File name:

uplay checker.rar

Full analysis: https://app.any.run/tasks/e2afa223-d74b-4398-962a-58a3dc399d63
Verdict: Malicious activity
Analysis date: February 13, 2020, 16:46:35
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

5EA8ACB3D41292F662DB8C3536653AD1

SHA1:

8D7FB77328778F944B1745F08F286D4C94089EF4

SHA256:

77B9576FB39084043F031AB04C7F211E4AF0B9AF8B1EC664E074656FA8EB1480

SSDEEP:

12288:c/aox0lWN0dS7JNSwWBJ1MC8mqUvHo4jRY9+C:c/x/vTSwWZImqUvHozh

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connects to CnC server

      • InkzProd.exe (PID: 2272)

  • SUSPICIOUS

    • Reads Environment values

      • InkzProd.exe (PID: 4052)
      • InkzProd.exe (PID: 2272)

    • Application launched itself

      • InkzProd.exe (PID: 1932)

    • Connects to unusual port

      • InkzProd.exe (PID: 4052)
      • InkzProd.exe (PID: 2272)

  • INFO

    • Manual execution by user

      • InkzProd.exe (PID: 4052)
      • InkzProd.exe (PID: 1932)

    • Reads settings of System Certificates

      • InkzProd.exe (PID: 4052)
      • InkzProd.exe (PID: 2272)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
4
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs inkzprod.exe inkzprod.exe no specs inkzprod.exe

Process information

PID
CMD
Path
Indicators
Parent process
1932"C:\Users\admin\Desktop\uplay checker\InkzProd.exe" C:\Users\admin\Desktop\uplay checker\InkzProd.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
InkzProd
Exit code:
1
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\uplay checker\inkzprod.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2272"C:\Users\admin\Desktop\uplay checker\InkzProd.exe" C:\Users\admin\Desktop\uplay checker\InkzProd.exe
InkzProd.exe
User:
admin
Integrity Level:
MEDIUM
Description:
InkzProd
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\uplay checker\inkzprod.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3000"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\uplay checker.rar"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
4052"C:\Users\admin\Desktop\uplay checker\InkzProd.exe" C:\Users\admin\Desktop\uplay checker\InkzProd.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
InkzProd
Exit code:
1
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\uplay checker\inkzprod.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
25 494
Read events
25 192
Write events
280
Delete events
22

Modification events

(PID) Process:(3000) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3000) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3000) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3000) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\uplay checker.rar
(PID) Process:(3000) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3000) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3000) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3000) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3000) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
(PID) Process:(3000) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\General
Operation:writeName:LastFolder
Value:
C:\Users\admin\AppData\Local\Temp
Executable files
0
Suspicious files
0
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
3000WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3000.43412\uplay checker\Bunifu_UI_v1.5.3.dll —
MD5:—
SHA256:—
3000WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3000.43412\uplay checker\InkzProd.exe —
MD5:—
SHA256:—
3000WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3000.43412\uplay checker\Newtonsoft.Json.dll —
MD5:—
SHA256:—
3000WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3000.43412\uplay checker\xNet.dll —
MD5:—
SHA256:—
3000WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3000.43412\uplay checker\MyProxy_6811 SOCKS4.txt —
MD5:—
SHA256:—
3000WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3000.43412\uplay checker\nulled base uplay 1302.txt —
MD5:—
SHA256:—
2272InkzProd.exeC:\Users\admin\Desktop\uplay checker\Result\Goods_2020.02.13_16-49\Other.txttext
MD5:—
SHA256:—
2272InkzProd.exeC:\Users\admin\Desktop\uplay checker\Result\Goods_2020.02.13_16-49\Good.txttext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1 635
DNS requests
12
Threats
576

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
87.120.179.74:4145
—
SKAT TV Ltd.
BG
suspicious
4052
InkzProd.exe
168.227.147.197:10801
—
IP·RED
AR
suspicious
4052
InkzProd.exe
66.76.58.60:54321
—
Suddenlink Communications
US
suspicious
4052
InkzProd.exe
45.250.168.35:4145
—
Kappa Internet Services Private Limited
IN
suspicious
4052
InkzProd.exe
213.96.31.253:4145
—
Telefonica De Espana
ES
suspicious
4052
InkzProd.exe
146.120.215.106:4145
—
Skynet-2010 Ltd.
UA
suspicious
4052
InkzProd.exe
197.211.38.187:35317
—
globacom-as
NG
suspicious
4052
InkzProd.exe
1.179.198.226:56428
—
TOT Public Company Limited
TH
suspicious
4052
InkzProd.exe
103.229.45.170:4153
—
Help Line
BD
suspicious
—
—
81.30.203.202:4145
—
OJSC Ufanet
RU
suspicious

DNS requests

Domain
IP
Reputation
dns.msftncsi.com
  • 131.107.255.255
shared
api-ubiservices.ubi.com
  • 3.219.59.31
  • 54.145.254.16
  • 54.163.211.139
unknown
wspuplay-ext.ubi.com
  • 216.98.58.60
unknown

Threats

PID
Process
Class
Message
4052
InkzProd.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
4052
InkzProd.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
4052
InkzProd.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
4052
InkzProd.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
4052
InkzProd.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
4052
InkzProd.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
4052
InkzProd.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
4052
InkzProd.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
4052
InkzProd.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
4052
InkzProd.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
uplay checker.rar