analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
download:

unhackmeb.zip

Full analysis: https://app.any.run/tasks/1dc400fb-541b-4c9c-890e-82e887ff4149
Verdict: Malicious activity
Analysis date: November 15, 2018, 11:23:05
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
miner
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

1B943C8DD6C470440F38FF2521596C8E

SHA1:

DCB6E51EEB014E42B60103636701998F73D3E543

SHA256:

8D3ABCF61676F676D9EF869FAD41B8243AAAEEA8D45122978F8764709A717AAB

SSDEEP:

393216:S1XqrzEiFPPVEH3UscxXOtmX+GVjE1kqoKveVJ6Lv+0:kXqvEiRNEH3UFXWQTFlqeHyvt

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • unhackme_setup.exe (PID: 2316)
      • unhackme_setup.exe (PID: 1968)
      • reanimator.exe (PID: 1180)
      • Unhackme.exe (PID: 456)
      • reanimator.exe (PID: 236)
      • hackmon.exe (PID: 2284)
      • unhackmeschedule.exe (PID: 256)
      • regruninfo.exe (PID: 1960)
      • wu.exe (PID: 1320)
      • mozlz4d.exe (PID: 4068)
      • ShowTrayIcon.exe (PID: 1684)
      • regruninfo.exe (PID: 1216)
      • wu.exe (PID: 2192)

    • Loads the Task Scheduler COM API

      • unhackmeschedule.exe (PID: 256)

    • Loads dropped or rewritten executable

      • reanimator.exe (PID: 1180)
      • reanimator.exe (PID: 236)

    • Changes settings of System certificates

      • regruninfo.exe (PID: 1960)
      • reanimator.exe (PID: 236)

    • Loads the Task Scheduler DLL interface

      • reanimator.exe (PID: 236)

    • Actions looks like stealing of personal data

      • reanimator.exe (PID: 236)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2416)
      • unhackme_setup.exe (PID: 1968)
      • unhackme_setup.exe (PID: 2316)
      • unhackme_setup.tmp (PID: 2952)

    • Dropped object may contain URLs of mainers pools

      • unhackme_setup.tmp (PID: 2952)

    • Creates files in the Windows directory

      • unhackme_setup.tmp (PID: 2952)
      • Unhackme.exe (PID: 456)

    • Creates files in the driver directory

      • unhackme_setup.tmp (PID: 2952)
      • Unhackme.exe (PID: 456)

    • Uses NETSH.EXE for network configuration

      • unhackme_setup.tmp (PID: 2952)

    • Modifies the open verb of a shell class

      • unhackme_setup.tmp (PID: 2952)

    • Creates files in the program directory

      • reanimator.exe (PID: 1180)
      • wu.exe (PID: 1320)
      • reanimator.exe (PID: 236)
      • wu.exe (PID: 2192)

    • Creates COM task schedule object

      • Unhackme.exe (PID: 456)

    • Adds / modifies Windows certificates

      • regruninfo.exe (PID: 1960)
      • reanimator.exe (PID: 236)

    • Low-level read access rights to disk partition

      • reanimator.exe (PID: 236)

    • Searches for installed software

      • reanimator.exe (PID: 236)

    • Creates files in the user directory

      • regruninfo.exe (PID: 1216)

  • INFO

    • Loads dropped or rewritten executable

      • unhackme_setup.tmp (PID: 2952)

    • Application was dropped or rewritten from another process

      • unhackme_setup.tmp (PID: 1460)
      • unhackme_setup.tmp (PID: 2952)

    • Dropped object may contain Bitcoin addresses

      • unhackme_setup.tmp (PID: 2952)
      • regruninfo.exe (PID: 1216)
      • reanimator.exe (PID: 236)

    • Creates files in the program directory

      • unhackme_setup.tmp (PID: 2952)

    • Dropped object may contain TOR URL's

      • unhackme_setup.tmp (PID: 2952)
      • Unhackme.exe (PID: 456)
      • reanimator.exe (PID: 236)

    • Creates a software uninstall entry

      • unhackme_setup.tmp (PID: 2952)

    • Low-level read access rights to disk partition

      • vssvc.exe (PID: 2660)

    • Reads settings of System Certificates

      • reanimator.exe (PID: 236)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: unhackme_setup.exe
ZipUncompressedSize: 18413360
ZipCompressedSize: 18388007
ZipCRC: 0x32531705
ZipModifyDate: 2018:11:15 11:38:21
ZipCompression: Deflated
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
64
Monitored processes
21
Malicious processes
6
Suspicious processes
3

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start winrar.exe unhackme_setup.exe unhackme_setup.tmp no specs unhackme_setup.exe unhackme_setup.tmp netsh.exe no specs netsh.exe no specs unhackmeschedule.exe no specs reanimator.exe no specs regruninfo.exe unhackme.exe no specs hackmon.exe no specs showtrayicon.exe no specs reanimator.exe wu.exe mozlz4d.exe no specs avgwdsvc.exe no specs regruninfo.exe wu.exe vssvc.exe no specs drvinst.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2416"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\unhackmeb.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
2316"C:\Users\admin\AppData\Local\Temp\Rar$EXa2416.4466\unhackme_setup.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2416.4466\unhackme_setup.exe
WinRAR.exe
User:
admin
Company:
Greatis Software, LLC.
Integrity Level:
MEDIUM
Description:
UnHackMe Setup
Exit code:
0
Version:
10.0.0.750
1460"C:\Users\admin\AppData\Local\Temp\is-3775G.tmp\unhackme_setup.tmp" /SL5="$1F0382,18149027,56832,C:\Users\admin\AppData\Local\Temp\Rar$EXa2416.4466\unhackme_setup.exe" C:\Users\admin\AppData\Local\Temp\is-3775G.tmp\unhackme_setup.tmp—unhackme_setup.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.52.0.0
1968"C:\Users\admin\AppData\Local\Temp\Rar$EXa2416.4466\unhackme_setup.exe" /SPAWNWND=$1B0118 /NOTIFYWND=$1F0382 C:\Users\admin\AppData\Local\Temp\Rar$EXa2416.4466\unhackme_setup.exe
unhackme_setup.tmp
User:
admin
Company:
Greatis Software, LLC.
Integrity Level:
HIGH
Description:
UnHackMe Setup
Exit code:
0
Version:
10.0.0.750
2952"C:\Users\admin\AppData\Local\Temp\is-UIH4H.tmp\unhackme_setup.tmp" /SL5="$8068C,18149027,56832,C:\Users\admin\AppData\Local\Temp\Rar$EXa2416.4466\unhackme_setup.exe" /SPAWNWND=$1B0118 /NOTIFYWND=$1F0382 C:\Users\admin\AppData\Local\Temp\is-UIH4H.tmp\unhackme_setup.tmp
unhackme_setup.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.52.0.0
2144"netsh.exe" firewall add allowedprogram program="C:\Program Files\UnHackMe\wu.exe" name="UnHackMe Updater" mode=ENABLE profile=CURRENTC:\Windows\system32\netsh.exe—unhackme_setup.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3552"netsh.exe" firewall add allowedprogram program="C:\Program Files\UnHackMe\regruninfo.exe" name="UnHackMe Info" mode=ENABLE profile=CURRENTC:\Windows\system32\netsh.exe—unhackme_setup.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
256"C:\Program Files\UnHackMe\unhackmeschedule.exe"C:\Program Files\UnHackMe\unhackmeschedule.exe—unhackme_setup.tmp
User:
admin
Company:
Greatis Software
Integrity Level:
HIGH
Description:
UnHackMe Schedule Creator
Exit code:
0
Version:
5, 0, 9, 9
1180"C:\Program Files\UnHackMe\reanimator.exe" /cC:\Program Files\UnHackMe\reanimator.exe—unhackme_setup.tmp
User:
admin
Company:
Greatis Software
Integrity Level:
HIGH
Description:
RegRun Start Control
Exit code:
0
Version:
10.0.0.750
1960"C:\Program Files\UnHackMe\regruninfo.exe" /postinsC:\Program Files\UnHackMe\regruninfo.exe
unhackme_setup.tmp
User:
admin
Company:
Greatis Software
Integrity Level:
HIGH
Description:
Module for retrieving file info from Internet
Exit code:
0
Version:
10.0.0.750
Total events
5 022
Read events
2 851
Write events
0
Delete events
0

Modification events

No data
Executable files
22
Suspicious files
142
Text files
542
Unknown types
22

Dropped files

PID
Process
Filename
Type
2952unhackme_setup.tmpC:\Program Files\UnHackMe\is-I1MEQ.tmp —
MD5:—
SHA256:—
2952unhackme_setup.tmpC:\Program Files\UnHackMe\is-IDRJH.tmp —
MD5:—
SHA256:—
2952unhackme_setup.tmpC:\Program Files\UnHackMe\is-2PMPD.tmp —
MD5:—
SHA256:—
2952unhackme_setup.tmpC:\Program Files\UnHackMe\is-GMDU1.tmp —
MD5:—
SHA256:—
2952unhackme_setup.tmpC:\Program Files\UnHackMe\is-CSLPD.tmp —
MD5:—
SHA256:—
2952unhackme_setup.tmpC:\Program Files\UnHackMe\is-7P9NE.tmp —
MD5:—
SHA256:—
2952unhackme_setup.tmpC:\Program Files\UnHackMe\is-9OKNR.tmp —
MD5:—
SHA256:—
2952unhackme_setup.tmpC:\Program Files\UnHackMe\is-IOOD6.tmp —
MD5:—
SHA256:—
2952unhackme_setup.tmpC:\Program Files\UnHackMe\is-F5HO4.tmp —
MD5:—
SHA256:—
2952unhackme_setup.tmpC:\Program Files\UnHackMe\is-LARG1.tmp —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
14
DNS requests
6
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1320
wu.exe
GET
200
208.76.245.34:80
http://greatis.com/dbs.ini
US
text
386 b
whitelisted
1960
regruninfo.exe
GET
200
2.16.186.81:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
unknown
compressed
54.4 Kb
whitelisted
2192
wu.exe
GET
200
208.76.245.34:80
http://greatis.com/dbs.ini
US
text
386 b
whitelisted
2192
wu.exe
GET
200
208.76.245.34:80
http://greatis.com/unhackme.ini
US
text
394 b
whitelisted
1960
regruninfo.exe
GET
200
54.192.94.69:80
http://x.ss2.us/x.cer
US
der
1.27 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1960
regruninfo.exe
2.16.186.81:80
www.download.windowsupdate.com
Akamai International B.V.
—
whitelisted
1960
regruninfo.exe
52.54.253.2:443
api.gameanalytics.com
Amazon.com, Inc.
US
unknown
1320
wu.exe
208.76.245.34:80
greatis.com
Crucial Paradigm
US
malicious
1216
regruninfo.exe
74.125.34.46:443
www.virustotal.com
Google Inc.
US
whitelisted
2192
wu.exe
208.76.245.34:80
greatis.com
Crucial Paradigm
US
malicious
1960
regruninfo.exe
54.192.94.69:80
x.ss2.us
Amazon.com, Inc.
US
unknown

DNS requests

Domain
IP
Reputation
api.gameanalytics.com
  • 52.54.253.2
  • 54.173.31.208
  • 52.45.142.230
  • 52.4.92.249
  • 54.164.77.73
  • 52.22.251.3
  • 54.173.134.93
  • 52.3.28.175
suspicious
x.ss2.us
  • 54.192.94.69
  • 54.192.94.3
  • 54.192.94.203
  • 54.192.94.252
whitelisted
www.download.windowsupdate.com
  • 2.16.186.81
  • 2.16.186.56
whitelisted
greatis.com
  • 208.76.245.34
whitelisted
www.virustotal.com
  • 74.125.34.46
whitelisted

Threats

PID
Process
Class
Message
1320
wu.exe
A Network Trojan was detected
ET USER_AGENTS Suspicious User-Agent Mozilla/3.0
2192
wu.exe
A Network Trojan was detected
ET USER_AGENTS Suspicious User-Agent Mozilla/3.0
2192
wu.exe
A Network Trojan was detected
ET USER_AGENTS Suspicious User-Agent Mozilla/3.0
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
unhackmeb.zip