File name:

C2R-R2V_5.7z

Full analysis: https://app.any.run/tasks/08b47d1d-0f94-4fc8-9a52-2b002c55cd38
Verdict: Malicious activity
Analysis date: October 03, 2019, 22:42:21
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

85086648BE3F3280581115BE82AB369D

SHA1:

8365F5F61B64B8269708C5463FFB2AA712B7EB9B

SHA256:

811E6F82B41E4263FC3F676C57DED8ECD1FB789C2A51B4D17273886370B6FB32

SSDEEP:

12288:uV3+4umF/ztkUjPkS8I8Gy+jnQaXeJyWYouPHc/E4xg8eZ:m3+4X/z/kS8PgjhektogyTuFZ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • CleanOSPP.exe (PID: 3956)

    • Loads dropped or rewritten executable

      • CleanOSPP.exe (PID: 3956)

    • Uses Task Scheduler to run other applications

      • cscript.exe (PID: 3036)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 2888)
      • schtasks.exe (PID: 3120)
      • schtasks.exe (PID: 2868)
      • explorer.exe (PID: 3916)
      • schtasks.exe (PID: 4012)
      • schtasks.exe (PID: 2208)
      • schtasks.exe (PID: 2988)
      • schtasks.exe (PID: 2652)
      • schtasks.exe (PID: 2776)
      • schtasks.exe (PID: 2484)
      • schtasks.exe (PID: 3040)
      • schtasks.exe (PID: 3536)
      • schtasks.exe (PID: 3424)
      • schtasks.exe (PID: 2472)
      • schtasks.exe (PID: 356)
      • schtasks.exe (PID: 2516)
      • schtasks.exe (PID: 2828)

    • Actions looks like stealing of personal data

      • cscript.exe (PID: 3036)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2880)

    • Executes scripts

      • WScript.exe (PID: 3788)

    • Executed via Task Scheduler

      • explorer.EXE (PID: 2584)

  • INFO

    • Manual execution by user

      • WScript.exe (PID: 3788)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
85
Monitored processes
23
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe wscript.exe no specs cscript.exe no specs cscript.exe cleanospp.exe no specs explorer.exe no specs schtasks.exe no specs schtasks.exe no specs explorer.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
356"C:\Windows\System32\schtasks.exe" /Delete /TN FF_INTEGRATEDUPDATEDETECTION /FC:\Windows\System32\schtasks.exe—cscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2208"C:\Windows\System32\schtasks.exe" /Delete /TN C2RAppVLoggingStart /FC:\Windows\System32\schtasks.exe—cscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2472"C:\Windows\System32\schtasks.exe" /Delete /TN "\Microsoft\Office\OfficeInventoryAgentFallBack" /FC:\Windows\System32\schtasks.exe—cscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\ole32.dll
c:\windows\system32\usp10.dll
2484"C:\Windows\System32\schtasks.exe" /Delete /TN "Office Subscription Maintenance" /FC:\Windows\System32\schtasks.exe—cscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2516"C:\Windows\System32\schtasks.exe" /Delete /TN "Microsoft Office 15 Sync Maintenance for {d068b555-9700-40b8-992c-f866287b06c1}" /FC:\Windows\System32\schtasks.exe—cscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2584C:\Windows\explorer.EXE C:\Windows\explorer.EXE—taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2652"C:\Windows\System32\schtasks.exe" /Delete /TN "\Microsoft\Office\OfficeInventoryAgentLogOn" /FC:\Windows\System32\schtasks.exe—cscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2776"C:\Windows\System32\schtasks.exe" /Delete /TN "\Microsoft\Office\Office Automatic Updates" /FC:\Windows\System32\schtasks.exe—cscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2828"C:\Windows\System32\schtasks.exe" /Delete /TN "\Microsoft\Office\OfficeTelemetryAgentLogOn" /FC:\Windows\System32\schtasks.exe—cscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2868"C:\Windows\System32\schtasks.exe" /Delete /TN OffScrEx /FC:\Windows\System32\schtasks.exe—cscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
c:\windows\system32\ole32.dll
Total events
2 295
Read events
2 154
Write events
139
Delete events
2

Modification events

(PID) Process:(2880) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2880) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2880) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\72\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2880) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\C2R-R2V_5.7z
(PID) Process:(2880) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2880) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2880) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2880) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2880) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\DialogEditHistory\ExtrPath
Operation:writeName:0
Value:
C:\Users\admin\Desktop
(PID) Process:(2880) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
Executable files
4
Suspicious files
0
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
2880WinRAR.exeC:\Users\admin\Desktop\C2R-R2V\OffScrub_O16msi.vbstext
MD5:67885A2865E9B277EA5A623B5217782C
SHA256:C5903CD58467DE9BBA3614D03D637D002C2A24C6706729E105699B1214F938D1
2880WinRAR.exeC:\Users\admin\Desktop\C2R-R2V\x86\key.vbstext
MD5:C264487F146AF23BE8B8C65E32D8A211
SHA256:CE647840ADAB3A9B403DF557CA993A42032EB57F768B5992B022839787C2D0CE
3036cscript.exeC:\Users\admin\AppData\Local\Temp\OffScrubC2R\USER-PC_20191003234313_ScrubLog.txttext
MD5:—
SHA256:—
2880WinRAR.exeC:\Users\admin\Desktop\C2R-R2V\OffScrubc2r.vbstext
MD5:930DC88EDCDDE90F7449CA55AA616928
SHA256:570F82344AD7300DD4A2993AD6C3A1ABE1987F37254BFF708DBA1801BFEF392C
2880WinRAR.exeC:\Users\admin\Desktop\C2R-R2V\x64\cleanospp.exeexecutable
MD5:162AB955CB2F002A73C1530AA796477F
SHA256:5CE462E5F34065FC878362BA58617FAB28C22D631B9D836DDDCF43FB1AD4DE6E
2880WinRAR.exeC:\Users\admin\Desktop\C2R-R2V\ReadMe.txttext
MD5:133FAC2255E749C176DBC1C8BF34D50E
SHA256:5822348EF723FB6AE37054B8B21976DEEAB82896BBA566EE6879F13F29488111
2880WinRAR.exeC:\Users\admin\Desktop\C2R-R2V\Convert-C2R.cmdtext
MD5:353CDE65B538019CA139E3E790ABD8CD
SHA256:D450D67F57F2B28EDEB22044D1107E35AF8AC3CC940E79F78B59601A3718B1FB
2880WinRAR.exeC:\Users\admin\Desktop\C2R-R2V\x86\cleanospp.exeexecutable
MD5:5FD363D52D04AC200CD24F3BCC903200
SHA256:3FDEFE2AD092A9A7FE0EDF0AC4DC2DE7E5B9CE6A0804F6511C06564194966CF9
3036cscript.exeC:\Users\admin\AppData\Local\Temp\OffScrubC2R\ScrubRetValFile.txttext
MD5:07DDC9B29E487769E638DA3E8277818E
SHA256:44119689FD681E69B50FF356FACCD21BC3DFBA827564DC1540910E7EE4FED75E
2880WinRAR.exeC:\Users\admin\Desktop\C2R-R2V\x64\msvcr100.dllexecutable
MD5:DF3CA8D16BDED6A54977B30E66864D33
SHA256:1D1A1AE540BA132F998D60D3622F0297B6E86AE399332C3B47462D7C0F560A36
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
C2R-R2V_5.7z