analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Downloads.rar

Full analysis: https://app.any.run/tasks/31fa9631-d54f-469c-a82f-783e1b8b235c
Verdict: Malicious activity
Analysis date: April 25, 2019, 13:03:13
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

E88F2E315D963804F92DDEA245FCF8AB

SHA1:

57765ACF25E6A736DD3541449FE57D156C563291

SHA256:

818EE6ED1AD91E043B382D6E52EC65698981F1AD03E38AD51C5C1458A3385E6B

SSDEEP:

24576:0aGFsrqSJhN/IKexXsPu2XOAHmM/dbrsfG373GBTSwWvCUrsklgDGilszYGB2:0aOsrqMn/IKCXb2qM/xr337WJSwW6UJY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • OrangeHeap.exe (PID: 2988)

    • Loads dropped or rewritten executable

      • OrangeHeap.exe (PID: 2988)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 1300)
      • msiexec.exe (PID: 1212)
      • WinRAR.exe (PID: 2112)

    • Creates files in the user directory

      • msiexec.exe (PID: 1212)
      • MsiExec.exe (PID: 2728)

  • INFO

    • Searches for installed software

      • msiexec.exe (PID: 1212)

    • Adds / modifies Windows certificates

      • DrvInst.exe (PID: 1956)

    • Application launched itself

      • msiexec.exe (PID: 1212)

    • Changes settings of System certificates

      • DrvInst.exe (PID: 1956)

    • Low-level read access rights to disk partition

      • vssvc.exe (PID: 1360)

    • Creates files in the program directory

      • msiexec.exe (PID: 1212)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 1212)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
46
Monitored processes
10
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs msiexec.exe msiexec.exe msiexec.exe no specs vssvc.exe no specs winrar.exe drvinst.exe no specs msiexec.exe no specs msiexec.exe no specs orangeheap.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3848"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Downloads.rar"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
1300"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\Desktop\123.msi" C:\Windows\System32\msiexec.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
1212C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
2800C:\Windows\system32\MsiExec.exe -Embedding F5AA4781185C9686C4F8CFA456A7678E CC:\Windows\system32\MsiExec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
1360C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2112"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Desktop\service.bin.zip" C:\Users\admin\Desktop\service.bin\C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
1956DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot18" "" "" "6792c44eb" "00000000" "000005C4" "00000580"C:\Windows\system32\DrvInst.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
252C:\Windows\system32\MsiExec.exe -Embedding 0E03A4FCF1A75E8129E549A8C0C21CC0C:\Windows\system32\MsiExec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
2728C:\Windows\system32\MsiExec.exe -Embedding 260F541B914B5F27B7D0429952ECAD58 M Global\MSI0000C:\Windows\system32\MsiExec.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
2988"C:\Program Files\Orange Heap\OrangeHeap.exe" C:\Program Files\Orange Heap\OrangeHeap.exe—explorer.exe
User:
admin
Company:
Mikalai Kalpinski
Integrity Level:
MEDIUM
Description:
OrangeHeap
Version:
1.3.29.0
Total events
1 819
Read events
1 485
Write events
0
Delete events
0

Modification events

No data
Executable files
16
Suspicious files
7
Text files
80
Unknown types
4

Dropped files

PID
Process
Filename
Type
3848WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3848.43149\123.msi —
MD5:—
SHA256:—
3848WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3848.43149\service.bin.zip —
MD5:—
SHA256:—
1212msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
1212msiexec.exeC:\System Volume Information\SPP\OnlineMetadataCache\{0ace3409-57f5-47cf-b0e8-a1d11ce1f772}_OnDiskSnapshotPropbinary
MD5:388DC18FB2343496E475E82A00A64166
SHA256:DA5A1D0F14D1E3A19E545B8AB69761093DF0441D92C8058539F6E016B81EB91A
1956DrvInst.exeC:\Windows\INF\setupapi.dev.logini
MD5:13B78692885FCBBD9FF8CC4E5CD79649
SHA256:8976D13143462A91E4DFAF73F9B9B129A6F5E6BD93A60DA69DFAED2F175EBC30
1956DrvInst.exeC:\Windows\INF\setupapi.ev3binary
MD5:76DCC60F78B3DFF1AE3627619074F465
SHA256:18541AC1875315C4F9EFF75050C574FAFF83717C029DAE6B366F9C6C3F0C19E0
1212msiexec.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:388DC18FB2343496E475E82A00A64166
SHA256:DA5A1D0F14D1E3A19E545B8AB69761093DF0441D92C8058539F6E016B81EB91A
1956DrvInst.exeC:\Windows\INF\setupapi.ev1binary
MD5:98D1B81486A0A380637B106B908B73EE
SHA256:10B13245F22854D4D93DB6C4723340A9775B3E224E619E95D06DE0E647FB9765
1212msiexec.exeC:\Users\admin\AppData\Local\Temp\~DF5B8E6DE6A76A7BBD.TMP —
MD5:—
SHA256:—
1212msiexec.exeC:\Windows\Installer\MSID89B.tmp —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Downloads.rar