File name:

R2R.rar

Full analysis: https://app.any.run/tasks/ad02e7e5-6bef-48a6-96a3-62fd18c0d787
Verdict: Malicious activity
Analysis date: November 08, 2023, 19:51:25
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

C458550A3B602194BB60BC035B2786E3

SHA1:

8BAD2F16C46A2529FC616CE7B84AD5ADB25683AC

SHA256:

790A9226740D404949FDA1C03D19406A9EA051A0A975B6479B25B4B91FEF5017

SSDEEP:

49152:LVSUpV36lA94bZEVWziXCnbdJbI56FVL2qLm6J5l3yWEmUpWwnIwL+bxLF/a9Tax:LV9Vqldag9BJB3L27eny/6bxLFUmwpSx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • ApisonicLabs_KeyGen.exe (PID: 3652)

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Reads the computer name

      • ApisonicLabs_KeyGen.exe (PID: 3652)
      • wmpnscfg.exe (PID: 4080)
      • keygen.exe (PID: 3756)
      • wmpnscfg.exe (PID: 3840)

    • Checks supported languages

      • ApisonicLabs_KeyGen.exe (PID: 3652)
      • keygen.exe (PID: 3756)
      • wmpnscfg.exe (PID: 3840)
      • wmpnscfg.exe (PID: 4080)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3840)
      • ApisonicLabs_KeyGen.exe (PID: 3652)
      • ApisonicLabs_KeyGen.exe (PID: 3608)
      • wmpnscfg.exe (PID: 4080)

    • Reads the machine GUID from the registry

      • wmpnscfg.exe (PID: 4080)
      • wmpnscfg.exe (PID: 3840)
      • keygen.exe (PID: 3756)

    • Create files in a temporary directory

      • keygen.exe (PID: 3756)
      • ApisonicLabs_KeyGen.exe (PID: 3652)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3436)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
6
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs apisoniclabs_keygen.exe no specs apisoniclabs_keygen.exe keygen.exe no specs wmpnscfg.exe no specs wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3436"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\R2R.rar"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3608"C:\Users\admin\Desktop\ApisonicLabs_KeyGen.exe" C:\Users\admin\Desktop\ApisonicLabs_KeyGen.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\apisoniclabs_keygen.exe
c:\windows\system32\ntdll.dll
3652"C:\Users\admin\Desktop\ApisonicLabs_KeyGen.exe" C:\Users\admin\Desktop\ApisonicLabs_KeyGen.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\apisoniclabs_keygen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
3756C:\Users\admin\AppData\Local\Temp\keygen.exeC:\Users\admin\AppData\Local\Temp\keygen.exe—ApisonicLabs_KeyGen.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\keygen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
3840"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
4080"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
Total events
1 045
Read events
1 029
Write events
8
Delete events
8

Modification events

(PID) Process:(3436) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17A\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3436) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3436) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3436) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3436) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3436) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3436) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3436) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3840) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{AD7BE65D-315B-4DA1-BE82-1D0658D31DB5}\{C90EB22E-B9DB-4D66-BB6B-947DCC727BC4}
Operation:delete keyName:(default)
Value:
(PID) Process:(3840) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{AD7BE65D-315B-4DA1-BE82-1D0658D31DB5}
Operation:delete keyName:(default)
Value:
Executable files
4
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
3436WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3436.9336\R2R\ApisonicLabs_KeyGen.exeexecutable
MD5:5C49257298E7C0B31519361815B8DCCE
SHA256:484FAEEF317AE761D2E24FC54AE4E6934509344BEA9E1F4A20739BFB173DBDAA
3652ApisonicLabs_KeyGen.exeC:\Users\admin\AppData\Local\Temp\keygen.exeexecutable
MD5:AFA202B319750B4207EE776626FFC95C
SHA256:F70E9F2EFD57A722C306B585D32D05D6E82B189A8E040DFA4431184B93408EBC
3652ApisonicLabs_KeyGen.exeC:\Users\admin\AppData\Local\Temp\R2RAPISNC.dllexecutable
MD5:5B691D4232876AF1CF7BF16B717FA5F1
SHA256:197EAD845EB6366E6152D8CBD6579D3CCE689609433CC64CD4C7F6A30BEB7FCB
3652ApisonicLabs_KeyGen.exeC:\Users\admin\AppData\Local\Temp\bgm.xmbinary
MD5:C817D3DFFD16F30FD40A51A71750B660
SHA256:DFE9AB47EB98135EA1BAB0B73F57EE5A3E7C930E16369E8D48A8A4A1AC4B3F5B
3652ApisonicLabs_KeyGen.exeC:\Users\admin\AppData\Local\Temp\BASSMOD.dllexecutable
MD5:E4EC57E8508C5C4040383EBE6D367928
SHA256:8AD9E47693E292F381DA42DDC13724A3063040E51C26F4CA8E1F8E2F1DDD547F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
3
DNS requests
2
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
868
svchost.exe
69.192.160.136:80
armmf.adobe.com
AKAMAI-AS
DE
unknown

DNS requests

Domain
IP
Reputation
armmf.adobe.com
  • 69.192.160.136
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
R2R.rar