File name:

Payment Draft.cab

Full analysis: https://app.any.run/tasks/f4f138f2-76a8-443b-9dd7-e47342ef4931
Verdict: Malicious activity
Threats:

Netwire is an advanced RAT — it is a malware that takes control of infected PCs and allows its operators to perform various actions. Unlike many RATs, this one can target every major operating system, including Windows, Linux, and MacOS.

Malware Trends Tracker     >>>
Analysis date: February 21, 2020, 16:15:51
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
autoit
rat
netwire
trojan
Indicators:
MIME: application/vnd.ms-cab-compressed
File info: Microsoft Cabinet archive data, 1228569 bytes, 1 file
MD5:

2EE7627EE56D2B11D10D7D780D235F92

SHA1:

CF3469D31AB8FAC7FCA9B6D4513E57455310B410

SHA256:

6A80B05A4A59B8EE0E1985754F0FEA95D877E114C6B6BAE720CDDB57E8257874

SSDEEP:

24576:FY9vvaLd7j3tz4fTWjv+gEURlWACSf3bNiCWAXz6h3Bo661d7c/1RMWaMP3af0on:y9vvI7zyfTuxEUQCWSmhxo661dw/XMxX

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Payment Draft.exe (PID: 3524)
      • hkub.pif (PID: 3820)
      • RegSvcs.exe (PID: 2560)

    • Connects to CnC server

      • RegSvcs.exe (PID: 2560)

    • Changes the autorun value in the registry

      • hkub.pif (PID: 3820)

    • NETWIRE was detected

      • RegSvcs.exe (PID: 2560)

  • SUSPICIOUS

    • Drop AutoIt3 executable file

      • Payment Draft.exe (PID: 3524)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3028)
      • Payment Draft.exe (PID: 3524)
      • hkub.pif (PID: 3820)

    • Starts application with an unusual extension

      • Payment Draft.exe (PID: 3524)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.cab | Microsoft Cabinet Archive (100)
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
4
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start winrar.exe payment  draft.exe hkub.pif #NETWIRE regsvcs.exe

Process information

PID
CMD
Path
Indicators
Parent process
2560"C:\Users\admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\admin\AppData\Local\Temp\RegSvcs.exe
hkub.pif
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Services Installation Utility
Exit code:
0
Version:
4.7.3062.0 built by: NET472REL1
Modules
Images
c:\users\admin\appdata\local\temp\regsvcs.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
3028"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Payment Draft.cab"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3524"C:\Users\admin\AppData\Local\Temp\Rar$EXa3028.27342\Payment Draft.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3028.27342\Payment Draft.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3028.27342\payment draft.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3820"C:\Users\admin\AppData\Local\Temp\62474426\hkub.pif" porrql.ihcC:\Users\admin\AppData\Local\Temp\62474426\hkub.pif
Payment Draft.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script
Exit code:
0
Version:
3, 3, 8, 1
Modules
Images
c:\users\admin\appdata\local\temp\62474426\hkub.pif
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\version.dll
Total events
811
Read events
791
Write events
20
Delete events
0

Modification events

(PID) Process:(3028) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3028) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3028) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3028) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Payment Draft.cab
(PID) Process:(3028) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3028) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3028) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3028) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3028) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3028) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
3
Suspicious files
0
Text files
66
Unknown types
0

Dropped files

PID
Process
Filename
Type
3524Payment Draft.exeC:\Users\admin\AppData\Local\Temp\62474426\porrql.ihc —
MD5:—
SHA256:—
3028WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3028.27342\Payment Draft.exeexecutable
MD5:—
SHA256:—
3524Payment Draft.exeC:\Users\admin\AppData\Local\Temp\62474426\vnmavfrx.cpltext
MD5:—
SHA256:—
3524Payment Draft.exeC:\Users\admin\AppData\Local\Temp\62474426\hlnhlf.exetext
MD5:—
SHA256:—
3524Payment Draft.exeC:\Users\admin\AppData\Local\Temp\62474426\vsgwk.dlltext
MD5:—
SHA256:—
3524Payment Draft.exeC:\Users\admin\AppData\Local\Temp\62474426\sgbsmesxam.docxtext
MD5:—
SHA256:—
3524Payment Draft.exeC:\Users\admin\AppData\Local\Temp\62474426\swco.icmtext
MD5:—
SHA256:—
3524Payment Draft.exeC:\Users\admin\AppData\Local\Temp\62474426\purc.ppttext
MD5:—
SHA256:—
3524Payment Draft.exeC:\Users\admin\AppData\Local\Temp\62474426\mfsrhdujp.txttext
MD5:—
SHA256:—
3524Payment Draft.exeC:\Users\admin\AppData\Local\Temp\62474426\hahaiwpm.dattext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
0
Threats
2

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2560
RegSvcs.exe
91.189.180.213:3365
—
ServeTheWorld AS
NO
malicious

DNS requests

No data

Threats

PID
Process
Class
Message
2560
RegSvcs.exe
A Network Trojan was detected
MALWARE [PTsecurity] Netwire.RAT
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Payment Draft.cab