
      • WinRAR.exe (PID: 3020)
      • win_update_stop_setup.tmp (PID: 2272)

    • Starts Internet Explorer

      • win_update_stop_setup.tmp (PID: 2272)

    • Starts CMD.EXE for commands execution

      • WinUpdateStop.exe (PID: 3380)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 3612)

  • INFO

    • Application was dropped or rewritten from another process

      • win_update_stop_setup.tmp (PID: 2272)
      • win_update_stop_setup.tmp (PID: 4040)

    • Application launched itself

      • iexplore.exe (PID: 2796)

    • Creates files in the program directory

      • win_update_stop_setup.tmp (PID: 2272)

    • Creates a software uninstall entry

      • win_update_stop_setup.tmp (PID: 2272)

    • Changes internet zones settings

      • iexplore.exe (PID: 2796)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3596)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3596)

    • Creates files in the user directory

      • iexplore.exe (PID: 3596)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3596)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3596)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
65
Monitored processes
20
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start winrar.exe win_update_stop_setup.exe win_update_stop_setup.tmp no specs win_update_stop_setup.exe win_update_stop_setup.tmp winupdatestop.exe no specs winupdatestop.exe iexplore.exe iexplore.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs sc.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs taskmgr.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3020"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\win_update_stop_setup.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3416"C:\Users\admin\AppData\Local\Temp\Rar$EXb3020.29938\win_update_stop_setup.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb3020.29938\win_update_stop_setup.exe
WinRAR.exe
User:
admin
Company:
NoVirusThanks Company Srl
Integrity Level:
MEDIUM
Description:
NoVirusThanks Win Update Stop Setup
Exit code:
0
Version:
1.3.0.0
4040"C:\Users\admin\AppData\Local\Temp\is-OAA3L.tmp\win_update_stop_setup.tmp" /SL5="$30158,1066140,57856,C:\Users\admin\AppData\Local\Temp\Rar$EXb3020.29938\win_update_stop_setup.exe" C:\Users\admin\AppData\Local\Temp\is-OAA3L.tmp\win_update_stop_setup.tmp—win_update_stop_setup.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.52.0.0
3684"C:\Users\admin\AppData\Local\Temp\Rar$EXb3020.29938\win_update_stop_setup.exe" /SPAWNWND=$20178 /NOTIFYWND=$30158 C:\Users\admin\AppData\Local\Temp\Rar$EXb3020.29938\win_update_stop_setup.exe
win_update_stop_setup.tmp
User:
admin
Company:
NoVirusThanks Company Srl
Integrity Level:
HIGH
Description:
NoVirusThanks Win Update Stop Setup
Exit code:
0
Version:
1.3.0.0
2272"C:\Users\admin\AppData\Local\Temp\is-EMSHG.tmp\win_update_stop_setup.tmp" /SL5="$30176,1066140,57856,C:\Users\admin\AppData\Local\Temp\Rar$EXb3020.29938\win_update_stop_setup.exe" /SPAWNWND=$20178 /NOTIFYWND=$30158 C:\Users\admin\AppData\Local\Temp\is-EMSHG.tmp\win_update_stop_setup.tmp
win_update_stop_setup.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.52.0.0
2588"C:\Program Files\NoVirusThanks\Win Update Stop\WinUpdateStop.exe" C:\Program Files\NoVirusThanks\Win Update Stop\WinUpdateStop.exe—win_update_stop_setup.tmp
User:
admin
Company:
NoVirusThanks Company Srl
Integrity Level:
MEDIUM
Description:
NoVirusThanks Win Update Stop
Exit code:
3221226540
Version:
1.3.0.0
3380"C:\Program Files\NoVirusThanks\Win Update Stop\WinUpdateStop.exe" C:\Program Files\NoVirusThanks\Win Update Stop\WinUpdateStop.exe
win_update_stop_setup.tmp
User:
admin
Company:
NoVirusThanks Company Srl
Integrity Level:
HIGH
Description:
NoVirusThanks Win Update Stop
Version:
1.3.0.0
2796"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
win_update_stop_setup.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3596"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2796 CREDAT:79873C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3612cmd /c sc stop wuauservC:\Windows\system32\cmd.exe—WinUpdateStop.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Total events
1 502
Read events
1 368
Write events
0
Delete events
0

Modification events

No data
Executable files
5
Suspicious files
1
Text files
40
Unknown types
8

Dropped files

PID
Process
Filename
Type
2272win_update_stop_setup.tmpC:\Program Files\NoVirusThanks\Win Update Stop\is-TRM6L.tmp —
MD5:—
SHA256:—
2272win_update_stop_setup.tmpC:\Program Files\NoVirusThanks\Win Update Stop\is-AB6SM.tmp —
MD5:—
SHA256:—
2272win_update_stop_setup.tmpC:\Program Files\NoVirusThanks\Win Update Stop\is-97E16.tmp —
MD5:—
SHA256:—
2272win_update_stop_setup.tmpC:\Program Files\NoVirusThanks\Win Update Stop\is-JRS6Q.tmp —
MD5:—
SHA256:—
2272win_update_stop_setup.tmpC:\Program Files\NoVirusThanks\Win Update Stop\is-7TVF6.tmp —
MD5:—
SHA256:—
2796iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\favicon[1].ico —
MD5:—
SHA256:—
2796iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
3596iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\post-install[1].txt —
MD5:—
SHA256:—
2272win_update_stop_setup.tmpC:\Users\admin\Desktop\Win Update Stop.lnklnk
MD5:80E74436D0A282290E80474093038BFC
SHA256:D3B0A9290882502C5D73180385936B8DD898E7CFE692A0A86DE3656A538E3DC0
2272win_update_stop_setup.tmpC:\Program Files\NoVirusThanks\Win Update Stop\unins000.datdat
MD5:42111298721908A0C126DE6F6CB784E6
SHA256:56BB7C8F33B5B39D056386C2828A6445230D76CA71E47DB5EB139E79735DF7C2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
20
DNS requests
13
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3596
iexplore.exe
GET
301
195.154.118.123:80
http://www.novirusthanks.org/post-install/?program=win-update-stop
FR
html
162 b
whitelisted
2796
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3596
iexplore.exe
172.217.22.99:443
fonts.gstatic.com
Google Inc.
US
whitelisted
3596
iexplore.exe
172.217.18.99:443
www.gstatic.com
Google Inc.
US
whitelisted
3596
iexplore.exe
172.217.22.68:443
www.google.com
Google Inc.
US
whitelisted
3596
iexplore.exe
216.58.205.226:443
pagead2.googlesyndication.com
Google Inc.
US
whitelisted
3596
iexplore.exe
172.217.16.202:443
fonts.googleapis.com
Google Inc.
US
whitelisted
3596
iexplore.exe
172.217.18.110:443
www.google-analytics.com
Google Inc.
US
whitelisted
2796
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3596
iexplore.exe
195.154.118.123:80
www.novirusthanks.org
Online S.a.s.
FR
unknown
3596
iexplore.exe
195.154.118.123:443
www.novirusthanks.org
Online S.a.s.
FR
unknown
3596
iexplore.exe
104.19.197.151:443
cdnjs.cloudflare.com
Cloudflare Inc
US
shared

DNS requests

Domain
IP
Reputation
www.novirusthanks.org
  • 195.154.118.123
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
maxcdn.bootstrapcdn.com
  • 209.197.3.15
whitelisted
fonts.googleapis.com
  • 172.217.16.202
whitelisted
fonts.gstatic.com
  • 172.217.22.99
whitelisted
oss.maxcdn.com
  • 23.111.8.154
whitelisted
www.google.com
  • 172.217.22.68
whitelisted
pagead2.googlesyndication.com
  • 216.58.205.226
whitelisted
www.gstatic.com
  • 172.217.18.99
whitelisted
cdnjs.cloudflare.com
  • 104.19.197.151
  • 104.19.199.151
  • 104.19.195.151
  • 104.19.198.151
  • 104.19.196.151
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
win_update_stop_setup.rar