analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

9.rar

Full analysis: https://app.any.run/tasks/12f764ab-f90f-4482-bbd9-d73cdccbc9c0
Verdict: Malicious activity
Analysis date: February 21, 2020, 16:44:42
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

02440A9A2D5923710D7296DED583291C

SHA1:

F2A88F7FF8C4FE226063E8B8977F648843250B7E

SHA256:

6D72224B4DE9388C0F6E1F54C15E6E21980D60BC5FEA0502383896D164E4D661

SSDEEP:

98304:mAvvaJ6saThc78RnpmIa3wbybuG8DrNwbeFxOK2QYDgXZuXvZsoTYz7K:mA31sOhc783Ykg89MqxOjQYsqZpTF

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • ABOUT SERVICE.EXE (PID: 3252)
      • PSN CHECKER.EXE (PID: 2012)
      • 24FRZVWSS0.exe (PID: 3924)
      • bfsvc.exe (PID: 3196)
      • PSN CHECKER.EXE (PID: 572)
      • UMOYHN3CH9.exe (PID: 3524)
      • bfsvc.exe (PID: 3004)

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 3548)
      • 24FRZVWSS0.exe (PID: 3924)
      • UMOYHN3CH9.exe (PID: 3524)

    • Changes the autorun value in the registry

      • PSN CHECKER.EXE (PID: 572)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • PSN Checker.exe (PID: 3324)
      • PSN CHECKER.EXE (PID: 2012)
      • ABOUT SERVICE.EXE (PID: 3252)
      • PSN CHECKER.EXE (PID: 572)

    • Connects to unusual port

      • ABOUT SERVICE.EXE (PID: 3252)

    • Starts CMD.EXE for commands execution

      • PSN CHECKER.EXE (PID: 2012)
      • PSN CHECKER.EXE (PID: 572)

    • Checks for external IP

      • PSN CHECKER.EXE (PID: 2012)
      • PSN CHECKER.EXE (PID: 572)

    • Connects to SMTP port

      • PSN CHECKER.EXE (PID: 2012)
      • PSN CHECKER.EXE (PID: 572)

    • Starts itself from another location

      • PSN CHECKER.EXE (PID: 2012)

    • Creates files in the Windows directory

      • ABOUT SERVICE.EXE (PID: 3252)

    • Creates files in the user directory

      • PSN CHECKER.EXE (PID: 572)

    • Searches for installed software

      • PSN CHECKER.EXE (PID: 572)
      • PSN CHECKER.EXE (PID: 2012)

  • INFO

    • Manual execution by user

      • PSN Checker.exe (PID: 3324)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
49
Monitored processes
12
Malicious processes
4
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start winrar.exe no specs psn checker.exe about service.exe psn checker.exe searchprotocolhost.exe no specs 24frzvwss0.exe no specs cmd.exe no specs bfsvc.exe psn checker.exe umoyhn3ch9.exe no specs cmd.exe no specs bfsvc.exe

Process information

PID
CMD
Path
Indicators
Parent process
1440"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\9.rar"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3324"C:\Users\admin\Desktop\PSN Checker 2020 [Working] [Fast] [Free]\PSN Checker [Crack.sx]\PSN Checker.exe" C:\Users\admin\Desktop\PSN Checker 2020 [Working] [Fast] [Free]\PSN Checker [Crack.sx]\PSN Checker.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
3252"C:\Users\admin\AppData\Local\Temp\ABOUT SERVICE.EXE" C:\Users\admin\AppData\Local\Temp\ABOUT SERVICE.EXE
PSN Checker.exe
User:
admin
Integrity Level:
MEDIUM
2012"C:\Users\admin\AppData\Local\Temp\PSN CHECKER.EXE" C:\Users\admin\AppData\Local\Temp\PSN CHECKER.EXE
PSN Checker.exe
User:
admin
Company:
Microsoft @ 2015
Integrity Level:
MEDIUM
Description:
Control ACLs Program
Exit code:
4294967295
Version:
1.0.0.0
3548"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe4_ Global\UsGthrCtrlFltPipeMssGthrPipe4 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
3924"C:\Users\admin\AppData\Local\Temp\24FRZVWSS0.exe" C:\Users\admin\AppData\Local\Temp\24FRZVWSS0.exe—PSN CHECKER.EXE
User:
admin
Integrity Level:
MEDIUM
Description:
PlaystationChecker
Version:
1.0.0.0
3176"C:\Windows\System32\cmd.exe" cmd /c bfsvc.exe "true" "true" "true" "true"C:\Windows\System32\cmd.exe—PSN CHECKER.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3196bfsvc.exe "true" "true" "true" "true"C:\Users\admin\AppData\Local\Temp\bfsvc.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Ranger.BrowserLogging.Tests
Exit code:
0
Version:
1.0.0.0
572"C:\Users\admin\AppData\Roaming\PSN CHECKER.EXE" C:\Users\admin\AppData\Local\Temp\PSN CHECKER.EXEC:\Users\admin\AppData\Roaming\PSN CHECKER.EXE
PSN CHECKER.EXE
User:
admin
Company:
Microsoft @ 2015
Integrity Level:
MEDIUM
Description:
Control ACLs Program
Version:
1.0.0.0
3524"C:\Users\admin\AppData\Local\Temp\UMOYHN3CH9.exe" C:\Users\admin\AppData\Local\Temp\UMOYHN3CH9.exe—PSN CHECKER.EXE
User:
admin
Integrity Level:
MEDIUM
Description:
PlaystationChecker
Version:
1.0.0.0
Total events
2 547
Read events
2 458
Write events
0
Delete events
0

Modification events

No data
Executable files
13
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
1440WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1440.2317\PSN Checker 2020 [Working] [Fast] [Free]\PSN Checker [Crack.sx]\BruteEngine.dll —
MD5:—
SHA256:—
1440WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1440.2317\PSN Checker 2020 [Working] [Fast] [Free]\PSN Checker [Crack.sx]\PlaystationChecker.pdb —
MD5:—
SHA256:—
1440WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1440.2317\PSN Checker 2020 [Working] [Fast] [Free]\PSN Checker [Crack.sx]\PSN Checker.exe —
MD5:—
SHA256:—
1440WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1440.2317\PSN Checker 2020 [Working] [Fast] [Free]\PSN Checker [Crack.sx]\System.dll —
MD5:—
SHA256:—
1440WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1440.2317\PSN Checker 2020 [Working] [Fast] [Free]\PSN Checker [Crack.sx]\System.Drawing.dll —
MD5:—
SHA256:—
1440WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1440.2317\PSN Checker 2020 [Working] [Fast] [Free]\PSN Checker [Crack.sx]\System.Management.dll —
MD5:—
SHA256:—
1440WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1440.2317\PSN Checker 2020 [Working] [Fast] [Free]\PSN Checker [Crack.sx]\System.Windows.Forms.dll —
MD5:—
SHA256:—
3324PSN Checker.exeC:\Users\admin\AppData\Local\Temp\ABOUT SERVICE.EXEexecutable
MD5:CA65FE4F9DE7DD66CEEE00ADD6AB2D0D
SHA256:62C21497F4FFDFDBC23E4793D01DA9667AD5E51FCA658C4416099F0404C6BF04
3324PSN Checker.exeC:\Users\admin\AppData\Local\Temp\PSN CHECKER.EXEexecutable
MD5:7FAD267B2E6965DBBD830637F938E355
SHA256:AD2AD86174603A0264A216A97383B84FE8C913769D783247F7EF3A40782358BF
3324PSN Checker.exeC:\Users\admin\AppData\Local\Temp\SYSTEM.DRAWING.DLLexecutable
MD5:C4D5551FAA4F2D560EF7786497A1BDE2
SHA256:0B5B8AE2F2F5AC6B5F48A21DB2E932F0E0B9FED3437908D360B852F4BBEE8AE3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
11
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
572
PSN CHECKER.EXE
GET
200
104.20.17.242:80
http://icanhazip.com/
US
text
12 b
shared
2012
PSN CHECKER.EXE
GET
200
104.20.17.242:80
http://icanhazip.com/
US
text
12 b
shared
2012
PSN CHECKER.EXE
GET
404
104.31.3.184:80
http://puu.sh/jMSLc.txt
US
text
30 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3252
ABOUT SERVICE.EXE
167.71.213.170:1738
—
—
US
unknown
3196
bfsvc.exe
104.31.3.184:443
puu.sh
Cloudflare Inc
US
suspicious
2012
PSN CHECKER.EXE
104.31.3.184:80
puu.sh
Cloudflare Inc
US
suspicious
2012
PSN CHECKER.EXE
104.20.17.242:80
icanhazip.com
Cloudflare Inc
US
shared
572
PSN CHECKER.EXE
104.31.3.184:80
puu.sh
Cloudflare Inc
US
suspicious
3004
bfsvc.exe
104.31.3.184:443
puu.sh
Cloudflare Inc
US
suspicious
572
PSN CHECKER.EXE
104.20.17.242:80
icanhazip.com
Cloudflare Inc
US
shared
2012
PSN CHECKER.EXE
52.97.176.34:587
smtp-mail.outlook.com
Microsoft Corporation
US
unknown
572
PSN CHECKER.EXE
52.97.232.210:587
smtp-mail.outlook.com
Microsoft Corporation
US
unknown

DNS requests

Domain
IP
Reputation
puu.sh
  • 104.31.3.184
  • 104.31.2.184
shared
icanhazip.com
  • 104.20.17.242
  • 104.20.16.242
shared
smtp-mail.outlook.com
  • 52.97.176.34
  • 40.101.80.18
  • 52.97.152.210
  • 52.97.232.210
  • 52.97.189.66
  • 52.97.186.114
shared

Threats

PID
Process
Class
Message
2012
PSN CHECKER.EXE
Potentially Bad Traffic
ET INFO GET to Puu.sh for TXT File with Minimal Headers
2012
PSN CHECKER.EXE
Attempted Information Leak
ET POLICY IP Check Domain (icanhazip. com in HTTP Host)
572
PSN CHECKER.EXE
Potentially Bad Traffic
ET INFO GET to Puu.sh for TXT File with Minimal Headers
572
PSN CHECKER.EXE
Attempted Information Leak
ET POLICY IP Check Domain (icanhazip. com in HTTP Host)
2 ETPRO signatures available at the full report
Process
Message
PSN Checker.exe
C:\Users\admin\AppData\Local\Temp\ABOUT SERVICE.EXE
PSN Checker.exe
C:\Users\admin\AppData\Local\Temp\BRUTEENGINE.DLL
PSN Checker.exe
C:\Users\admin\AppData\Local\Temp\PSN CHECKER.EXE
PSN Checker.exe
C:\Users\admin\AppData\Local\Temp\SYSTEM.DLL
PSN Checker.exe
C:\Users\admin\AppData\Local\Temp\SYSTEM.DRAWING.DLL
PSN Checker.exe
C:\Users\admin\AppData\Local\Temp\SYSTEM.MANAGEMENT.DLL
PSN Checker.exe
C:\Users\admin\AppData\Local\Temp\SYSTEM.WINDOWS.FORMS.DLL
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
9.rar