File name:

Payment Draft.cab

Full analysis: https://app.any.run/tasks/d15b0824-b57d-4606-9a1b-45186e28bea7
Verdict: Malicious activity
Threats:

Netwire is an advanced RAT — it is a malware that takes control of infected PCs and allows its operators to perform various actions. Unlike many RATs, this one can target every major operating system, including Windows, Linux, and MacOS.

Malware Trends Tracker     >>>
Analysis date: February 21, 2020, 16:13:46
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
autoit
trojan
netwire
Indicators:
MIME: application/vnd.ms-cab-compressed
File info: Microsoft Cabinet archive data, 1228569 bytes, 1 file
MD5:

2EE7627EE56D2B11D10D7D780D235F92

SHA1:

CF3469D31AB8FAC7FCA9B6D4513E57455310B410

SHA256:

6A80B05A4A59B8EE0E1985754F0FEA95D877E114C6B6BAE720CDDB57E8257874

SSDEEP:

24576:FY9vvaLd7j3tz4fTWjv+gEURlWACSf3bNiCWAXz6h3Bo661d7c/1RMWaMP3af0on:y9vvI7zyfTuxEUQCWSmhxo661dw/XMxX

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • RegSvcs.exe (PID: 2248)
      • hkub.pif (PID: 2080)
      • Payment Draft.exe (PID: 3692)

    • NETWIRE was detected

      • RegSvcs.exe (PID: 2248)

    • Changes the autorun value in the registry

      • hkub.pif (PID: 2080)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3620)
      • Payment Draft.exe (PID: 3692)
      • hkub.pif (PID: 2080)

    • Drop AutoIt3 executable file

      • Payment Draft.exe (PID: 3692)

    • Starts application with an unusual extension

      • Payment Draft.exe (PID: 3692)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.cab | Microsoft Cabinet Archive (100)
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
4
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start winrar.exe payment  draft.exe hkub.pif #NETWIRE regsvcs.exe

Process information

PID
CMD
Path
Indicators
Parent process
2080"C:\Users\admin\AppData\Local\Temp\62474426\hkub.pif" porrql.ihcC:\Users\admin\AppData\Local\Temp\62474426\hkub.pif
Payment Draft.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script
Exit code:
0
Version:
3, 3, 8, 1
Modules
Images
c:\users\admin\appdata\local\temp\62474426\hkub.pif
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\version.dll
2248"C:\Users\admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\admin\AppData\Local\Temp\RegSvcs.exe
hkub.pif
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Services Installation Utility
Exit code:
0
Version:
4.7.3062.0 built by: NET472REL1
Modules
Images
c:\users\admin\appdata\local\temp\regsvcs.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
3620"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Payment Draft.cab"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\comdlg32.dll
3692"C:\Users\admin\AppData\Local\Temp\Rar$EXa3620.16773\Payment Draft.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3620.16773\Payment Draft.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3620.16773\payment draft.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
818
Read events
798
Write events
20
Delete events
0

Modification events

(PID) Process:(3620) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3620) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3620) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3620) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Payment Draft.cab
(PID) Process:(3620) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3620) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3620) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3620) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3620) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3620) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
3
Suspicious files
0
Text files
66
Unknown types
0

Dropped files

PID
Process
Filename
Type
3692Payment Draft.exeC:\Users\admin\AppData\Local\Temp\62474426\porrql.ihc —
MD5:—
SHA256:—
3692Payment Draft.exeC:\Users\admin\AppData\Local\Temp\62474426\mfsrhdujp.txttext
MD5:—
SHA256:—
3692Payment Draft.exeC:\Users\admin\AppData\Local\Temp\62474426\sgbsmesxam.docxtext
MD5:—
SHA256:—
3692Payment Draft.exeC:\Users\admin\AppData\Local\Temp\62474426\vsgwk.dlltext
MD5:—
SHA256:—
3692Payment Draft.exeC:\Users\admin\AppData\Local\Temp\62474426\tsujrjvms.jpgtext
MD5:—
SHA256:—
3692Payment Draft.exeC:\Users\admin\AppData\Local\Temp\62474426\hkub.pifexecutable
MD5:71D8F6D5DC35517275BC38EBCC815F9F
SHA256:FB73A819B37523126C7708A1D06F3B8825FA60C926154AB2D511BA668F49DC4B
3692Payment Draft.exeC:\Users\admin\AppData\Local\Temp\62474426\hlnhlf.exetext
MD5:—
SHA256:—
3692Payment Draft.exeC:\Users\admin\AppData\Local\Temp\62474426\fiiim.dlltext
MD5:—
SHA256:—
3692Payment Draft.exeC:\Users\admin\AppData\Local\Temp\62474426\purc.ppttext
MD5:—
SHA256:—
3692Payment Draft.exeC:\Users\admin\AppData\Local\Temp\62474426\swco.icmtext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
2
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2248
RegSvcs.exe
91.189.180.213:3365
—
ServeTheWorld AS
NO
malicious

DNS requests

Domain
IP
Reputation
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Payment Draft.cab