analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Seng 6.0.rar

Full analysis: https://app.any.run/tasks/a7619aca-95f9-450a-aea7-9f1d0dd21c58
Verdict: Malicious activity
Analysis date: November 14, 2018, 11:50:59
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v4, os: Win32
MD5:

BBF98295073BC535E69644524DCFEB9B

SHA1:

9A5C57C614F259EC7FA2C5FFAE415EFAD0687373

SHA256:

7C775436928A8731AA372B9B627CF6BF88DB7C1323892D670A190A2E08EA351B

SSDEEP:

196608:/5/OY0vfOwmQ4+cZE8rVYt120TDAx1QzFAjAScOSqXRusPux4EzKb/:5OYqOwyRXSt120DuyOjASceIzg

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 1860)
      • VVIPPKL9.exe (PID: 3304)
      • explorer.exe (PID: 1772)
      • CCMini.exe (PID: 4056)

    • Application was dropped or rewritten from another process

      • Fast Activator for Exiled.exe (PID: 2836)
      • Fast Activator for Hax4yu.exe (PID: 3876)
      • VVIPPKL9.exe (PID: 3304)
      • CCMini.exe (PID: 4056)

  • SUSPICIOUS

    • Creates files in the user directory

      • explorer.exe (PID: 1772)

    • Starts Internet Explorer

      • Fast Activator for Exiled.exe (PID: 2836)
      • Fast Activator for Hax4yu.exe (PID: 3876)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2664)

    • Reads Internet Cache Settings

      • explorer.exe (PID: 1772)

    • Uses RUNDLL32.EXE to load library

      • explorer.exe (PID: 1772)

  • INFO

    • Reads internet explorer settings

      • iexplore.exe (PID: 1728)
      • iexplore.exe (PID: 3056)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 1728)
      • iexplore.exe (PID: 3056)

    • Changes internet zones settings

      • iexplore.exe (PID: 4032)
      • iexplore.exe (PID: 1264)

    • Creates files in the user directory

      • iexplore.exe (PID: 1728)
      • iexplore.exe (PID: 3056)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v-4.x) (58.3)
.rar | RAR compressed archive (gen) (41.6)

EXIF

ZIP

ArchivedFileName: DRAG ALL FILE TO DESTOP.txt
PackingMethod: Normal
ModifyDate: 2018:08:18 21:56:25
OperatingSystem: Win32
UncompressedSize: 79
CompressedSize: 124
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
48
Monitored processes
12
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe searchprotocolhost.exe no specs fast activator for exiled.exe no specs iexplore.exe iexplore.exe fast activator for hax4yu.exe no specs iexplore.exe iexplore.exe vvippkl9.exe no specs explorer.exe no specs rundll32.exe no specs ccmini.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2664"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Seng 6.0.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
1860"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe6_ Global\UsGthrCtrlFltPipeMssGthrPipe6 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
2836"C:\Users\admin\Desktop\Seng 6.0\Fast Activator for Exiled.exe" C:\Users\admin\Desktop\Seng 6.0\Fast Activator for Exiled.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.00
4032"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
Fast Activator for Exiled.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
1728"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:4032 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3876"C:\Users\admin\Desktop\Seng 6.0\Fast Activator for Hax4yu.exe" C:\Users\admin\Desktop\Seng 6.0\Fast Activator for Hax4yu.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.00
1264"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
Fast Activator for Hax4yu.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3056"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1264 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3304"C:\Users\admin\Desktop\Seng 6.0\VVIPPKL9.exe" C:\Users\admin\Desktop\Seng 6.0\VVIPPKL9.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.00
1772C:\Windows\Explorer.EXEC:\Windows\explorer.exe——
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
3 657
Read events
3 422
Write events
0
Delete events
0

Modification events

No data
Executable files
5
Suspicious files
7
Text files
26
Unknown types
5

Dropped files

PID
Process
Filename
Type
4032iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\favicon[1].ico —
MD5:—
SHA256:—
4032iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
1728iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@pushnest[1].txt —
MD5:—
SHA256:—
2664WinRAR.exeC:\Users\admin\Desktop\Seng 6.0\DRAG ALL FILE TO DESTOP.txttext
MD5:199BBABA91D22398C8A3F9ACB8366B70
SHA256:9E5A9B105FDCCF7FBBA2A2AB673556D62789E7FE696844CDD6DFE57EDAD78F8F
2664WinRAR.exeC:\Users\admin\Desktop\Seng 6.0\ReamMePlease!.txttext
MD5:82E44656773298F7E6EFB3FB6F38C428
SHA256:4F8188836574E510DD4AEC65830553C309A68D25D102C0F47071A138C5D5B8D4
2664WinRAR.exeC:\Users\admin\Desktop\Seng 6.0\Fast Activator for Exiled.exeexecutable
MD5:1F1995D4BDCC95E4577DE3ECA11C78FB
SHA256:D183C1FCC3B2230F990699A7F8A59289FB546E39F69A593875B0DAB69900156F
1772explorer.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\290532160612e071.automaticDestinations-msautomaticdestinations-ms
MD5:4001DD0BFF15C3FA4C085DAAF97C7A7D
SHA256:E1F6F97A4FF5270217F78BE0A67433A9C16C33A6A5F9CB4F62BCA32799FFD211
2664WinRAR.exeC:\Users\admin\Desktop\Seng 6.0\VVIPPKL9.exeexecutable
MD5:DE94644EBA1562C8D24B4526F19A4DA6
SHA256:393E23767391F16D6CA1C8D7F34BFC09E5AB80976CF264989B2FAE69E2912172
1728iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\active-r0s-13-november-2018[1].htmlhtml
MD5:2FF021067294EF89C58C6AAFAEA420E5
SHA256:918586529A870729A3006EB45AB80EB52165871E62A0801F375A89316ED5D4E1
1772explorer.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012018111420181115\index.datdat
MD5:76DD1477D35C777D2ECE0FAA32AF99B0
SHA256:52BAEBA13D8E53A22B2C318D5A39A42600F2D9B1007EA9B3AC069CB005C9A834
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
27
DNS requests
9
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1264
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
4032
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1728
iexplore.exe
172.217.19.201:443
www.blogger.com
Google Inc.
US
whitelisted
1728
iexplore.exe
188.72.202.222:443
go.mobtrks.com
Webzilla B.V.
NL
unknown
1728
iexplore.exe
188.72.202.170:443
pushnest.com
Webzilla B.V.
NL
suspicious
4032
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
1728
iexplore.exe
172.217.20.97:443
pekalongan-cits.blogspot.com
Google Inc.
US
whitelisted
3056
iexplore.exe
209.197.3.15:443
maxcdn.bootstrapcdn.com
Highwinds Network Group, Inc.
US
whitelisted
1264
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3056
iexplore.exe
172.217.19.201:443
www.blogger.com
Google Inc.
US
whitelisted
3056
iexplore.exe
172.217.20.97:443
pekalongan-cits.blogspot.com
Google Inc.
US
whitelisted
1728
iexplore.exe
172.217.17.42:443
ajax.googleapis.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
whitelisted
pekalongan-cits.blogspot.com
  • 172.217.20.97
whitelisted
pushnest.com
  • 188.72.202.170
whitelisted
go.mobtrks.com
  • 188.72.202.222
malicious
ajax.googleapis.com
  • 172.217.17.42
whitelisted
www.blogger.com
  • 172.217.19.201
shared
pl14317197.puserving.com
  • 213.196.2.1
suspicious
maxcdn.bootstrapcdn.com
  • 209.197.3.15
whitelisted
firebasestorage.googleapis.com
  • 172.217.17.106
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Seng 6.0.rar