analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Instagram Checker.rar

Full analysis: https://app.any.run/tasks/3e697e89-4380-417c-a30f-8354fc53145e
Verdict: Malicious activity
Analysis date: December 18, 2018, 08:09:22
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

BAE0321EE72C2A560B999905AE5D2952

SHA1:

4B0716E632D4BB131724F6CFEF4B18FC60A5343F

SHA256:

8DE2F445E919925DBB0345E660C0D571FDC4D140CC1BA9C471F891AB4C1FABA9

SSDEEP:

49152:axKQ9WBB+DLgg+uhUmkLk0mbCFjYI4ZcGSlD:aX+B+3zEmF0mCF+cnJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Instagram Checker.exe (PID: 2336)
      • AdobeFlashPlayer.exe (PID: 2212)
    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 1472)
  • SUSPICIOUS

    • Creates files in the user directory

      • Instagram Checker.exe (PID: 2336)
    • Executable content was dropped or overwritten

      • Instagram Checker.exe (PID: 2336)
    • Starts itself from another location

      • Instagram Checker.exe (PID: 2336)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
5
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start winrar.exe no specs searchprotocolhost.exe no specs instagram checker.exe adobeflashplayer.exe no specs regasm.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2852"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Instagram Checker.rar"C:\Program Files\WinRAR\WinRAR.exeexplorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
1472"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe6_ Global\UsGthrCtrlFltPipeMssGthrPipe6 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exeSearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
2336"C:\Users\admin\Desktop\Instagram Checker.exe" C:\Users\admin\Desktop\Instagram Checker.exe
explorer.exe
User:
admin
Company:
VLC media player
Integrity Level:
HIGH
Description:
vlc
Exit code:
0
Version:
3.0.3.0
2212"C:\Users\admin\AppData\Roaming\AdobeFlashPlayer.exe" C:\Users\admin\AppData\Roaming\AdobeFlashPlayer.exeInstagram Checker.exe
User:
admin
Company:
VLC media player
Integrity Level:
HIGH
Description:
vlc
Exit code:
0
Version:
3.0.3.0
3880"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Regasm.exeAdobeFlashPlayer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft .NET Assembly Registration Utility
Version:
4.6.1055.0 built by: NETFXREL2
Total events
789
Read events
765
Write events
24
Delete events
0

Modification events

(PID) Process:(2852) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2852) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2852) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2852) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Instagram Checker.rar
(PID) Process:(2852) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2852) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2852) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2852) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2336) Instagram Checker.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\Run\CurrentVersion
Operation:writeName:AdobeFlashPlayer.exe
Value:
C:\Users\admin\AppData\Roaming\AdobeFlashPlayer.exe
(PID) Process:(2336) Instagram Checker.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
Executable files
1
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2852WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2852.9993\Instagram Checker.exe
MD5:
SHA256:
2852WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2852.9993\Mono.Cecil.dll
MD5:
SHA256:
2336Instagram Checker.exeC:\Users\admin\AppData\Roaming\AdobeFlashPlayer.exeexecutable
MD5:8CC8B79672B864186503BBDB0D551048
SHA256:57812739E2D76FB92CF867096B48857FFFEC757012D65A6A98E64A01699D3F4B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info