File name:

Waircut V2.0 by ARKAZZU.zip

Full analysis: https://app.any.run/tasks/9e29e6d3-be27-431f-a75f-22e000031498
Verdict: Malicious activity
Analysis date: May 05, 2019, 22:40:49
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

8E8B99321B4EB57105C80742879DE02C

SHA1:

744F849CB1831BFBC96F7C88E789771EFA4B9773

SHA256:

7D0925FDA57958CB6945BCF020AB9693A59601156194FC8370E1A7D5F64EE19B

SSDEEP:

49152:txvfIKVG0MJfDZFkbB9zhStmAAkwgmyDwtIU77C4O4Ou22lSlV3Syth3h8TZo18z:txvfFVG0MFF6VCabHyUtBC4O41YlV3SD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Waircut.exe (PID: 2860)
      • Waircut.exe (PID: 2316)

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 3092)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 4000)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2018:05:15 19:19:01
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: Waircut V2.0/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe searchprotocolhost.exe no specs waircut.exe no specs waircut.exe

Process information

PID
CMD
Path
Indicators
Parent process
2316"C:\Users\admin\Desktop\Waircut V2.0\Waircut.exe" C:\Users\admin\Desktop\Waircut V2.0\Waircut.exe
explorer.exe
User:
admin
Company:
Patcher
Integrity Level:
HIGH
Description:
waircut
Exit code:
0
Version:
2.0
Modules
Images
c:\users\admin\desktop\waircut v2.0\waircut.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2860"C:\Users\admin\Desktop\Waircut V2.0\Waircut.exe" C:\Users\admin\Desktop\Waircut V2.0\Waircut.exe—explorer.exe
User:
admin
Company:
Patcher
Integrity Level:
MEDIUM
Description:
waircut
Exit code:
3221226540
Version:
2.0
Modules
Images
c:\users\admin\desktop\waircut v2.0\waircut.exe
c:\systemroot\system32\ntdll.dll
3092"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe5_ Global\UsGthrCtrlFltPipeMssGthrPipe5 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
4000"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Waircut V2.0 by ARKAZZU.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
Total events
848
Read events
823
Write events
25
Delete events
0

Modification events

(PID) Process:(4000) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(4000) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(4000) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(4000) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Waircut V2.0 by ARKAZZU.zip
(PID) Process:(4000) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(4000) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(4000) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(4000) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3092) SearchProtocolHost.exeKey:HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\62\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3092) SearchProtocolHost.exeKey:HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\62\52C64B7E
Operation:writeName:@C:\Windows\system32\notepad.exe,-469
Value:
Text Document
Executable files
6
Suspicious files
0
Text files
5
Unknown types
2

Dropped files

PID
Process
Filename
Type
2316Waircut.exeC:\Users\admin\AppData\Local\Patcher\Waircut.exe_StrongName_hu55jcqz1l0xzwol4xdhfkxzesvt1zhm\2.0.0.0\0y5ccy5y.newcfg —
MD5:—
SHA256:—
4000WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4000.8008\Waircut V2.0\Bd\ApLog.dbsqlite
MD5:8B9F4E200FABD3D75D00EAB9AEDB3C2E
SHA256:8C115D8E85DCC74130A152ACE7F8BA65AE23FF6E1928F9D984B6B9F017A64C4D
4000WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4000.8008\Waircut V2.0\ChangeLog.txttext
MD5:AE7F9DF96C5304BA802BDB5B32476E48
SHA256:5CFD82232FC4603228C8F9AE239126B3FE6930150AFFEC8336D9ABA19DEE349D
4000WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4000.8008\Waircut V2.0\wAirCut.exe.configxml
MD5:38D8EBC77C915D5CF70AFB5BD5769AFB
SHA256:0ABAD5F4E905942EB27185D72C3A60DD6032B521B6F0100B36B2CFC8EC132644
4000WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4000.8008\Waircut V2.0\ru\Waircut.resources.dllexecutable
MD5:A3F3D0098FB43D970873281FE07AF65F
SHA256:F7D494BBBA03B8BEF611E6A91D92EA5490EDAF384E421AF8342244836F1CE6F7
4000WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4000.8008\Waircut V2.0\System.Data.SQLite.dllexecutable
MD5:DEAF98E10B82FC9BC2476A432724492F
SHA256:3CCAF0BF3B927ACEDA3645F0A592C2DB6B9AFB7680E766042BF9CA6D51774886
4000WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4000.8008\Waircut V2.0\Waircut.exeexecutable
MD5:9D11A8641AAE3C20C2F39C89E75798AB
SHA256:600986E9892988BA772CE853C559FB7C28186E84422AF9AED53F2327F5FF45DE
4000WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4000.8008\Waircut V2.0\es\Waircut.resources.dllexecutable
MD5:1849C11F96636115D8BB784824472295
SHA256:71CEE5AC2078AE405EC8D0F2305A8987FE08D7E608F6062659D22160DC4B7851
2316Waircut.exeC:\Users\admin\AppData\Local\Patcher\Waircut.exe_StrongName_hu55jcqz1l0xzwol4xdhfkxzesvt1zhm\2.0.0.0\user.configxml
MD5:—
SHA256:—
4000WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4000.8008\Waircut V2.0\Bd\WpsProbePin.dbsqlite
MD5:1484B2BFFF2CFB2A6F02BCDC9713F079
SHA256:BE6C085B1A29D131C78D76EBDA033E7FDF434E152E81A97A87F5BFB41ED355F7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Waircut V2.0 by ARKAZZU.zip