analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

attachments.rar

Full analysis: https://app.any.run/tasks/5816047b-2b5b-41a6-a43a-82630b764954
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Malware Trends Tracker     >>>
Analysis date: April 15, 2019, 13:22:12
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
Indicators:
MIME: application/octet-stream
File info: ACE archive data version 20, from Win/32, version 20 to extract, contains AV-String (unregistered), solid
MD5:

0FE5E07626042E39245206C27643A24E

SHA1:

F297BE7B444CF0F1630FDE039F68114F3E28BB56

SHA256:

5B2C7B05368D825A4F3B10D74074D0803234F918166436D3E48EF7F9FAF66461

SSDEEP:

24576:ad89hgiTbkwgYUITd89hgiTbkwgYLGKUQ8rXpua4nP6JDxewk/DiZnFvGcyk:NXg2kwIXg2kwD4pfqiJquFucB

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • winlog.exe (PID: 1524)
      • win.exe (PID: 2872)
      • winlog.exe (PID: 1532)
      • win.exe (PID: 3796)
      • config.exe (PID: 2396)
      • config.exe (PID: 2032)
      • config.exe (PID: 756)
      • config.exe (PID: 3144)

    • Writes to a start menu file

      • WinRAR.exe (PID: 2832)

    • Connects to CnC server

      • config.exe (PID: 2032)
      • config.exe (PID: 2396)
      • config.exe (PID: 756)
      • config.exe (PID: 3144)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2832)
      • win.exe (PID: 2872)
      • winlog.exe (PID: 1524)
      • winlog.exe (PID: 1532)

    • Creates files in the user directory

      • WinRAR.exe (PID: 2832)

    • Uses REG.EXE to modify Windows registry

      • cmd.exe (PID: 2488)
      • cmd.exe (PID: 3944)
      • cmd.exe (PID: 2900)
      • cmd.exe (PID: 3264)
      • cmd.exe (PID: 3568)
      • cmd.exe (PID: 1672)

    • Starts CMD.EXE for commands execution

      • winlog.exe (PID: 1524)
      • cmd.exe (PID: 3068)
      • winlog.exe (PID: 1532)
      • cmd.exe (PID: 3940)

    • Application launched itself

      • cmd.exe (PID: 3068)
      • cmd.exe (PID: 3940)

    • Uses SYSTEMINFO.EXE to read environment

      • cmd.exe (PID: 3068)
      • cmd.exe (PID: 3940)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 3068)
      • cmd.exe (PID: 3940)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • win.exe (PID: 2872)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.ace | ACE compressed archive (100)

EXIF

Composite

Megapixels: 1
ImageSize: 1200x842

JFIF

YResolution: 1
XResolution: 1
ResolutionUnit: None
JFIFVersion: 1.01
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
102
Monitored processes
60
Malicious processes
8
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start winrar.exe no specs explorer.exe no specs winrar.exe win.exe winlog.exe cmd.exe no specs cmd.exe no specs reg.exe no specs find.exe no specs cmd.exe no specs reg.exe no specs find.exe no specs cmd.exe no specs reg.exe no specs find.exe no specs cmd.exe no specs cmd.exe no specs systeminfo.exe no specs timeout.exe no specs win.exe no specs winlog.exe cmd.exe no specs cmd.exe no specs reg.exe no specs find.exe no specs cmd.exe no specs reg.exe no specs find.exe no specs cmd.exe no specs reg.exe no specs find.exe no specs cmd.exe no specs cmd.exe no specs systeminfo.exe no specs timeout.exe no specs PhotoViewer.dll no specs ping.exe no specs taskkill.exe no specs config.exe ping.exe no specs timeout.exe no specs ping.exe no specs taskkill.exe no specs config.exe timeout.exe no specs timeout.exe no specs ping.exe no specs timeout.exe no specs ping.exe no specs taskkill.exe no specs config.exe ping.exe no specs timeout.exe no specs ping.exe no specs taskkill.exe no specs config.exe timeout.exe no specs timeout.exe no specs ping.exe no specs timeout.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2504"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\attachments.rar"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
832"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2832"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Desktop\attachments.rar" C:\Users\admin\Desktop\attachments\C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
2872"C:\Users\admin\win.exe" -pfvthbrfycrbte,k.lrbC:\Users\admin\win.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
1524"C:\Users\admin\winlog.exe" C:\Users\admin\winlog.exe
win.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Email Microsoft Office Word
Version:
9.00.7600.16385
3068cmd /c ""C:\Users\admin\AppData\Local\Temp\7ZipSfx.000\5532.cmd" "C:\Windows\system32\cmd.exe—winlog.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2488C:\Windows\system32\cmd.exe /c Reg.exe Query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"|Find /I "ProxyServer"C:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1464Reg.exe Query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"C:\Windows\system32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3520Find /I "ProxyServer"C:\Windows\system32\find.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (grep) Utility
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3944C:\Windows\system32\cmd.exe /c Reg.exe Query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"|Find /I "ProxyUser"C:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Total events
2 236
Read events
2 178
Write events
0
Delete events
0

Modification events

No data
Executable files
4
Suspicious files
3
Text files
17
Unknown types
2

Dropped files

PID
Process
Filename
Type
2832WinRAR.exeC:\Users\admin\Desktop\attachments\3_òáótÑ¡¬«\òáótÑ¡¬« 伿Ga« éáß¿½i¬«ó¿t 06.01.1966.docxdocument
MD5:1D1DCA39D8CD0F8A6CF009E6413A65E0
SHA256:43A98942ABF662B939EE510B0393D6AB240E03EB5542E27402A6B4D4383A07AD
2832WinRAR.exeC:\Users\admin\Desktop\attachments\BAZA SPISOK\35975603230990.txttext
MD5:FBDDEEACBBFD3E6C194D3159076A5DFF
SHA256:03D105AD2E86CCA559B028A270DDC9265C6E8E4390E2554D75C4170AC34BD1A7
2832WinRAR.exeC:\Users\admin\Desktop\attachments\¡«¼Ñaá.txttext
MD5:9ED4782BDF729FE846B9B5DBE986D8DA
SHA256:9AFAE74AF9D461173365DB9BA95AE147E1139D0BF13468B1DB6B8ABECB2AC7AF
2832WinRAR.exeC:\Users\admin\desktop\Goggle Chrome.lnklnk
MD5:64C3556574DAA5BC76A5CEDE8F8BFCD7
SHA256:257F7F67C59EC8F3837C7E4C99B1DC20C5CD0273BD940BEEF46D5E641393BE37
2832WinRAR.exeC:\Users\admin\Desktop\attachments\BAZA SPISOK\35573706209564.txttext
MD5:DE8E2CD94221B05DC98DD36B670D24EF
SHA256:BC3274C18A43E8F900DD83A046EC9ADD7CB4B13F5DB86E6F9BE601E4CACEF12B
2832WinRAR.exeC:\Users\admin\win.exeexecutable
MD5:8EB98AAB56283B15FA93B88E5E19FD4E
SHA256:04ED2AD4FA67C8ABD635D34017C3D04813690A91282A0446C0505B2AF97CE48B
1532winlog.exeC:\Users\admin\AppData\Local\Temp\7ZipSfx.001\5532.cmdtext
MD5:1230098B9E09C55A4078CBF615CD9839
SHA256:F5B327E492BFADDDA0658B99E3412EBCA4D2B381476F53BF89B97FF9D43510B8
2832WinRAR.exeC:\Users\admin\Desktop\attachments\BAZA SPISOK\35257401912340.txttext
MD5:87C9DB368F19C97CBD93EBC3A1C2232A
SHA256:1B49B0BCF667F98F41BF1724A46C3A5DE973D6D2AE1E194D848EEEE1434A8D64
2832WinRAR.exeC:\Users\admin\Desktop\attachments\BAZA SPISOK\35824901472605.txttext
MD5:4F3ABB4829D309A0278BDA036D804750
SHA256:6082A7BB443A66BCB073DBF28B080052CDC343E8C4845E280C2638FA131432EA
2832WinRAR.exeC:\Users\admin\Desktop\attachments\380997533085\380997533085.txttext
MD5:7F213C01AAB3A387D27AE3BC7065CBAA
SHA256:4AF218580BE6F19005DAD5BC766039AA326C6A1724996AAC37BCFF286817F30B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
8
DNS requests
3
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3144
config.exe
POST
403
195.62.52.164:80
http://lisingrout.ddns.net/
RU
—
—
malicious
756
config.exe
POST
403
195.62.52.164:80
http://lisingrout.ddns.net/
RU
—
—
malicious
3144
config.exe
POST
403
195.62.52.164:80
http://lisingrout.ddns.net/
RU
—
—
malicious
2032
config.exe
POST
403
195.62.52.164:80
http://lisingrout.ddns.net/
RU
—
—
malicious
2032
config.exe
POST
403
195.62.52.164:80
http://lisingrout.ddns.net/
RU
—
—
malicious
2396
config.exe
POST
403
195.62.52.164:80
http://lisingrout.ddns.net/
RU
—
—
malicious
756
config.exe
POST
403
195.62.52.164:80
http://lisingrout.ddns.net/
RU
—
—
malicious
2396
config.exe
POST
403
195.62.52.164:80
http://lisingrout.ddns.net/
RU
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2396
config.exe
195.62.52.164:80
lisingrout.ddns.net
IT Expert LLC
RU
malicious
2032
config.exe
195.62.52.164:80
lisingrout.ddns.net
IT Expert LLC
RU
malicious
3144
config.exe
195.62.52.164:80
lisingrout.ddns.net
IT Expert LLC
RU
malicious
756
config.exe
195.62.52.164:80
lisingrout.ddns.net
IT Expert LLC
RU
malicious

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.207.46
whitelisted
lisingrout.ddns.net
  • 195.62.52.164
malicious

Threats

PID
Process
Class
Message
2396
config.exe
A Network Trojan was detected
MALWARE [PTsecurity] SystemInfo Exfiltration
2396
config.exe
A Network Trojan was detected
MALWARE [PTsecurity] Trojan/Win32.Skeeyah Data Exfil
2396
config.exe
A Network Trojan was detected
MALWARE [PTsecurity] SystemInfo Exfiltration
2396
config.exe
A Network Trojan was detected
MALWARE [PTsecurity] SystemInfo Exfiltration
2396
config.exe
A Network Trojan was detected
MALWARE [PTsecurity] Trojan/Win32.Skeeyah Data Exfil
2396
config.exe
A Network Trojan was detected
MALWARE [PTsecurity] SystemInfo Exfiltration
3144
config.exe
A Network Trojan was detected
MALWARE [PTsecurity] SystemInfo Exfiltration
3144
config.exe
A Network Trojan was detected
MALWARE [PTsecurity] Trojan/Win32.Skeeyah Data Exfil
3144
config.exe
A Network Trojan was detected
MALWARE [PTsecurity] SystemInfo Exfiltration
3144
config.exe
A Network Trojan was detected
MALWARE [PTsecurity] SystemInfo Exfiltration
8 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
attachments.rar