File name:

mykey_.rar

Full analysis: https://app.any.run/tasks/9e56710e-dd8e-4df8-97c1-bf783cc93c58
Verdict: Malicious activity
Analysis date: August 22, 2018, 12:35:21
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v4, os: Win32
MD5:

460F98C7960444845BE0F1710D92ED1D

SHA1:

FA3F6CE892A1888D720B513A12EEEB61E443F5BA

SHA256:

7136CFB4343CAE6D67A7E7A7572C5E2EDB36F1ECA4B7EB24B202E632071EAE8F

SSDEEP:

196608:PbwKK/IldXbJis+MIrBiOI/N/U9NcjY9FYMCFl:VK/IlddqMIrMOI/NMgjBBl

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • mykey.exe (PID: 2264)
      • sl500f.exe (PID: 2648)
      • acr122u.exe (PID: 4020)

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 1640)
      • sl500f.exe (PID: 2648)
      • acr122u.exe (PID: 4020)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3368)

  • INFO

    • Dropped object may contain URL's

      • WinRAR.exe (PID: 3368)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v-4.x) (58.3)
.rar | RAR compressed archive (gen) (41.6)

EXIF

ZIP

CompressedSize: 656
UncompressedSize: 910
OperatingSystem: Win32
ModifyDate: 2016:06:27 16:39:05
PackingMethod: Normal
ArchivedFileName: mykey by sg4j1n3ll0\guida su come utilizzare il programma.txt
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
5
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe searchprotocolhost.exe no specs mykey.exe sl500f.exe no specs acr122u.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1640"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe12_ Global\UsGthrCtrlFltPipeMssGthrPipe12 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2264"C:\Users\admin\Desktop\mykey by sg4j1n3ll0\mykey.exe" C:\Users\admin\Desktop\mykey by sg4j1n3ll0\mykey.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\mykey by sg4j1n3ll0\mykey.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2648sl500f.exe -v 9940220 -b -o 1 -p SL500FC:\Users\admin\Desktop\mykey by sg4j1n3ll0\plugins\SL500F\sl500f.exe—mykey.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\mykey by sg4j1n3ll0\plugins\sl500f\sl500f.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\users\admin\desktop\mykey by sg4j1n3ll0\plugins\sl500f\masterrd.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
3368"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\mykey_.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
4020acr122u.exe -v 9940220 -b -p ACR122UC:\Users\admin\Desktop\mykey by sg4j1n3ll0\plugins\ACR122U\acr122u.exe—mykey.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\mykey by sg4j1n3ll0\plugins\acr122u\acr122u.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\users\admin\desktop\mykey by sg4j1n3ll0\plugins\acr122u\libnfc.dll
c:\users\admin\desktop\mykey by sg4j1n3ll0\plugins\acr122u\pcre3.dll
Total events
785
Read events
771
Write events
14
Delete events
0

Modification events

(PID) Process:(3368) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3368) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3368) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\59\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3368) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\mykey_.rar
(PID) Process:(3368) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3368) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3368) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3368) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1640) SearchProtocolHost.exeKey:HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\59\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1640) SearchProtocolHost.exeKey:HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\59\52C64B7E
Operation:writeName:@C:\Windows\System32\msxml3r.dll,-1
Value:
XML Document
Executable files
17
Suspicious files
0
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
3368WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3368.5508\mykey by sg4j1n3ll0\guida su come utilizzare il programma.txttext
MD5:—
SHA256:—
3368WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3368.5508\mykey by sg4j1n3ll0\plugins\ACR122U\acr122u.exeexecutable
MD5:6F637F74E24B666058DF22DAF0843F6F
SHA256:41815BB79FDE882ADA92B050C5AFCFE9336D015BA7E36AF272F438F76B6E5A4D
3368WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3368.5508\mykey by sg4j1n3ll0\plugins\ACR122U\pcre3.dllexecutable
MD5:57CAC848FA14AE38F14F9441F8933282
SHA256:8861AAAF4C65EB975B927292F7283BF1AEACDAE8428700E81DDFD0FA2C379D62
3368WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3368.5508\mykey by sg4j1n3ll0\plugins\GutenTAG\LibUsbDotNet.xmlxml
MD5:97C442B9A4830661736AEE13794FA5EE
SHA256:0C0C357BEA31A90D7313BC156B565813537DC7F71BD49735ECFF21D680D0095F
3368WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3368.5508\mykey by sg4j1n3ll0\plugins\ACR122U\libnfc.dllexecutable
MD5:46670E4C1CD1DC0F3B33328D6C0B4990
SHA256:ABF2CD53E1430D86AD3A252F17EBE6E7E2B0B0C6ECC8C76A97C1BB61D24374ED
3368WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3368.5508\mykey by sg4j1n3ll0\plugins\ACR122U\libusb0.dllexecutable
MD5:535779909A40B42F4F3E48598F5778A5
SHA256:00CACA07869B19D10B370552AC7CC2F6F2EE246FC15DB11650F6CD3F4EF9B666
3368WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3368.5508\mykey by sg4j1n3ll0\plugins\pn532\libnfc.dllexecutable
MD5:46670E4C1CD1DC0F3B33328D6C0B4990
SHA256:ABF2CD53E1430D86AD3A252F17EBE6E7E2B0B0C6ECC8C76A97C1BB61D24374ED
3368WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3368.5508\mykey by sg4j1n3ll0\plugins\GutenTAG\GutenTAG.exeexecutable
MD5:37B35A6789C0972DFB15929DC20FD0D3
SHA256:72E65ECCC2771E0C38BF2196A55CC03622EEF33BE0C5505E9820692F4C6F9DDC
3368WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3368.5508\mykey by sg4j1n3ll0\plugins\pn532\pn532.exeexecutable
MD5:7B0C519AFA9155D9BE2E0A63833EF925
SHA256:F032DF6A71B8FDF4A677873212EA3E90D3E8B2802A90FC4C52F850E8BAD8CA2C
3368WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3368.5508\mykey by sg4j1n3ll0\plugins\SL500F\MasterCom.dllexecutable
MD5:ACCAF687146081A35C249E7B17A3E49B
SHA256:11976024701F38C32609D8CA94B678C33227A3AD2EADD3B3138AE6F8498554FF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
Process
Message
mykey.exe
Could not parse application stylesheet
mykey.exe
libpng warning: iCCP: known incorrect sRGB profile
mykey.exe
"Find 1 Serial Port(s):"
mykey.exe
Name : "COM1"
mykey.exe
Description : "Communications Port"
mykey.exe
Manufacturer: "(Standard port types)"
mykey.exe
SystemLocation: "\\\\.\\COM1"
mykey.exe
"COM1\t----\t(Standard port types) Communications Port"
mykey.exe
"C:/Users/admin/Desktop/mykey by sg4j1n3ll0"
mykey.exe
"C:/Users/admin/Desktop/mykey by sg4j1n3ll0"
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
mykey_.rar