analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| File name: | paws-1.0.0.0-32.rar |
| Full analysis: | https://app.any.run/tasks/37315113-cb14-4e35-a9f7-11a130bcab6e |
| Verdict: | Malicious activity |
| Analysis date: | November 14, 2018, 07:05:19 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/x-rar |
| File info: | RAR archive data, v5 |
| MD5: | 17229CE075DA37A7D9590267B58C898F |
| SHA1: | E8C5D633F0F958A9BB2B30A142D5AD44DEC673AC |
| SHA256: | 71987A8D555160E41F83F1C4E6532044B39C7B479AC6F20153E337892A4EA59C |
| SSDEEP: | 393216:ntosqSWQqYL9TqdTeRgE4JUEjnC4FFcEUmda91hoSd91d4w:nTqSRk9eihC4FFcEvdCo+1n |
MALICIOUS
Application was dropped or rewritten from another process
- paws-qt.exe (PID: 2764)
SUSPICIOUS
Executable content was dropped or overwritten
- WinRAR.exe (PID: 2360)
Creates files in the user directory
- paws-qt.exe (PID: 2764)
Connects to unusual port
- paws-qt.exe (PID: 2764)
INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .rar | | | RAR compressed archive (v5.0) (61.5) |
|---|---|---|
| .rar | | | RAR compressed archive (gen) (38.4) |
Total processes
34
Monitored processes
2
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 2360 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\paws-1.0.0.0-32.rar" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 | ||||
| 2764 | "C:\Users\admin\Desktop\paws-1.0.0.0-32\paws-qt.exe" | C:\Users\admin\Desktop\paws-1.0.0.0-32\paws-qt.exe | explorer.exe | |
User: admin Integrity Level: MEDIUM | ||||
Total events
612
Read events
549
Write events
0
Delete events
0
Modification events
Executable files
3
Suspicious files
33
Text files
13
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2764 | paws-qt.exe | C:\Users\admin\AppData\Roaming\PAWS\zerocoin\MANIFEST-000001 | — | |
MD5:— | SHA256:— | |||
| 2764 | paws-qt.exe | C:\Users\admin\AppData\Roaming\PAWS\zerocoin\000001.dbtmp | — | |
MD5:— | SHA256:— | |||
| 2764 | paws-qt.exe | C:\Users\admin\AppData\Roaming\PAWS\zerocoin\000002.dbtmp | — | |
MD5:— | SHA256:— | |||
| 2764 | paws-qt.exe | C:\Users\admin\AppData\Roaming\PAWS\sporks\MANIFEST-000001 | — | |
MD5:— | SHA256:— | |||
| 2764 | paws-qt.exe | C:\Users\admin\AppData\Roaming\PAWS\sporks\000001.dbtmp | — | |
MD5:— | SHA256:— | |||
| 2764 | paws-qt.exe | C:\Users\admin\AppData\Roaming\PAWS\sporks\000002.dbtmp | — | |
MD5:— | SHA256:— | |||
| 2764 | paws-qt.exe | C:\Users\admin\AppData\Roaming\PAWS\blocks\index\MANIFEST-000001 | — | |
MD5:— | SHA256:— | |||
| 2764 | paws-qt.exe | C:\Users\admin\AppData\Roaming\PAWS\blocks\index\000001.dbtmp | — | |
MD5:— | SHA256:— | |||
| 2764 | paws-qt.exe | C:\Users\admin\AppData\Roaming\PAWS\blocks\index\000002.dbtmp | — | |
MD5:— | SHA256:— | |||
| 2764 | paws-qt.exe | C:\Users\admin\AppData\Roaming\PAWS\chainstate\MANIFEST-000001 | — | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
7
DNS requests
1
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2764 | paws-qt.exe | 95.179.200.213:34120 | — | Cosmoline Telecommunication Services S.A. | GR | unknown |
2764 | paws-qt.exe | 104.207.130.217:34120 | — | Choopa, LLC | DE | unknown |
2764 | paws-qt.exe | 45.63.10.156:34120 | — | Choopa, LLC | US | unknown |
2764 | paws-qt.exe | 139.162.224.106:34120 | paws.fund | Linode, LLC | GB | unknown |
2764 | paws-qt.exe | 45.77.5.22:34120 | — | Choopa, LLC | US | unknown |
2764 | paws-qt.exe | 45.32.145.142:34120 | — | Choopa, LLC | FR | unknown |
2764 | paws-qt.exe | 144.202.53.246:34120 | — | Baltimore Technology Park, LLC | US | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
paws.fund |
| unknown |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2764 | paws-qt.exe | Misc activity | SUSPICIOUS [PTsecurity] CoinWallet (PUA) |
Process | Message |
|---|---|
paws-qt.exe | Invalid parameter passed to C runtime function.
|