| File name: | HiJackThis.zip |
| Full analysis: | https://app.any.run/tasks/c0d32f48-d481-481e-895a-5bd1179ca832 |
| Verdict: | Malicious activity |
| Threats: | Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. |
| Analysis date: | March 02, 2024, 19:14:16 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v2.0 to extract, compression method=store |
| MD5: | C35031AD91B40D26EEC3D444450585A3 |
| SHA1: | 65398DF885DD55658CC44B416ADDFEC2843D1927 |
| SHA256: | 5BA823158805BF3C5E9DD3CF2209FCD5BD08F329A5A01A6F532ED45FF9531BD5 |
| SSDEEP: | 98304:7lQKWHXs7y+MLu3wYlVQxKuJ7jKXAbcag//+F7uPsFISZixdaPY4xT5Tq3Tsy3uy:TIgqkhJ/qEz |
MALICIOUS
Drops the executable file immediately after the start
- WinRAR.exe (PID: 4052)
Steals credentials
- abr.exe (PID: 3324)
SUSPICIOUS
Reads settings of System Certificates
- HiJackThis.exe (PID: 2340)
Reads security settings of Internet Explorer
- HiJackThis.exe (PID: 2340)
Reads the date of Windows installation
- HiJackThis.exe (PID: 2340)
Adds/modifies Windows certificates
- HiJackThis.exe (PID: 2340)
Reads the Internet Settings
- HiJackThis.exe (PID: 2340)
Read startup parameters
- HiJackThis.exe (PID: 2340)
Executes as Windows Service
- VSSVC.exe (PID: 968)
Checks Windows Trust Settings
- HiJackThis.exe (PID: 2340)
INFO
Manual execution by a user
- HiJackThis.exe (PID: 2852)
- HiJackThis.exe (PID: 2340)
- abr.exe (PID: 3324)
- explorer.exe (PID: 2440)
- abr.exe (PID: 1560)
Executable content was dropped or overwritten
- WinRAR.exe (PID: 4052)
Reads the computer name
- HiJackThis.exe (PID: 2340)
- abr.exe (PID: 3324)
Reads product name
- HiJackThis.exe (PID: 2340)
Checks supported languages
- HiJackThis.exe (PID: 2340)
- abr.exe (PID: 3324)
Reads the machine GUID from the registry
- HiJackThis.exe (PID: 2340)
Reads Environment values
- HiJackThis.exe (PID: 2340)
Create files in a temporary directory
- HiJackThis.exe (PID: 2340)
Process checks whether UAC notifications are on
- HiJackThis.exe (PID: 2340)
Checks proxy server information
- HiJackThis.exe (PID: 2340)
Reads the software policy settings
- HiJackThis.exe (PID: 2340)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .zip | | | ZIP compressed archive (100) |
|---|
EXIF
ZIP
| ZipRequiredVersion: | 20 |
|---|---|
| ZipBitFlag: | - |
| ZipCompression: | None |
| ZipModifyDate: | 2024:01:28 18:59:38 |
| ZipCRC: | 0x00000000 |
| ZipCompressedSize: | - |
| ZipUncompressedSize: | - |
| ZipFileName: | apps/ |
Total processes
58
Monitored processes
11
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 968 | C:\Windows\system32\vssvc.exe | C:\Windows\System32\VSSVC.exe | — | services.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft® Volume Shadow Copy Service Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1560 | "C:\Users\admin\AppData\Local\Temp\HiJackThis\apps\abr.exe" | C:\Users\admin\AppData\Local\Temp\HiJackThis\apps\abr.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: Autobackup registry Exit code: 3221226540 Version: 1.2.0.0 Modules
| |||||||||||||||
| 1740 | C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding | C:\Windows\explorer.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2096 | C:\Windows\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801} | C:\Windows\System32\dllhost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: COM Surrogate Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2184 | "C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\Temp\HiJackThis\HiJackThis.log | C:\Windows\System32\notepad.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Notepad Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2340 | "C:\Users\admin\AppData\Local\Temp\HiJackThis\HiJackThis.exe" | C:\Users\admin\AppData\Local\Temp\HiJackThis\HiJackThis.exe | explorer.exe | ||||||||||||
User: admin Company: Alex Dragokas & Trend Micro Inc. Integrity Level: HIGH Description: Creates a report of non-standard parameters of registry and file system for selectively removal of items related to the activities of malware and security risks Exit code: 0 Version: 3.04.0006 Modules
| |||||||||||||||
| 2440 | "C:\Windows\explorer.exe" C:\Users\admin\AppData\Local\Temp\HiJackThis\HiJackThis.log | C:\Windows\explorer.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2488 | "C:\Windows\system32\bcdedit.exe" /enum | C:\Windows\System32\bcdedit.exe | — | abr.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Boot Configuration Data Editor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2852 | "C:\Users\admin\AppData\Local\Temp\HiJackThis\HiJackThis.exe" | C:\Users\admin\AppData\Local\Temp\HiJackThis\HiJackThis.exe | — | explorer.exe | |||||||||||
User: admin Company: Alex Dragokas & Trend Micro Inc. Integrity Level: MEDIUM Description: Creates a report of non-standard parameters of registry and file system for selectively removal of items related to the activities of malware and security risks Exit code: 3221226540 Version: 3.04.0006 Modules
| |||||||||||||||
| 3324 | "C:\Users\admin\AppData\Local\Temp\HiJackThis\apps\abr.exe" | C:\Users\admin\AppData\Local\Temp\HiJackThis\apps\abr.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: HIGH Description: Autobackup registry Exit code: 0 Version: 1.2.0.0 Modules
| |||||||||||||||
Total events
201 133
Read events
201 057
Write events
65
Delete events
11
Modification events
| (PID) Process: | (4052) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (4052) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (4052) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (4052) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 3 |
Value: C:\Users\admin\Desktop\phacker.zip | |||
| (PID) Process: | (4052) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\Win7-KB3191566-x86.zip | |||
| (PID) Process: | (4052) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip | |||
| (PID) Process: | (4052) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\HiJackThis.zip | |||
| (PID) Process: | (4052) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (4052) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (4052) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
Executable files
3
Suspicious files
17
Text files
2
Unknown types
1
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3324 | abr.exe | C:\Windows\ABR\2024-03-02\SYSTEM | — | |
MD5:— | SHA256:— | |||
| 3324 | abr.exe | C:\Windows\ABR\2024-03-02\SOFTWARE | — | |
MD5:— | SHA256:— | |||
| 3324 | abr.exe | C:\Windows\ABR\2024-03-02\COMPONENTS | — | |
MD5:— | SHA256:— | |||
| 4052 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\HiJackThis\apps\VBCCR17.OCX | executable | |
MD5:E7AAA82F0A491FE4CF7603038758AF41 | SHA256:B8D73BC915D8C617204979588F788F5DCD90D30DF026AFE9BDE5FE3C39E36DCC | |||
| 3324 | abr.exe | C:\Windows\ABR\2024-03-02\S-1-5-20\NTUSER.DAT | binary | |
MD5:45C7FDB69FD0201C8F356F1CC711E0CC | SHA256:ED515924354F35C8CCA042058DFD96DFC00EAEA754904055C23DA8065DC614C7 | |||
| 3324 | abr.exe | C:\Windows\ABR\2024-03-02\SECURITY | binary | |
MD5:E73EF49DB4A31ED38C3AB6B810422E02 | SHA256:C654580F80C8890716E7DF91D83AE75F1703C660E64889CF7E081CF596E40800 | |||
| 3324 | abr.exe | C:\Windows\ABR\2024-03-02\S-1-5-21-1302019708-1500728564-335382590-1000\NTUSER.DAT | binary | |
MD5:629BD7D1E81734ADE9B284CEB0C40668 | SHA256:30B1D1D2AAA28BBD878A1A0338207A88D5395F1BF983C0E1C29760A1AF166782 | |||
| 3324 | abr.exe | C:\Windows\ABR\2024-03-02\S-1-5-21-1302019708-1500728564-335382590-500\NTUSER.DAT.txt | binary | |
MD5:16B6D7D991B0943782B3371A937FB8B0 | SHA256:F305B167858986640563EC15F1C08D43264E59694BFC44D9EE011FE4EE8FDB91 | |||
| 3324 | abr.exe | C:\Windows\ABR\2024-03-02\S-1-5-19\NTUSER.DAT.txt | binary | |
MD5:650AABCE16E6A48F3C15E0B5DF6E352D | SHA256:489FB6048D6BD2E838675E480C21A44A3A7DC03F077AA6B7249302C7BA8D7AFE | |||
| 3324 | abr.exe | C:\Windows\ABR\2024-03-02\DEFAULT | binary | |
MD5:B18A752B4A378D2B22CA4F385AD3A03E | SHA256:FED302C9D3A253AAF163CE2DF6D0EB0F1272A0DD70F914DB90505679CDFF0C72 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |