File name:

64.rar

Full analysis: https://app.any.run/tasks/6354088f-e568-4aaf-97a8-5ebe856767c4
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Malware Trends Tracker     >>>
Analysis date: December 02, 2023, 21:15:23
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
unruy
trojan
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

DD37496DE752DEAE538E682CA673AEB0

SHA1:

2C691B5F56D6959BB5F81EABE81C598D374CF7EB

SHA256:

57E30F68B6E8AAC28DCEEC324E3D1DD04B8FB0EFC954D0FC116115F6C0C4BCA4

SSDEEP:

98304:AjOLYolL7PFOctg4fKHHCCO6PQQrt6XehRltDWu7CZlC72HvKPeioO9T6UlZ3ZK4:7+awelfbnzG1YZpHiK14

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • 48397f3def7293d8a7a07ad7f8e09492.exe (PID: 2424)
      • 2ffd9fa87324f42d52e7c325ba246bfa.exe (PID: 2928)
      • 3bc0bcdb43b5f742d25984144e94ada9.exe (PID: 1560)
      • 332f837976ce39747ceb1e36b572b84f.exe (PID: 3312)
      • qswpf.exe (PID: 3448)
      • b1bea821f505496a0207f8b0a4fc0b19.exe (PID: 3268)
      • inbuxzyre.exe (PID: 3220)
      • b15a0a575b3df7e7a6c17456f997bd9d.exe (PID: 3876)

    • Creates a writable file in the system directory

      • 2ffd9fa87324f42d52e7c325ba246bfa.exe (PID: 2928)
      • b15a0a575b3df7e7a6c17456f997bd9d.exe (PID: 3876)

    • Changes the autorun value in the registry

      • qswpf.exe (PID: 2968)

    • UNRUY has been detected (SURICATA)

      • 9b39f2feb680faf5f7dd512445f9f625.exe (PID: 2728)

    • Connects to the CnC server

      • 9b39f2feb680faf5f7dd512445f9f625.exe (PID: 2728)
      • svchost.exe (PID: 2220)

    • Changes appearance of the Explorer extensions

      • ad05ec1c43b0ba980eb458a936909967.exe (PID: 3576)

  • SUSPICIOUS

    • Reads the Internet Settings

      • 3bc0bcdb43b5f742d25984144e94ada9.exe (PID: 1560)
      • Setup.exe (PID: 2444)
      • b449f05d5ce1ab0c875f9924496d2c1c.exe (PID: 3604)

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 3060)
      • b15a0a575b3df7e7a6c17456f997bd9d.exe (PID: 3876)
      • inbuxzyre.exe (PID: 3220)

    • The process creates files with name similar to system file names

      • 2ffd9fa87324f42d52e7c325ba246bfa.exe (PID: 2928)

    • Starts itself from another location

      • 48397f3def7293d8a7a07ad7f8e09492.exe (PID: 2424)
      • 3bc0bcdb43b5f742d25984144e94ada9.exe (PID: 1560)
      • b15a0a575b3df7e7a6c17456f997bd9d.exe (PID: 3876)

    • Starts application with an unusual extension

      • 48397f3def7293d8a7a07ad7f8e09492.exe (PID: 2424)

    • The process checks if it is being run in the virtual environment

      • Setup.exe (PID: 2444)

    • Checks Windows Trust Settings

      • b449f05d5ce1ab0c875f9924496d2c1c.exe (PID: 3604)

    • Reads security settings of Internet Explorer

      • b449f05d5ce1ab0c875f9924496d2c1c.exe (PID: 3604)

    • Reads settings of System Certificates

      • b449f05d5ce1ab0c875f9924496d2c1c.exe (PID: 3604)

  • INFO

    • Manual execution by a user

      • 2ffd9fa87324f42d52e7c325ba246bfa.exe (PID: 2464)
      • 2ffd9fa87324f42d52e7c325ba246bfa.exe (PID: 2928)
      • 3bc0bcdb43b5f742d25984144e94ada9.exe (PID: 1560)
      • 788158bc2319cc2b5fa2df8d969b2446.exe (PID: 2544)
      • 3ee442a6031bf56b86715fe1d778925a.exe (PID: 2896)
      • 9b39f2feb680faf5f7dd512445f9f625.exe (PID: 2728)
      • 332f837976ce39747ceb1e36b572b84f.exe (PID: 3312)
      • 4e7dc7f446e06d90acdcaf078d59e873.exe (PID: 880)
      • b449f05d5ce1ab0c875f9924496d2c1c.exe (PID: 4016)
      • b449f05d5ce1ab0c875f9924496d2c1c.exe (PID: 3604)
      • 3ee442a6031bf56b86715fe1d778925a.exe (PID: 2808)
      • 4e7dc7f446e06d90acdcaf078d59e873.exe (PID: 3984)
      • 9b39f2feb680faf5f7dd512445f9f625.exe (PID: 1496)
      • 332f837976ce39747ceb1e36b572b84f.exe (PID: 4080)
      • 332f837976ce39747ceb1e36b572b84f.exe (PID: 944)
      • aac77134b932eb7d3e8e1ee9949a956a.exe (PID: 3124)
      • b15a0a575b3df7e7a6c17456f997bd9d.exe (PID: 3260)
      • b15a0a575b3df7e7a6c17456f997bd9d.exe (PID: 3876)
      • ad05ec1c43b0ba980eb458a936909967.exe (PID: 3576)
      • b1bea821f505496a0207f8b0a4fc0b19.exe (PID: 3268)
      • 48397f3def7293d8a7a07ad7f8e09492.exe (PID: 2424)
      • wmpnscfg.exe (PID: 2748)

    • Checks supported languages

      • 48397f3def7293d8a7a07ad7f8e09492.exe (PID: 2424)
      • 3bc0bcdb43b5f742d25984144e94ada9.exe (PID: 1560)
      • 788158bc2319cc2b5fa2df8d969b2446.exe (PID: 2544)
      • 97A0.tmp (PID: 2300)
      • Setup.exe (PID: 2444)
      • svchost.exe (PID: 2220)
      • 4e7dc7f446e06d90acdcaf078d59e873.exe (PID: 880)
      • 9b39f2feb680faf5f7dd512445f9f625.exe (PID: 2728)
      • 332f837976ce39747ceb1e36b572b84f.exe (PID: 3312)
      • qswpf.exe (PID: 3448)
      • qswpf.exe (PID: 2968)
      • 3ee442a6031bf56b86715fe1d778925a.exe (PID: 2896)
      • 332f837976ce39747ceb1e36b572b84f.exe (PID: 4080)
      • b449f05d5ce1ab0c875f9924496d2c1c.exe (PID: 3604)
      • 3ee442a6031bf56b86715fe1d778925a.exe (PID: 2808)
      • 4e7dc7f446e06d90acdcaf078d59e873.exe (PID: 3984)
      • 9b39f2feb680faf5f7dd512445f9f625.exe (PID: 1496)
      • 332f837976ce39747ceb1e36b572b84f.exe (PID: 944)
      • b15a0a575b3df7e7a6c17456f997bd9d.exe (PID: 3876)
      • b1bea821f505496a0207f8b0a4fc0b19.exe (PID: 3268)
      • aac77134b932eb7d3e8e1ee9949a956a.exe (PID: 3124)
      • ad05ec1c43b0ba980eb458a936909967.exe (PID: 3576)
      • b1bea821f505496a0207f8b0a4fc0b19.exe (PID: 3560)
      • inbuxzyre.exe (PID: 3220)
      • 2ffd9fa87324f42d52e7c325ba246bfa.exe (PID: 2928)
      • wmpnscfg.exe (PID: 2748)

    • Reads the computer name

      • 3bc0bcdb43b5f742d25984144e94ada9.exe (PID: 1560)
      • 2ffd9fa87324f42d52e7c325ba246bfa.exe (PID: 2928)
      • svchost.exe (PID: 2220)
      • Setup.exe (PID: 2444)
      • 4e7dc7f446e06d90acdcaf078d59e873.exe (PID: 880)
      • 332f837976ce39747ceb1e36b572b84f.exe (PID: 3312)
      • 9b39f2feb680faf5f7dd512445f9f625.exe (PID: 2728)
      • 332f837976ce39747ceb1e36b572b84f.exe (PID: 4080)
      • b449f05d5ce1ab0c875f9924496d2c1c.exe (PID: 3604)
      • 4e7dc7f446e06d90acdcaf078d59e873.exe (PID: 3984)
      • 332f837976ce39747ceb1e36b572b84f.exe (PID: 944)
      • b15a0a575b3df7e7a6c17456f997bd9d.exe (PID: 3876)
      • b1bea821f505496a0207f8b0a4fc0b19.exe (PID: 3560)
      • wmpnscfg.exe (PID: 2748)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3060)

    • Checks proxy server information

      • 3bc0bcdb43b5f742d25984144e94ada9.exe (PID: 1560)
      • Setup.exe (PID: 2444)
      • b449f05d5ce1ab0c875f9924496d2c1c.exe (PID: 3604)

    • Creates files or folders in the user directory

      • 788158bc2319cc2b5fa2df8d969b2446.exe (PID: 2544)
      • qswpf.exe (PID: 3448)
      • qswpf.exe (PID: 2968)
      • b449f05d5ce1ab0c875f9924496d2c1c.exe (PID: 3604)

    • Reads the machine GUID from the registry

      • 3bc0bcdb43b5f742d25984144e94ada9.exe (PID: 1560)
      • Setup.exe (PID: 2444)
      • b449f05d5ce1ab0c875f9924496d2c1c.exe (PID: 3604)
      • b1bea821f505496a0207f8b0a4fc0b19.exe (PID: 3560)

    • Create files in a temporary directory

      • 3bc0bcdb43b5f742d25984144e94ada9.exe (PID: 1560)
      • 9b39f2feb680faf5f7dd512445f9f625.exe (PID: 2728)
      • b15a0a575b3df7e7a6c17456f997bd9d.exe (PID: 3876)
      • inbuxzyre.exe (PID: 3220)

    • Creates files in the program directory

      • 4e7dc7f446e06d90acdcaf078d59e873.exe (PID: 880)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
80
Monitored processes
30
Malicious processes
4
Suspicious processes
9

Behavior graph

Click at the process to see the details
start winrar.exe no specs 2ffd9fa87324f42d52e7c325ba246bfa.exe no specs 2ffd9fa87324f42d52e7c325ba246bfa.exe 3bc0bcdb43b5f742d25984144e94ada9.exe no specs 48397f3def7293d8a7a07ad7f8e09492.exe no specs 788158bc2319cc2b5fa2df8d969b2446.exe no specs 97a0.tmp no specs svchost.exe setup.exe 4e7dc7f446e06d90acdcaf078d59e873.exe no specs 3ee442a6031bf56b86715fe1d778925a.exe no specs #UNRUY 9b39f2feb680faf5f7dd512445f9f625.exe 332f837976ce39747ceb1e36b572b84f.exe no specs qswpf.exe no specs qswpf.exe 332f837976ce39747ceb1e36b572b84f.exe no specs b449f05d5ce1ab0c875f9924496d2c1c.exe no specs b449f05d5ce1ab0c875f9924496d2c1c.exe 3ee442a6031bf56b86715fe1d778925a.exe no specs 4e7dc7f446e06d90acdcaf078d59e873.exe no specs 9b39f2feb680faf5f7dd512445f9f625.exe no specs 332f837976ce39747ceb1e36b572b84f.exe no specs aac77134b932eb7d3e8e1ee9949a956a.exe no specs ad05ec1c43b0ba980eb458a936909967.exe no specs b1bea821f505496a0207f8b0a4fc0b19.exe no specs b15a0a575b3df7e7a6c17456f997bd9d.exe no specs b15a0a575b3df7e7a6c17456f997bd9d.exe b1bea821f505496a0207f8b0a4fc0b19.exe no specs inbuxzyre.exe wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
880"C:\Users\admin\Desktop\4e7dc7f446e06d90acdcaf078d59e873.exe" C:\Users\admin\Desktop\4e7dc7f446e06d90acdcaf078d59e873.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Mira Malware
Exit code:
0
Version:
1.0.0.155
Modules
Images
c:\users\admin\desktop\4e7dc7f446e06d90acdcaf078d59e873.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
944"C:\Users\admin\Desktop\332f837976ce39747ceb1e36b572b84f.exe" C:\Users\admin\Desktop\332f837976ce39747ceb1e36b572b84f.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Mira Malware
Exit code:
0
Version:
1.0.0.155
Modules
Images
c:\users\admin\desktop\332f837976ce39747ceb1e36b572b84f.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1496"C:\Users\admin\Desktop\9b39f2feb680faf5f7dd512445f9f625.exe" C:\Users\admin\Desktop\9b39f2feb680faf5f7dd512445f9f625.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\9b39f2feb680faf5f7dd512445f9f625.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mfc42.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1560"C:\Users\admin\Desktop\3bc0bcdb43b5f742d25984144e94ada9.exe" C:\Users\admin\Desktop\3bc0bcdb43b5f742d25984144e94ada9.exe—explorer.exe
User:
admin
Company:
Download Assistant
Integrity Level:
MEDIUM
Description:
PHILIPS LX3750W user guide
Exit code:
1
Version:
3.0.0.134
Modules
Images
c:\users\admin\desktop\3bc0bcdb43b5f742d25984144e94ada9.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\advapi32.dll
2220"C:\Windows\System32\yROwJA\svchost.exe"C:\Windows\System32\yROwJA\svchost.exe
2ffd9fa87324f42d52e7c325ba246bfa.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\windows\system32\yrowja\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2300"C:\Users\admin\AppData\Local\Temp\97A0.tmp"C:\Users\admin\AppData\Local\Temp\97A0.tmp—48397f3def7293d8a7a07ad7f8e09492.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\users\admin\appdata\local\temp\97a0.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2424"C:\Users\admin\Desktop\48397f3def7293d8a7a07ad7f8e09492.exe" C:\Users\admin\Desktop\48397f3def7293d8a7a07ad7f8e09492.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\users\admin\desktop\48397f3def7293d8a7a07ad7f8e09492.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2444"C:\Users\admin\AppData\Local\Temp\a2FbemoAaM\16LCKu7Q\Setup.exe" --relaunchC:\Users\admin\AppData\Local\Temp\a2FbemoAaM\16LCKu7Q\Setup.exe
3bc0bcdb43b5f742d25984144e94ada9.exe
User:
admin
Company:
Download Assistant
Integrity Level:
HIGH
Description:
PHILIPS LX3750W user guide
Exit code:
1
Version:
3.0.0.134
Modules
Images
c:\users\admin\appdata\local\temp\a2fbemoaam\16lcku7q\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
2464"C:\Users\admin\Desktop\2ffd9fa87324f42d52e7c325ba246bfa.exe" C:\Users\admin\Desktop\2ffd9fa87324f42d52e7c325ba246bfa.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\2ffd9fa87324f42d52e7c325ba246bfa.exe
c:\windows\system32\ntdll.dll
2544"C:\Users\admin\Desktop\788158bc2319cc2b5fa2df8d969b2446.exe" C:\Users\admin\Desktop\788158bc2319cc2b5fa2df8d969b2446.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
2
Modules
Images
c:\users\admin\desktop\788158bc2319cc2b5fa2df8d969b2446.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
9 059
Read events
8 931
Write events
124
Delete events
4

Modification events

(PID) Process:(3060) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1560) 3bc0bcdb43b5f742d25984144e94ada9.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1560) 3bc0bcdb43b5f742d25984144e94ada9.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
26
Suspicious files
8
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
3060WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3060.22112\48397f3def7293d8a7a07ad7f8e09492.exeexecutable
MD5:48397F3DEF7293D8A7A07AD7F8E09492
SHA256:9676FB4AFA6F8DC39C969E424B0ACDC1AD73386C3477413B79B462C052A918E5
3060WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3060.22112\aac77134b932eb7d3e8e1ee9949a956a.exeexecutable
MD5:AAC77134B932EB7D3E8E1EE9949A956A
SHA256:AC40534FCFD60CAD11D69AE28B501F30EEEA2ABD804942EEEB3E3E4F83B46653
3060WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3060.22112\b449f05d5ce1ab0c875f9924496d2c1c.exeexecutable
MD5:B449F05D5CE1AB0C875F9924496D2C1C
SHA256:60D1ED3171A612F0CBFECA3127CE639E9D5D2AFAE404648ACC2589AE7EDB84C5
3060WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3060.22112\2ffd9fa87324f42d52e7c325ba246bfa.exeexecutable
MD5:2FFD9FA87324F42D52E7C325BA246BFA
SHA256:CDDC4382A30A9304C44A51CD858DA6951E950F52F61112885857506AD58437B3
3060WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3060.22112\4e7dc7f446e06d90acdcaf078d59e873.exeexecutable
MD5:4E7DC7F446E06D90ACDCAF078D59E873
SHA256:DDD6D6837E3F64E600FA5657F4799D1F4DE13D8F07E5A33AA53B4C70CA98919A
3060WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3060.22112\4202fbc100973cd6e7aedbc5710adbfb.exeexecutable
MD5:4202FBC100973CD6E7AEDBC5710ADBFB
SHA256:38253B764A8AF6348A8A0A820AC0BCC29FE14903A1FA002EB3DFC4D933E97051
3060WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3060.22112\3bc0bcdb43b5f742d25984144e94ada9.exeexecutable
MD5:3BC0BCDB43B5F742D25984144E94ADA9
SHA256:B19A2FDA4E2751125E67516B4B4EB35C6EFF66758011B12292F0778DDE2F0CA9
3060WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3060.22112\b15a0a575b3df7e7a6c17456f997bd9d.exeexecutable
MD5:B15A0A575B3DF7E7A6C17456F997BD9D
SHA256:A718CDB03CCF6EE3EFB1035D368FD326DD68BE6920504D201C20568EA3986289
29282ffd9fa87324f42d52e7c325ba246bfa.exeC:\Windows\DwFpOBMr.dlltext
MD5:EE0CCFB95652643D2EB7A54701A6A39E
SHA256:93E0E229751CFF7F2171967DC97DA309573D469A58D8F8BA46109E63E2EDD980
2544788158bc2319cc2b5fa2df8d969b2446.exeC:\Users\admin\AppData\Local\VirtualStore\marijuana.txttext
MD5:C0214C7723FE7BDE6BC2834742BCC506
SHA256:A1E88659A4AD4F4FD55F246AB076DEE048881FCAC3EA8A300E2FE8CDFFD88B73
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
14
DNS requests
20
Threats
23

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2220
svchost.exe
GET
404
119.97.143.63:80
http://cnwx.58ad.cn/index/getcfg?id=2
unknown
html
168 b
unknown
3604
b449f05d5ce1ab0c875f9924496d2c1c.exe
GET
301
101.226.28.186:80
http://www.upan.cc/pay/chipeasy/ce1.txt
unknown
html
262 b
unknown
—
—
GET
200
2.19.198.162:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?3f026084f2f57876
unknown
compressed
4.66 Kb
unknown
3604
b449f05d5ce1ab0c875f9924496d2c1c.exe
GET
200
104.18.20.226:80
http://ocsp.globalsign.com/rootr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEH1NQqkrQx1%2BZFPnwZqNWHc%3D
unknown
binary
1.41 Kb
unknown
3604
b449f05d5ce1ab0c875f9924496d2c1c.exe
GET
200
104.18.20.226:80
http://ocsp.globalsign.com/alphasslcasha256g4/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBSPdwLcDiHQXlVfp8h37hrpMerTggQUT8usqMLvq92Db2u%2Fzpg9XFgldhUCDF%2B0c54hKta1uXF%2BQA%3D%3D
unknown
binary
1.40 Kb
unknown
2220
svchost.exe
GET
200
153.35.100.123:80
http://www.58sky.com/index/getcfg?id=2
unknown
binary
6.00 Kb
unknown
1080
svchost.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?d3b771b78e4ef5fc
unknown
compressed
65.2 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
2728
9b39f2feb680faf5f7dd512445f9f625.exe
107.178.223.183:53
ns.dns3-domain.com
—
—
unknown
3604
b449f05d5ce1ab0c875f9924496d2c1c.exe
101.226.28.186:80
www.upan.cc
China Telecom Group
CN
unknown
2220
svchost.exe
119.97.143.63:80
cnwx.58ad.cn
Chinanet
CN
unknown
3604
b449f05d5ce1ab0c875f9924496d2c1c.exe
101.226.28.186:443
www.upan.cc
China Telecom Group
CN
unknown
3604
b449f05d5ce1ab0c875f9924496d2c1c.exe
2.19.198.162:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
3604
b449f05d5ce1ab0c875f9924496d2c1c.exe
104.18.20.226:80
ocsp.globalsign.com
CLOUDFLARENET
—
shared

DNS requests

Domain
IP
Reputation
download1.installbay.lrplpawkrs.com
  • —
unknown
wx.go890.com
  • —
unknown
ns.dns3-domain.com
  • 107.178.223.183
  • 104.155.138.21
unknown
www.upan.cc
  • 101.226.28.186
  • 101.226.28.188
  • 101.226.28.187
  • 101.226.28.183
  • 101.226.28.184
  • 101.226.28.148
  • 101.226.28.185
  • 101.226.28.182
unknown
cnwx.58ad.cn
  • 119.97.143.63
unknown
www.58sky.com
  • 153.35.100.123
  • 36.248.64.126
  • 42.7.60.117
  • 175.43.23.80
  • 42.7.60.123
  • 36.248.64.52
  • 61.243.13.101
  • 36.248.64.54
  • 175.43.23.247
  • 36.248.64.77
  • 202.97.231.60
  • 175.43.23.67
  • 42.7.60.207
unknown
ctldl.windowsupdate.com
  • 2.19.198.162
  • 2.19.198.160
  • 93.184.221.240
whitelisted
ocsp.globalsign.com
  • 104.18.20.226
  • 104.18.21.226
whitelisted
wdx.go890.com
  • —
unknown
www.go890.com
  • —
unknown

Threats

PID
Process
Class
Message
1080
svchost.exe
A Network Trojan was detected
ET MALWARE Win32/Delf.TJJ CnC Domain in DNS Lookup (wx .go890 .com)
1080
svchost.exe
A Network Trojan was detected
ET MALWARE Win32/Delf.TJJ CnC Domain in DNS Lookup (wx .go890 .com)
2728
9b39f2feb680faf5f7dd512445f9f625.exe
Potential Corporate Privacy Violation
ET DNS Non-DNS or Non-Compliant DNS traffic on DNS port Opcode 6 or 7 set
1080
svchost.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
1080
svchost.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
1080
svchost.exe
A Network Trojan was detected
ET MALWARE Win32/Delf.TJJ CnC Domain in DNS Lookup (cnwx .58ad .cn)
1080
svchost.exe
A Network Trojan was detected
ET MALWARE Win32/Delf.TJJ CnC Domain in DNS Lookup (cnwx .58ad .cn)
2220
svchost.exe
Malware Command and Control Activity Detected
ET MALWARE Win32/Delf.TJJ Variant CnC Activity
1080
svchost.exe
A Network Trojan was detected
ET MALWARE Win32/Delf.TJJ CnC Domain in DNS Lookup (www .58sky .com)
1080
svchost.exe
A Network Trojan was detected
ET MALWARE Win32/Delf.TJJ CnC Domain in DNS Lookup (www .58sky .com)
10 ETPRO signatures available at the full report
Process
Message
b15a0a575b3df7e7a6c17456f997bd9d.exe
PCRatStact
b15a0a575b3df7e7a6c17456f997bd9d.exe
µ½ACtiveX °²×°
b15a0a575b3df7e7a6c17456f997bd9d.exe
{A3F75BEA-01F6-4b39-847F-CA67AF3C2354}
b15a0a575b3df7e7a6c17456f997bd9d.exe
¿ªÆôÀëÏ߼Ǽ
b15a0a575b3df7e7a6c17456f997bd9d.exe
ACtiveX °²×°Íê±Ï
b15a0a575b3df7e7a6c17456f997bd9d.exe
icon=0
b15a0a575b3df7e7a6c17456f997bd9d.exe
C:\Windows\system32\inbuxzyre.exe_lang.ini
b15a0a575b3df7e7a6c17456f997bd9d.exe
u1ajHXZAyHBB3nhP4HTSHw==
b15a0a575b3df7e7a6c17456f997bd9d.exe
дÈëiniÎļþ
b15a0a575b3df7e7a6c17456f997bd9d.exe
ReleaseResource³É¹¦
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
64.rar