File name:

Dfgownloads.rar

Full analysis: https://app.any.run/tasks/1e0acd0c-2acd-41c5-9ddb-03c113ed6465
Verdict: Malicious activity
Analysis date: October 19, 2023, 10:28:23
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

BB4C399E02EE90EFE868AFAC1A7D4E9B

SHA1:

44B4D1C297EA627AFD566DE84EFF1A9DAAD234EF

SHA256:

7B821449D8A58E32F8607626BC8A7F2DE8F727C76231A42C5F3DE56B771AE620

SSDEEP:

393216:CalJ6jv61hz03ePtUq01E8dFFZOtVx+G8DOgeyOtcrvJUXmOkp8E:PJ6e1qq09dZOtffBgctAnOU8E

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Bifrost.exe (PID: 1372)
      • Bifrost.exe (PID: 3716)
      • Bifrost 2.6 final.exe (PID: 1396)
      • Bifrost Bypass limit 2100 victims bourkane.exe (PID: 3124)
      • Bifrost 2.6 final.exe (PID: 3228)
      • BiFrost Sa$a HACk.exe (PID: 2996)
      • Bifrost.exe (PID: 2956)
      • BiFrOsT Dr.AdNaN 0.3.exe (PID: 3304)
      • BiFrOsT Dr.AdNaN 0.3.exe (PID: 2224)
      • BiFrOsT Dr.AdNaN 0.3.exe (PID: 2388)
      • Bifrost_dernier_version.exe (PID: 2124)
      • TaFFaL.exe (PID: 2440)
      • TaFFaL.exe (PID: 3212)
      • BiFrOsT BeSt oF HaC.exe (PID: 2616)
      • BiFrOsT.شامخ رغم الألم.EXE (PID: 1556)
      • notepad.exe (PID: 3796)
      • BiFrOsT Dr.AdNaN 0.3 ByPaSs LiMiT.exe (PID: 3620)
      • BiFrOsT Dr.AdNaN 0.3 ByPaSs LiMiT.exe (PID: 4056)
      • Bifrost Korabika.exe (PID: 584)
      • BiFrOsT Dr.MOT v0.1.exe (PID: 3900)
      • Bifrost Saw II.exe (PID: 3624)
      • مترجم الكيلوجر.exe (PID: 888)
      • BiFrOsT-MoJaHeD.exe (PID: 2648)
      • server.exe (PID: 964)
      • notepad.exe (PID: 3584)
      • BiFroSt-MaTreX.exe (PID: 3912)
      • BiFrOsT-MoJaHeD.exe (PID: 1232)

    • Application was injected by another process

      • explorer.exe (PID: 1400)
      • taskeng.exe (PID: 368)
      • dwm.exe (PID: 928)
      • ctfmon.exe (PID: 1708)

    • Runs injected code in another process

      • Bifrost 2.6 final.exe (PID: 1396)
      • 39E0.tmp (PID: 2608)
      • TaFFaL.exe (PID: 2440)

    • Drops the executable file immediately after the start

      • BiFrOsT Dr.AdNaN 0.3.exe (PID: 2388)
      • BiFrost Sa$a HACk.exe (PID: 2996)
      • Bifrost_dernier_version.exe (PID: 2124)
      • BiFroSt-MaTreX.exe (PID: 3912)

    • Changes appearance of the Explorer extensions

      • 39E0.tmp (PID: 2608)
      • BiFrost Sa$a HACk.exe (PID: 2996)

    • UAC/LUA settings modification

      • BiFrost Sa$a HACk.exe (PID: 2996)

    • Changes Security Center notification settings

      • BiFrost Sa$a HACk.exe (PID: 2996)

    • Changes the autorun value in the registry

      • explorer.exe (PID: 1400)

  • SUSPICIOUS

    • Write to the desktop.ini file (may be used to cloak folders)

      • WinRAR.exe (PID: 3192)

    • Application launched itself

      • Bifrost 2.6 final.exe (PID: 3228)
      • BiFrOsT Dr.AdNaN 0.3.exe (PID: 2224)
      • TaFFaL.exe (PID: 3212)
      • BiFrOsT Dr.AdNaN 0.3 ByPaSs LiMiT.exe (PID: 3620)

    • Reads the Internet Settings

      • BiFrOsT Dr.AdNaN 0.3.exe (PID: 2388)
      • Bifrost_dernier_version.exe (PID: 2124)
      • BiFrOsT BeSt oF HaC.exe (PID: 2616)

    • Starts application with an unusual extension

      • BiFrost Sa$a HACk.exe (PID: 2996)

    • Process drops legitimate windows executable

      • explorer.exe (PID: 1400)

    • SMB connection has been detected (probably for file transfer)

      • explorer.exe (PID: 1400)

  • INFO

    • Manual execution by a user

      • WinRAR.exe (PID: 3192)
      • Bifrost.exe (PID: 1372)
      • Bifrost.exe (PID: 3716)
      • wmpnscfg.exe (PID: 1028)
      • Bifrost Bypass limit 2100 victims bourkane.exe (PID: 3124)
      • Bifrost 2.6 final.exe (PID: 3228)
      • BiFrOsT Dr.AdNaN 0.3.exe (PID: 2388)
      • BiFrost Sa$a HACk.exe (PID: 2996)
      • BiFrOsT.شامخ رغم الألم.EXE (PID: 1556)
      • notepad.exe (PID: 3796)
      • Bifrost_dernier_version.exe (PID: 2124)
      • BiFrOsT Dr.AdNaN 0.3 ByPaSs LiMiT.exe (PID: 3620)
      • iexplore.exe (PID: 2556)
      • Bifrost Korabika.exe (PID: 584)
      • Bifrost Saw II.exe (PID: 3624)
      • BiFrOsT Dr.MOT v0.1.exe (PID: 3900)
      • مترجم الكيلوجر.exe (PID: 888)
      • BiFroSt-MaTreX.exe (PID: 3912)
      • server.exe (PID: 964)
      • BiFrOsT-MoJaHeD.exe (PID: 2648)
      • notepad.exe (PID: 3584)
      • BiFrOsT-MoJaHeD.exe (PID: 1232)

    • Reads the computer name

      • Bifrost.exe (PID: 1372)
      • Bifrost.exe (PID: 3716)
      • wmpnscfg.exe (PID: 1028)
      • Bifrost Bypass limit 2100 victims bourkane.exe (PID: 3124)
      • BiFrOsT Dr.AdNaN 0.3.exe (PID: 2388)
      • BiFrOsT Dr.AdNaN 0.3.exe (PID: 3304)
      • 39E0.tmp (PID: 2608)
      • BiFrost Sa$a HACk.exe (PID: 2996)
      • Bifrost_dernier_version.exe (PID: 2124)
      • BiFrOsT BeSt oF HaC.exe (PID: 2616)
      • Bifrost Korabika.exe (PID: 584)
      • Bifrost Saw II.exe (PID: 3624)
      • BiFrOsT Dr.AdNaN 0.3 ByPaSs LiMiT.exe (PID: 4056)
      • BiFrOsT Dr.MOT v0.1.exe (PID: 3900)
      • BiFroSt-MaTreX.exe (PID: 3912)
      • BiFrOsT-MoJaHeD.exe (PID: 1232)
      • BiFrOsT-MoJaHeD.exe (PID: 2648)

    • Checks supported languages

      • Bifrost.exe (PID: 1372)
      • Bifrost.exe (PID: 3716)
      • Bifrost 2.6 final.exe (PID: 3228)
      • Bifrost 2.6 final.exe (PID: 1396)
      • Bifrost Bypass limit 2100 victims bourkane.exe (PID: 3124)
      • wmpnscfg.exe (PID: 1028)
      • BiFrOsT Dr.AdNaN 0.3.exe (PID: 2388)
      • Bifrost.exe (PID: 2956)
      • BiFrOsT Dr.AdNaN 0.3.exe (PID: 2224)
      • BiFrOsT Dr.AdNaN 0.3.exe (PID: 3304)
      • 39E0.tmp (PID: 2608)
      • BiFrost Sa$a HACk.exe (PID: 2996)
      • BiFrOsT.شامخ رغم الألم.EXE (PID: 1556)
      • Bifrost_dernier_version.exe (PID: 2124)
      • TaFFaL.exe (PID: 3212)
      • BiFrOsT BeSt oF HaC.exe (PID: 2616)
      • TaFFaL.exe (PID: 2440)
      • BiFrOsT Dr.AdNaN 0.3 ByPaSs LiMiT.exe (PID: 3620)
      • BiFrOsT Dr.AdNaN 0.3 ByPaSs LiMiT.exe (PID: 4056)
      • Bifrost Korabika.exe (PID: 584)
      • Bifrost Saw II.exe (PID: 3624)
      • BiFrOsT Dr.MOT v0.1.exe (PID: 3900)
      • مترجم الكيلوجر.exe (PID: 888)
      • BiFroSt-MaTreX.exe (PID: 3912)
      • server.exe (PID: 964)
      • BiFrOsT-MoJaHeD.exe (PID: 1232)
      • BiFrOsT-MoJaHeD.exe (PID: 2648)

    • Dropped object may contain TOR URL's

      • WinRAR.exe (PID: 3192)

    • Reads the machine GUID from the registry

      • Bifrost.exe (PID: 3716)
      • wmpnscfg.exe (PID: 1028)
      • BiFrOsT Dr.AdNaN 0.3.exe (PID: 3304)
      • Bifrost Bypass limit 2100 victims bourkane.exe (PID: 3124)
      • BiFrost Sa$a HACk.exe (PID: 2996)
      • BiFrOsT BeSt oF HaC.exe (PID: 2616)
      • BiFrOsT Dr.MOT v0.1.exe (PID: 3900)
      • Bifrost Korabika.exe (PID: 584)
      • Bifrost Saw II.exe (PID: 3624)
      • BiFrOsT Dr.AdNaN 0.3 ByPaSs LiMiT.exe (PID: 4056)
      • مترجم الكيلوجر.exe (PID: 888)
      • BiFrOsT-MoJaHeD.exe (PID: 2648)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3192)
      • explorer.exe (PID: 1400)

    • Creates files or folders in the user directory

      • explorer.exe (PID: 1400)
      • BiFrost Sa$a HACk.exe (PID: 2996)
      • TaFFaL.exe (PID: 2440)

    • Create files in a temporary directory

      • explorer.exe (PID: 1400)
      • BiFrOsT Dr.AdNaN 0.3.exe (PID: 2388)
      • BiFrost Sa$a HACk.exe (PID: 2996)
      • Bifrost_dernier_version.exe (PID: 2124)
      • مترجم الكيلوجر.exe (PID: 888)

    • Reads the Internet Settings

      • explorer.exe (PID: 1400)

    • Changes appearance of the Explorer extensions

      • explorer.exe (PID: 1400)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
85
Monitored processes
36
Malicious processes
24
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start drop and start inject inject drop and start drop and start inject drop and start winrar.exe no specs winrar.exe no specs bifrost.exe no specs bifrost.exe no specs wmpnscfg.exe no specs bifrost 2.6 final.exe no specs bifrost 2.6 final.exe no specs bifrost bypass limit 2100 victims bourkane.exe no specs bifrost dr.adnan 0.3.exe no specs bifrost.exe bifrost dr.adnan 0.3.exe no specs bifrost dr.adnan 0.3.exe no specs bifrost sa$a hack.exe no specs 39e0.tmp no specs taskeng.exe dwm.exe ctfmon.exe bifrost.شامخ رغم الألم.exe no specs bifrost_dernier_version.exe no specs taffal.exe no specs taffal.exe no specs bifrost best of hac.exe no specs notepad.exe no specs explorer.exe iexplore.exe no specs bifrost dr.adnan 0.3 bypass limit.exe no specs bifrost dr.adnan 0.3 bypass limit.exe no specs bifrost dr.mot v0.1.exe no specs bifrost korabika.exe no specs bifrost saw ii.exe no specs مترجم الكيلوجر.exe no specs bifrost-matrex.exe no specs server.exe no specs notepad.exe no specs bifrost-mojahed.exe no specs bifrost-mojahed.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
368taskeng.exe {A138C7FA-105D-4695-A941-2BE80CB32127}C:\Windows\System32\taskeng.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Engine
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskeng.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
584"C:\Users\admin\Desktop\BiFrOsT_Korabika_0.1\Dev-PoinT\Bifrost Korabika.exe" C:\Users\admin\Desktop\BiFrOsT_Korabika_0.1\Dev-PoinT\Bifrost Korabika.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
BiFrOsT KoRaBiKa 0.1
Exit code:
20
Version:
0, 1
Modules
Images
c:\users\admin\desktop\bifrost_korabika_0.1\dev-point\bifrost korabika.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
c:\windows\system32\gdi32.dll
888"C:\Users\admin\Desktop\Bifrost_SAWII\Bifrost_SAWII\مترجم الكيلوجر.exe" C:\Users\admin\Desktop\Bifrost_SAWII\Bifrost_SAWII\مترجم الكيلوجر.exe—explorer.exe
User:
admin
Company:
alshamrani
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.00
Modules
Images
c:\users\admin\desktop\bifrost_sawii\bifrost_sawii\مترجم الكيلوجر.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
928"C:\Windows\system32\Dwm.exe"C:\Windows\System32\dwm.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Desktop Window Manager
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dwm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\uxtheme.dll
964"C:\Users\admin\Desktop\BiFroSt-MaTreX\BiFroSt-MaTreX\server.exe" C:\Users\admin\Desktop\BiFroSt-MaTreX\BiFroSt-MaTreX\server.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\bifrost-matrex\bifrost-matrex\server.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1028"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\user32.dll
1232"C:\Users\admin\Desktop\BiFrOsT-MoJaHeDN1\BiFrOsT-MoJaHeDN1\BiFrOsT-MoJaHeDN\BiFrOsT-MoJaHeD.exe" C:\Users\admin\Desktop\BiFrOsT-MoJaHeDN1\BiFrOsT-MoJaHeDN1\BiFrOsT-MoJaHeDN\BiFrOsT-MoJaHeD.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
عآشق رسول الله
Exit code:
4294967295
Version:
1, 2, 1, 0
Modules
Images
c:\users\admin\desktop\bifrost-mojahedn1\bifrost-mojahedn1\bifrost-mojahedn\bifrost-mojahed.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
1372"C:\Users\admin\Desktop\Bifrost - MiSter Swat\Bifrost - MiSter Swat\Bifrost.exe" C:\Users\admin\Desktop\Bifrost - MiSter Swat\Bifrost - MiSter Swat\Bifrost.exe—explorer.exe
User:
admin
Company:
http://www.chasenet.org
Integrity Level:
MEDIUM
Description:
Bifrost 1.2.1
Exit code:
20
Version:
1, 2, 1, 0
Modules
Images
c:\users\admin\desktop\bifrost - mister swat\bifrost - mister swat\bifrost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
1396"C:\Users\admin\Desktop\Bifrost 2.6 final\Bifrost 2.6 final.exe"C:\Users\admin\Desktop\Bifrost 2.6 final\Bifrost 2.6 final.exe—Bifrost 2.6 final.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\bifrost 2.6 final\bifrost 2.6 final.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
1400C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
38 423
Read events
37 045
Write events
1 372
Delete events
6

Modification events

(PID) Process:(1400) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\NewShortcuts
Operation:delete keyName:(default)
Value:
(PID) Process:(3708) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\178\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3708) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3708) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3708) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3708) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3708) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3708) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3708) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1400) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
Operation:writeName:MRUListEx
Value:
020000001E0000001D0000001C0000001B0000001A000000000000001900000003000000180000001600000017000000150000001400000013000000120000000F00000011000000100000000E0000000D0000000C0000000B0000000A00000009000000080000000700000006000000050000000400000001000000FFFFFFFF
Executable files
34
Suspicious files
43
Text files
22
Unknown types
0

Dropped files

PID
Process
Filename
Type
1400explorer.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\Dfgownloads.rar.lnkbinary
MD5:90E1E451344DFC8DEC3BD6F36C80CA9C
SHA256:886F57A2FA882376312E73E8807631C252DBA61CBB7ECF34D5CFA7B230AE079C
3708WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3708.30443\BiFrost Sa$a HACk.rarcompressed
MD5:723F735E8EADD6D9F1FA60849FE675FC
SHA256:39D82928FAFA5FD976B3C7AD685726DD4C8CB30BC4A55E3427D1F9B7E7C4742D
1400explorer.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\1b4dd67f29cb1962.automaticDestinations-msbinary
MD5:4070A52115E2A64D1BEF13DFF479DFC6
SHA256:DAED6CD08BC1C41D544A75704C7C3F9554A2EA7218C105B5C95ED3F0B57ACA96
1400explorer.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\290532160612e071.automaticDestinations-msbinary
MD5:0F32F7BFD1D642F883AB4364F6FEDD3D
SHA256:28B64329C1AED82D898213D2EE32E0F14B3F4C3AEB0E2D3F6F6439C026F6C6B0
3708WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3708.30443\Bifrost Bypass limit 2100 victims bourkane.rarcompressed
MD5:427BB60D09A03E3E5DC03D7E1B6DB5EB
SHA256:ADD74373B2F2ADD6A5CBE873FCA05AF0347B4CB6FEE14B9D9E1ED7F85594F79F
3708WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3708.30443\Bifrost_dernier_version.rarcompressed
MD5:487EF0A92FC705A12299376EC0C80E46
SHA256:E9D0DA0CD8C1C2D0E4C39079C12DA720ADCA0C267339AF14F41A054A99D0514B
3708WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3708.30443\Bifrost_SAWII.rarcompressed
MD5:51A2FC71622077455F2511882FF17E07
SHA256:F0C4E3AC4BDBE0D9E72A4F59FCBC6ADEC2587E87618840E392F05A2DDD9FFFB2
3708WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3708.30443\BiFrOsT_Dr.AdNaN_0.3_ByPaSs_LiMiT.rarcompressed
MD5:840B841CAFA3D80938E7416810A1F6DD
SHA256:64C0D187AF4FC6C065B0EB360A19359A827A6C8ED57EE0B15D57F3129A114E6E
3708WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3708.30443\BiFrOsT Dr.AdNaN 0.3.rarcompressed
MD5:476C297E26C2F7DAD7318F17EA8C9772
SHA256:933584B9F50FA6F37EFA531F64B75BBABF8B86F0A7DD8B25D7C7450E31E79F71
3708WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3708.30443\Bifrost - MiSter Swat.rarcompressed
MD5:61E3078B7A05607E28F4940F128BEB49
SHA256:738C9C6AFE4F48466F1EB888EE121CDE5A20C847799D0AAB505B0595833D96F5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2
DNS requests
2
Threats
2

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
azouz0.no-ip.org
  • 0.0.0.0
unknown
saidsaid.no-ip.org
  • —
unknown

Threats

PID
Process
Class
Message
1088
svchost.exe
Misc activity
ET INFO DYNAMIC_DNS Query to a Suspicious no-ip Domain
1088
svchost.exe
Misc activity
ET INFO DYNAMIC_DNS Query to a Suspicious no-ip Domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Dfgownloads.rar