analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://anonfile.com/b8LfJfubo6/Release_rar

Full analysis: https://app.any.run/tasks/dbc6c62a-667f-41b5-bb3f-e232782287bc
Verdict: Malicious activity
Analysis date: August 08, 2020, 10:33:06
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

67C9EABF44D28BEC7497AB65BD35EFE5

SHA1:

A8FC0F60D5A8CBB2382ABB322DEE3CF9BB3BDE76

SHA256:

831BBA6939EAB28F8F8E982670DABE7E945D5BD5D7531E6FE74738AB4826B2A5

SSDEEP:

3:N8RGQdui1X:2gDyX

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • DBD20RANK Nitro Keygen.exe (PID: 2904)
      • DBD20RANK Nitro Keygen.exe (PID: 3224)
      • DBD20RANK Nitro Keygen.exe (PID: 3500)

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 3856)
      • DBD20RANK Nitro Keygen.exe (PID: 3224)
      • explorer.exe (PID: 352)
      • DBD20RANK Nitro Keygen.exe (PID: 2904)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 4092)
      • explorer.exe (PID: 352)

    • Creates files in the user directory

      • explorer.exe (PID: 352)

  • INFO

    • Reads settings of System Certificates

      • chrome.exe (PID: 2728)

    • Reads the hosts file

      • chrome.exe (PID: 2772)
      • chrome.exe (PID: 2728)

    • Reads Internet Cache Settings

      • chrome.exe (PID: 2772)

    • Manual execution by user

      • DBD20RANK Nitro Keygen.exe (PID: 3224)
      • DBD20RANK Nitro Keygen.exe (PID: 2904)

    • Application launched itself

      • chrome.exe (PID: 2772)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
73
Monitored processes
28
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs winrar.exe chrome.exe no specs searchprotocolhost.exe no specs dbd20rank nitro keygen.exe no specs chrome.exe no specs chrome.exe no specs dbd20rank nitro keygen.exe no specs explorer.exe dbd20rank nitro keygen.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2772"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://anonfile.com/b8LfJfubo6/Release_rar"C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
3924"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=75.0.3770.100 --initial-client-data=0x7c,0x80,0x84,0x78,0x88,0x6e99a9d0,0x6e99a9e0,0x6e99a9ecC:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
2956"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=2768 --on-initialized-event-handle=324 --parent-handle=328 /prefetch:6C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
2692"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1000,17259752005644937367,3368519032226211485,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=9131227847314220895 --mojo-platform-channel-handle=1024 --ignored=" --type=renderer " /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
75.0.3770.100
2728"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1000,17259752005644937367,3368519032226211485,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --service-request-channel-token=15361348508712109955 --mojo-platform-channel-handle=1644 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
3172"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1000,17259752005644937367,3368519032226211485,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=5935721319481562169 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2252 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
75.0.3770.100
1124"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1000,17259752005644937367,3368519032226211485,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=1471565204044166549 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2256 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
2672"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1000,17259752005644937367,3368519032226211485,131072 --enable-features=PasswordImport --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=7177344610979112146 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2436 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
2820"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1000,17259752005644937367,3368519032226211485,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=10053718659794300587 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
792"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1000,17259752005644937367,3368519032226211485,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=16973830809192342851 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3076 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Total events
6 085
Read events
5 771
Write events
0
Delete events
0

Modification events

No data
Executable files
13
Suspicious files
55
Text files
88
Unknown types
9

Dropped files

PID
Process
Filename
Type
2772chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000032.dbtmp —
MD5:—
SHA256:—
2772chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\3f5c5b31-7b08-4c7c-97a4-e9b2e1ec117f.tmp —
MD5:—
SHA256:—
2772chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase\LOG.old —
MD5:—
SHA256:—
2772chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG.old —
MD5:—
SHA256:—
2772chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\LOG.old —
MD5:—
SHA256:—
2772chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.oldtext
MD5:988975E56D776333B46F1BCAE6967C0E
SHA256:22186F0422A02BE70860975EF688A895EEA653C3A7259FFBA9114138A544E05A
2772chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG.oldtext
MD5:142AFC7F980CB38310D0680F2E8907CF
SHA256:3D5E5DF95E28CF65C77882748077EC52706AF02F8D869E188B6D16F782F82F44
2772chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB\LOG.oldtext
MD5:AFDDC99E148FD40EED8086EE532B61C4
SHA256:3F1C412561D08C113C1561C9D273FBA00DAB5481B4AC1428FCC91D9285BA7E1E
2772chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG.old~RF191246.TMPtext
MD5:142AFC7F980CB38310D0680F2E8907CF
SHA256:3D5E5DF95E28CF65C77882748077EC52706AF02F8D869E188B6D16F782F82F44
2772chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.oldtext
MD5:D11C35B3D5258F594933332C11C6F0F2
SHA256:DC2EB16E16FA3FB258AC31A481F817208CF0C917AF4224F2832588D3A64ADD05
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
25
DNS requests
20
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2728
chrome.exe
151.101.2.217:443
vjs.zencdn.net
Fastly
US
suspicious
2728
chrome.exe
143.204.201.80:443
antrademic.club
—
US
malicious
2728
chrome.exe
35.227.196.138:443
www.performanceonclick.com
—
US
suspicious
2728
chrome.exe
172.217.22.78:443
clients2.google.com
Google Inc.
US
whitelisted
—
—
172.217.18.163:443
ssl.gstatic.com
Google Inc.
US
whitelisted
2728
chrome.exe
172.217.16.141:443
accounts.google.com
Google Inc.
US
suspicious
2728
chrome.exe
216.58.207.35:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
2728
chrome.exe
172.64.174.29:443
anonfiles.com
Cloudflare Inc
US
shared
2728
chrome.exe
54.144.3.29:443
baconaces.pro
Amazon.com, Inc.
US
suspicious
2728
chrome.exe
52.84.114.10:443
providentsopport.site
Amazon.com, Inc.
US
unknown

DNS requests

Domain
IP
Reputation
anonfile.com
  • 45.148.16.42
  • 45.148.16.46
whitelisted
clientservices.googleapis.com
  • 216.58.207.35
whitelisted
accounts.google.com
  • 172.217.16.141
shared
anonfiles.com
  • 172.64.174.29
  • 172.64.175.29
shared
vjs.zencdn.net
  • 151.101.2.217
  • 151.101.66.217
  • 151.101.130.217
  • 151.101.194.217
whitelisted
djv99sxoqpv11.cloudfront.net
  • 13.35.253.58
  • 13.35.253.164
  • 13.35.253.123
  • 13.35.253.162
shared
baconaces.pro
  • 54.144.3.29
  • 52.206.71.220
  • 54.237.125.12
  • 34.196.151.230
  • 52.86.219.129
shared
porchiteds.club
  • 143.204.201.90
  • 143.204.201.100
  • 143.204.201.114
  • 143.204.201.55
malicious
antrademic.club
  • 143.204.201.80
  • 143.204.201.64
  • 143.204.201.26
  • 143.204.201.101
malicious
providentsopport.site
  • 52.84.114.10
  • 52.84.114.7
  • 52.84.114.8
  • 52.84.114.129
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://anonfile.com/b8LfJfubo6/Release_rar