analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

DiscordHaxx 1.9 [BETA].zip

Full analysis: https://app.any.run/tasks/1fa73db3-479f-43fc-b240-a39cd02461e2
Verdict: Malicious activity
Analysis date: November 29, 2020, 13:21:54
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

A15C646C47F0D5E75104F316675F2E92

SHA1:

5A7E81849BE45B0E745BF46E554CCE4305E5EBB5

SHA256:

5ACEB2366B27F789FF7BF5AFF0AEC5EB3F4E2A52BE5CDB13D8767219BBFAE985

SSDEEP:

49152:2dH0zADOtKGLdhS7B7PO2tqdWi8BtJtvhA/Cyl77u:aHDDb8jc722QdWlX7v6N7u

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • DiscordHaxx.exe (PID: 2476)

  • SUSPICIOUS

    • Drops a file with too old compile date

      • WinRAR.exe (PID: 2536)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2536)

    • Drops a file that was compiled in debug mode

      • WinRAR.exe (PID: 2536)

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 2712)

  • INFO

    • Manual execution by user

      • opera.exe (PID: 3468)
      • opera.exe (PID: 1696)
      • opera.exe (PID: 3032)
      • chrome.exe (PID: 2712)

    • Creates files in the user directory

      • opera.exe (PID: 3468)

    • Reads the hosts file

      • chrome.exe (PID: 2712)
      • chrome.exe (PID: 2704)

    • Application launched itself

      • chrome.exe (PID: 2712)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: DiscordHaxx 1.9 [BETA]/
ZipUncompressedSize: -
ZipCompressedSize: -
ZipCRC: 0x00000000
ZipModifyDate: 2019:02:16 09:44:02
ZipCompression: None
ZipBitFlag: -
ZipRequiredVersion: 10
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
80
Monitored processes
44
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start winrar.exe opera.exe opera.exe no specs opera.exe no specs discordhaxx.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2536"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\DiscordHaxx 1.9 [BETA].zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3468"C:\Program Files\Opera\opera.exe" C:\Program Files\Opera\opera.exe
explorer.exe
User:
admin
Company:
Opera Software
Integrity Level:
MEDIUM
Description:
Opera Internet Browser
Exit code:
0
Version:
1748
1696"C:\Program Files\Opera\opera.exe" C:\Program Files\Opera\opera.exe—explorer.exe
User:
admin
Company:
Opera Software
Integrity Level:
MEDIUM
Description:
Opera Internet Browser
Exit code:
0
Version:
1748
3032"C:\Program Files\Opera\opera.exe" C:\Program Files\Opera\opera.exe—explorer.exe
User:
admin
Company:
Opera Software
Integrity Level:
MEDIUM
Description:
Opera Internet Browser
Exit code:
0
Version:
1748
2476"C:\Users\admin\AppData\Local\Temp\Rar$EXa2536.47836\DiscordHaxx 1.9 [BETA]\DiscordHaxx.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2536.47836\DiscordHaxx 1.9 [BETA]\DiscordHaxx.exe
WinRAR.exe
User:
admin
Company:
iLinked Software
Integrity Level:
MEDIUM
Description:
DiscordHaxx
Version:
1.8.5.0
2712"C:\Program Files\Google\Chrome\Application\chrome.exe" C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
3252"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=75.0.3770.100 --initial-client-data=0x7c,0x80,0x84,0x78,0x88,0x68e4a9d0,0x68e4a9e0,0x68e4a9ecC:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
1136"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=2708 --on-initialized-event-handle=324 --parent-handle=328 /prefetch:6C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
1952"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1040,8815488171577657586,7046136697343514410,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=11345844924677017324 --mojo-platform-channel-handle=972 --ignored=" --type=renderer " /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
75.0.3770.100
2704"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1040,8815488171577657586,7046136697343514410,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --service-request-channel-token=12784754180129880125 --mojo-platform-channel-handle=1660 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
Total events
1 023
Read events
871
Write events
0
Delete events
0

Modification events

No data
Executable files
7
Suspicious files
85
Text files
294
Unknown types
14

Dropped files

PID
Process
Filename
Type
3468opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\opr5EA4.tmp —
MD5:—
SHA256:—
3468opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\opr5EC4.tmp —
MD5:—
SHA256:—
3468opera.exeC:\Users\admin\AppData\Local\Opera\Opera\cache\sesn\opr00001.tmp —
MD5:—
SHA256:—
3468opera.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\3KNFZO1I3PFCQ4MX3L59.temp —
MD5:—
SHA256:—
3468opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\sessions\opr6760.tmp —
MD5:—
SHA256:—
3468opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\opr6761.tmp —
MD5:—
SHA256:—
3468opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\opr6762.tmp —
MD5:—
SHA256:—
3468opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\tasks.xmlxml
MD5:EB9910BA4BC848C595DFAE7526E7D51A
SHA256:13C5777A1753F8C78D4BD461EC549B432A254D11E2D233679B4829D200752524
3468opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\operaprefs.initext
MD5:C572930F426FA92816BC86138F5686E5
SHA256:915D8E0EAAE46DB90B0D8B0E432A122B82CB10FECDF56607C1FC28BF03DACAD0
3468opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\opssl6.datbinary
MD5:1941DB70BD8926E4E8A415693F9080D7
SHA256:9E4AA2BB56ABE81C96BE018457C5E5FF3D05187EEB6295767F591427D91352F9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
49
DNS requests
34
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2704
chrome.exe
GET
200
212.129.20.209:80
http://monip.org/
FR
html
285 b
malicious
3468
opera.exe
GET
200
93.184.220.29:80
http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl
US
der
592 b
whitelisted
2704
chrome.exe
GET
200
205.185.216.42:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
US
compressed
57.5 Kb
whitelisted
2704
chrome.exe
GET
404
212.129.20.209:80
http://monip.org/favicon.ico
FR
html
271 b
malicious
2704
chrome.exe
GET
304
205.185.216.42:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
US
compressed
57.5 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
104.23.99.190:443
pastebin.com
Cloudflare Inc
US
malicious
3468
opera.exe
93.184.220.29:80
crl4.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2704
chrome.exe
172.217.16.131:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
2704
chrome.exe
142.250.74.195:443
www.google.com.ua
Google Inc.
US
whitelisted
2704
chrome.exe
172.217.23.110:443
apis.google.com
Google Inc.
US
whitelisted
2704
chrome.exe
172.217.23.131:443
fonts.gstatic.com
Google Inc.
US
whitelisted
2704
chrome.exe
216.58.207.78:443
ogs.google.com.ua
Google Inc.
US
whitelisted
3468
opera.exe
185.26.182.93:443
certs.opera.com
Opera Software AS
—
whitelisted
—
—
172.217.21.202:443
fonts.googleapis.com
Google Inc.
US
whitelisted
2704
chrome.exe
172.217.22.110:443
clients2.google.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
certs.opera.com
  • 185.26.182.93
  • 185.26.182.94
whitelisted
crl4.digicert.com
  • 93.184.220.29
whitelisted
pastebin.com
  • 104.23.99.190
  • 104.23.98.190
shared
clientservices.googleapis.com
  • 172.217.16.131
whitelisted
accounts.google.com
  • 216.58.205.237
shared
www.google.com.ua
  • 142.250.74.195
whitelisted
fonts.googleapis.com
  • 172.217.21.202
whitelisted
www.gstatic.com
  • 172.217.16.131
whitelisted
fonts.gstatic.com
  • 172.217.23.131
whitelisted
apis.google.com
  • 172.217.23.110
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
DiscordHaxx 1.9 [BETA].zip