File name:

New folder.rar

Full analysis: https://app.any.run/tasks/361a2718-b405-41d3-8e53-f3dbeb9fdc36
Verdict: Malicious activity
Analysis date: December 04, 2023, 18:58:59
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

EB37670E8F8D6399FF0923B4DE5BBE20

SHA1:

39DC59786C188978BB838238E62A88E8D2A2E8E1

SHA256:

4E7E1432E320848F9A61F4FE4353A9AD6D34F25F05F799FCCDC8C2AFC81EA6E5

SSDEEP:

98304:wBMuLqLssgQ2wczTOaXFJlwSRGIS+aoeHofNP1+Pav1KnyUpD9AMBTaSXkNBgq51:Kvqfst

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Black World.exe (PID: 2348)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 3264)

  • INFO

    • Checks supported languages

      • 日月神教.exe (PID: 3144)
      • NetBot_Cn.exe (PID: 3620)
      • 中国黑客组织第五版.exe (PID: 2224)
      • wmpnscfg.exe (PID: 1452)
      • 日月神教 IM DDOS压力测试.exe (PID: 3248)
      • 中国黑客组织.exe (PID: 644)
      • 中国黑客组织VIP远程协助V2011.exe (PID: 1460)
      • Black World.exe (PID: 2348)
      • 中国黑客组织VIP远程协助V2011.exe (PID: 120)
      • 中国黑客组织第六版.exe (PID: 3884)
      • Server.exe (PID: 1840)

    • Manual execution by a user

      • 日月神教.exe (PID: 3144)
      • WinRAR.exe (PID: 3264)
      • 中国黑客组织.exe (PID: 644)
      • 中国黑客组织第五版.exe (PID: 2224)
      • 日月神教 IM DDOS压力测试.exe (PID: 3248)
      • 中国黑客组织第六版.exe (PID: 3884)
      • Black World.exe (PID: 2348)
      • Server.exe (PID: 3028)
      • 中国黑客组织VIP远程协助V2011.exe (PID: 1460)
      • wmpnscfg.exe (PID: 1452)
      • Server.exe (PID: 1840)
      • NetBot_Cn.exe (PID: 3620)
      • 中国黑客组织VIP远程协助V2011.exe (PID: 120)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3264)

    • Reads the computer name

      • 中国黑客组织.exe (PID: 644)
      • 日月神教 IM DDOS压力测试.exe (PID: 3248)
      • NetBot_Cn.exe (PID: 3620)
      • 中国黑客组织第五版.exe (PID: 2224)
      • wmpnscfg.exe (PID: 1452)
      • 中国黑客组织第六版.exe (PID: 3884)
      • 中国黑客组织VIP远程协助V2011.exe (PID: 1460)
      • Black World.exe (PID: 2348)
      • 中国黑客组织VIP远程协助V2011.exe (PID: 120)
      • Server.exe (PID: 1840)
      • 日月神教.exe (PID: 3144)

    • Creates files or folders in the user directory

      • Black World.exe (PID: 2348)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
71
Monitored processes
14
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe no specs winrar.exe no specs 日月神教.exe no specs 中国黑客组织.exe no specs 中国黑客组织第五版.exe no specs 中国黑客组织第六版.exe no specs wmpnscfg.exe no specs 日月神教 im ddos压力测试.exe no specs netbot_cn.exe 中国黑客组织vip远程协助v2011.exe 中国黑客组织vip远程协助v2011.exe black world.exe no specs server.exe no specs server.exe

Process information

PID
CMD
Path
Indicators
Parent process
120"C:\Users\admin\Desktop\bin\中国黑客组织VIP远程协助V2011.exe" C:\Users\admin\Desktop\bin\中国黑客组织VIP远程协助V2011.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
2147483652
Modules
Images
c:\users\admin\desktop\bin\中国黑客组织vip远程协助v2011.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
644"C:\Users\admin\Desktop\中国黑客组织VIP专版远程控制\中国黑客组织.exe" C:\Users\admin\Desktop\中国黑客组织VIP专版远程控制\中国黑客组织.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
中国黑客组织 改进版
Exit code:
3221225477
Version:
2.1
Modules
Images
c:\users\admin\desktop\中国黑客组织vip专版远程控制\中国黑客组织.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1452"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1460"C:\Users\admin\Desktop\bin\中国黑客组织VIP远程协助V2011.exe" C:\Users\admin\Desktop\bin\中国黑客组织VIP远程协助V2011.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
2147483652
Modules
Images
c:\users\admin\desktop\bin\中国黑客组织vip远程协助v2011.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1840"C:\Users\admin\Desktop\Black World DDOSV1.3日月神教专版\Server.exe" C:\Users\admin\Desktop\Black World DDOSV1.3日月神教专版\Server.exe
explorer.exe
User:
admin
Company:
360.cn
Integrity Level:
HIGH
Description:
360手机助手
Exit code:
0
Version:
1, 6, 0, 1610
Modules
Images
c:\users\admin\desktop\black world ddosv1.3日月神教专版\server.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2144"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\New folder.rar"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2224"C:\Users\admin\Desktop\中国黑客组织第五版\中国黑客组织第五版\中国黑客组织第五版.exe" C:\Users\admin\Desktop\中国黑客组织第五版\中国黑客组织第五版\中国黑客组织第五版.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
中国黑客组织第五版
Exit code:
0
Version:
5, 0, 0, 0
Modules
Images
c:\users\admin\desktop\中国黑客组织第五版\中国黑客组织第五版\中国黑客组织第五版.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2348"C:\Users\admin\Desktop\Black World DDOSV1.3日月神教专版\Black World.exe" C:\Users\admin\Desktop\Black World DDOSV1.3日月神教专版\Black World.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Blck Wrold DDOS V1.3
Exit code:
0
Version:
1, 0, 0, 0
Modules
Images
c:\users\admin\desktop\black world ddosv1.3日月神教专版\black world.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3028"C:\Users\admin\Desktop\Black World DDOSV1.3日月神教专版\Server.exe" C:\Users\admin\Desktop\Black World DDOSV1.3日月神教专版\Server.exe—explorer.exe
User:
admin
Company:
360.cn
Integrity Level:
MEDIUM
Description:
360手机助手
Exit code:
3221226540
Version:
1, 6, 0, 1610
Modules
Images
c:\users\admin\desktop\black world ddosv1.3日月神教专版\server.exe
c:\windows\system32\ntdll.dll
3144"C:\Users\admin\Desktop\Sword beta 3.0\日月神教.exe" C:\Users\admin\Desktop\Sword beta 3.0\日月神教.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\sword beta 3.0\日月神教.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
5 267
Read events
5 255
Write events
12
Delete events
0

Modification events

(PID) Process:(2144) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2144) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2144) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2144) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(2144) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2144) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2144) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2144) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3264) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3264) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
Executable files
31
Suspicious files
18
Text files
14
Unknown types
0

Dropped files

PID
Process
Filename
Type
2144WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2144.34036\论坛专版免杀.rarcompressed
MD5:9B8B625D73F60BB66628F852A6CDA8E0
SHA256:A06D40CBA186D1FAF28DAD922E9D047F7877AE0DCA0ED20B2B4D22F537D25EC1
2144WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2144.34036\中国黑客组织VIP专版远程控制.rarcompressed
MD5:F579D4BC1D892EE7CED9BBC45126EF5E
SHA256:4640650BF5A53AC9EBFB6DB63E07923A2A14D868C46278AA1E8B77BC43713DAC
2144WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2144.34036\Black World DDOSV1.3日月神教专版.rarcompressed
MD5:A1F08BBE3A571FEBBCD06AA36AD1924C
SHA256:73C0D29BDA4644922F5B3AF482DA01CBAE4F7D0E8383488B232F8DC6EB1EB36B
2144WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2144.34036\中国黑客组织第六版.rarcompressed
MD5:718CB9E80BDD4755317CE10F9AFEA0DD
SHA256:E8964A5E99B45EC3D52C7F579B3E10FEA7207E206F8DCB58D885AA38C5AC47AF
2144WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2144.34036\Sword beta 3.0.rarcompressed
MD5:8EFEA927552F00AB1D438C30BC7B2807
SHA256:D162E5EF706C5B4640CF196BAFB4AE68AB41A62B2596AFC063C164493C850CC7
3264WinRAR.exeC:\Users\admin\Desktop\Black World DDOSV1.3日月神教专版\Black World.exeexecutable
MD5:B8678094AF229486DEB00D682CCC3DAC
SHA256:224E121154EBD7D37B868BDD44D35B2DC9E68F5A5CA904764818CB6E229045C3
3264WinRAR.exeC:\Users\admin\Desktop\Black World DDOSV1.3日月神教专版\Black World.initext
MD5:1B39DEBA33CA8A0C4236EECE9C8BEB04
SHA256:0A81395AB235EEB3CE1F4F48BADBF051E7A0C4D493A9264AE270AEE55E32EFD9
3264WinRAR.exeC:\Users\admin\Desktop\Black World DDOSV1.3日月神教专版\hzdg.datexecutable
MD5:398D9F89AC61AA7C540B3FDE70731947
SHA256:A816535085D90D5D352653D5D2ECB06E4CA70C352042B514F179B1E14D0EC4B9
2144WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2144.34036\bin.rarcompressed
MD5:B0F25F491EBB3D3EC12A6A7DA20494C9
SHA256:62C9322D3A72CE94AA4E6070CBE7F3D01D815BF1EC99BD7E3E3912F071FB96FE
2144WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2144.34036\中国黑客组织第五版.rarcompressed
MD5:BC41641A2BF454266E3701827176D4BB
SHA256:345A2134F59530035922FABA52D8030B22FB25BE364BFFD32B783C52AC610F3B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
New folder.rar