File name:

9.rar

Full analysis: https://app.any.run/tasks/12f764ab-f90f-4482-bbd9-d73cdccbc9c0
Verdict: Malicious activity
Analysis date: February 21, 2020, 16:44:42
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

02440A9A2D5923710D7296DED583291C

SHA1:

F2A88F7FF8C4FE226063E8B8977F648843250B7E

SHA256:

6D72224B4DE9388C0F6E1F54C15E6E21980D60BC5FEA0502383896D164E4D661

SSDEEP:

98304:mAvvaJ6saThc78RnpmIa3wbybuG8DrNwbeFxOK2QYDgXZuXvZsoTYz7K:mA31sOhc783Ykg89MqxOjQYsqZpTF

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • ABOUT SERVICE.EXE (PID: 3252)
      • PSN CHECKER.EXE (PID: 2012)
      • 24FRZVWSS0.exe (PID: 3924)
      • bfsvc.exe (PID: 3196)
      • PSN CHECKER.EXE (PID: 572)
      • UMOYHN3CH9.exe (PID: 3524)
      • bfsvc.exe (PID: 3004)

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 3548)
      • 24FRZVWSS0.exe (PID: 3924)
      • UMOYHN3CH9.exe (PID: 3524)

    • Changes the autorun value in the registry

      • PSN CHECKER.EXE (PID: 572)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • PSN CHECKER.EXE (PID: 2012)
      • PSN CHECKER.EXE (PID: 572)

    • Executable content was dropped or overwritten

      • PSN CHECKER.EXE (PID: 2012)
      • PSN Checker.exe (PID: 3324)
      • PSN CHECKER.EXE (PID: 572)
      • ABOUT SERVICE.EXE (PID: 3252)

    • Checks for external IP

      • PSN CHECKER.EXE (PID: 2012)
      • PSN CHECKER.EXE (PID: 572)

    • Starts itself from another location

      • PSN CHECKER.EXE (PID: 2012)

    • Connects to SMTP port

      • PSN CHECKER.EXE (PID: 2012)
      • PSN CHECKER.EXE (PID: 572)

    • Connects to unusual port

      • ABOUT SERVICE.EXE (PID: 3252)

    • Creates files in the Windows directory

      • ABOUT SERVICE.EXE (PID: 3252)

    • Creates files in the user directory

      • PSN CHECKER.EXE (PID: 572)

    • Searches for installed software

      • PSN CHECKER.EXE (PID: 2012)
      • PSN CHECKER.EXE (PID: 572)

  • INFO

    • Manual execution by user

      • PSN Checker.exe (PID: 3324)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
49
Monitored processes
12
Malicious processes
4
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start winrar.exe no specs psn checker.exe about service.exe psn checker.exe searchprotocolhost.exe no specs 24frzvwss0.exe no specs cmd.exe no specs bfsvc.exe psn checker.exe umoyhn3ch9.exe no specs cmd.exe no specs bfsvc.exe

Process information

PID
CMD
Path
Indicators
Parent process
572"C:\Users\admin\AppData\Roaming\PSN CHECKER.EXE" C:\Users\admin\AppData\Local\Temp\PSN CHECKER.EXEC:\Users\admin\AppData\Roaming\PSN CHECKER.EXE
PSN CHECKER.EXE
User:
admin
Company:
Microsoft @ 2015
Integrity Level:
MEDIUM
Description:
Control ACLs Program
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\psn checker.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1440"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\9.rar"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2012"C:\Users\admin\AppData\Local\Temp\PSN CHECKER.EXE" C:\Users\admin\AppData\Local\Temp\PSN CHECKER.EXE
PSN Checker.exe
User:
admin
Company:
Microsoft @ 2015
Integrity Level:
MEDIUM
Description:
Control ACLs Program
Exit code:
4294967295
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\psn checker.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2756"C:\Windows\System32\cmd.exe" cmd /c bfsvc.exe "true" "true" "true" "true"C:\Windows\System32\cmd.exe—PSN CHECKER.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3004bfsvc.exe "true" "true" "true" "true"C:\Users\admin\AppData\Local\Temp\bfsvc.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Ranger.BrowserLogging.Tests
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\bfsvc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3176"C:\Windows\System32\cmd.exe" cmd /c bfsvc.exe "true" "true" "true" "true"C:\Windows\System32\cmd.exe—PSN CHECKER.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3196bfsvc.exe "true" "true" "true" "true"C:\Users\admin\AppData\Local\Temp\bfsvc.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Ranger.BrowserLogging.Tests
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\bfsvc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3252"C:\Users\admin\AppData\Local\Temp\ABOUT SERVICE.EXE" C:\Users\admin\AppData\Local\Temp\ABOUT SERVICE.EXE
PSN Checker.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\about service.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3324"C:\Users\admin\Desktop\PSN Checker 2020 [Working] [Fast] [Free]\PSN Checker [Crack.sx]\PSN Checker.exe" C:\Users\admin\Desktop\PSN Checker 2020 [Working] [Fast] [Free]\PSN Checker [Crack.sx]\PSN Checker.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\users\admin\desktop\psn checker 2020 [working] [fast] [free]\psn checker [crack.sx]\psn checker.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3524"C:\Users\admin\AppData\Local\Temp\UMOYHN3CH9.exe" C:\Users\admin\AppData\Local\Temp\UMOYHN3CH9.exe—PSN CHECKER.EXE
User:
admin
Integrity Level:
MEDIUM
Description:
PlaystationChecker
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\umoyhn3ch9.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
2 547
Read events
2 458
Write events
89
Delete events
0

Modification events

(PID) Process:(1440) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1440) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1440) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1440) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\9.rar
(PID) Process:(1440) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1440) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1440) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1440) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3324) PSN Checker.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3324) PSN Checker.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
13
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
1440WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1440.2317\PSN Checker 2020 [Working] [Fast] [Free]\PSN Checker [Crack.sx]\BruteEngine.dll —
MD5:—
SHA256:—
1440WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1440.2317\PSN Checker 2020 [Working] [Fast] [Free]\PSN Checker [Crack.sx]\PlaystationChecker.pdb —
MD5:—
SHA256:—
1440WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1440.2317\PSN Checker 2020 [Working] [Fast] [Free]\PSN Checker [Crack.sx]\PSN Checker.exe —
MD5:—
SHA256:—
1440WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1440.2317\PSN Checker 2020 [Working] [Fast] [Free]\PSN Checker [Crack.sx]\System.dll —
MD5:—
SHA256:—
1440WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1440.2317\PSN Checker 2020 [Working] [Fast] [Free]\PSN Checker [Crack.sx]\System.Drawing.dll —
MD5:—
SHA256:—
1440WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1440.2317\PSN Checker 2020 [Working] [Fast] [Free]\PSN Checker [Crack.sx]\System.Management.dll —
MD5:—
SHA256:—
1440WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1440.2317\PSN Checker 2020 [Working] [Fast] [Free]\PSN Checker [Crack.sx]\System.Windows.Forms.dll —
MD5:—
SHA256:—
3324PSN Checker.exeC:\Users\admin\AppData\Local\Temp\ABOUT SERVICE.EXEexecutable
MD5:—
SHA256:—
2012PSN CHECKER.EXEC:\Users\admin\AppData\Local\Temp\24FRZVWSS0.exeexecutable
MD5:—
SHA256:—
572PSN CHECKER.EXEC:\Users\admin\AppData\Roaming\TMP_4728text
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
11
DNS requests
4
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
572
PSN CHECKER.EXE
GET
200
104.20.17.242:80
http://icanhazip.com/
US
text
12 b
shared
2012
PSN CHECKER.EXE
GET
200
104.20.17.242:80
http://icanhazip.com/
US
text
12 b
shared
2012
PSN CHECKER.EXE
GET
404
104.31.3.184:80
http://puu.sh/jMSLc.txt
US
text
30 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3252
ABOUT SERVICE.EXE
167.71.213.170:1738
—
—
US
unknown
2012
PSN CHECKER.EXE
104.31.3.184:80
puu.sh
Cloudflare Inc
US
suspicious
3196
bfsvc.exe
104.31.3.184:443
puu.sh
Cloudflare Inc
US
suspicious
2012
PSN CHECKER.EXE
104.20.17.242:80
icanhazip.com
Cloudflare Inc
US
shared
572
PSN CHECKER.EXE
104.31.3.184:80
puu.sh
Cloudflare Inc
US
suspicious
3004
bfsvc.exe
104.31.3.184:443
puu.sh
Cloudflare Inc
US
suspicious
572
PSN CHECKER.EXE
104.20.17.242:80
icanhazip.com
Cloudflare Inc
US
shared
572
PSN CHECKER.EXE
52.97.232.210:587
smtp-mail.outlook.com
Microsoft Corporation
US
unknown
2012
PSN CHECKER.EXE
52.97.176.34:587
smtp-mail.outlook.com
Microsoft Corporation
US
unknown

DNS requests

Domain
IP
Reputation
puu.sh
  • 104.31.3.184
  • 104.31.2.184
shared
icanhazip.com
  • 104.20.17.242
  • 104.20.16.242
shared
smtp-mail.outlook.com
  • 52.97.176.34
  • 40.101.80.18
  • 52.97.152.210
  • 52.97.232.210
  • 52.97.189.66
  • 52.97.186.114
shared

Threats

PID
Process
Class
Message
2012
PSN CHECKER.EXE
Potentially Bad Traffic
ET INFO GET to Puu.sh for TXT File with Minimal Headers
2012
PSN CHECKER.EXE
Attempted Information Leak
ET POLICY IP Check Domain (icanhazip. com in HTTP Host)
572
PSN CHECKER.EXE
Potentially Bad Traffic
ET INFO GET to Puu.sh for TXT File with Minimal Headers
572
PSN CHECKER.EXE
Attempted Information Leak
ET POLICY IP Check Domain (icanhazip. com in HTTP Host)
2 ETPRO signatures available at the full report
Process
Message
PSN Checker.exe
C:\Users\admin\AppData\Local\Temp\ABOUT SERVICE.EXE
PSN Checker.exe
C:\Users\admin\AppData\Local\Temp\BRUTEENGINE.DLL
PSN Checker.exe
C:\Users\admin\AppData\Local\Temp\PSN CHECKER.EXE
PSN Checker.exe
C:\Users\admin\AppData\Local\Temp\SYSTEM.DLL
PSN Checker.exe
C:\Users\admin\AppData\Local\Temp\SYSTEM.DRAWING.DLL
PSN Checker.exe
C:\Users\admin\AppData\Local\Temp\SYSTEM.MANAGEMENT.DLL
PSN Checker.exe
C:\Users\admin\AppData\Local\Temp\SYSTEM.WINDOWS.FORMS.DLL