File name:

EMV Reader Writer.rar

Full analysis: https://app.any.run/tasks/f1a9be8e-2f55-46f6-a26b-69615054578c
Verdict: Malicious activity
Analysis date: November 11, 2019, 07:39:35
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

6E3225822D9232524718A0BA9E5A6444

SHA1:

DF50F0D271CCD4CCD3B6A17F5207FF273B48741D

SHA256:

928CD49A8F1A71AF7CF632D907382496D71640FC97AD16CA5AA4A800D13A6F83

SSDEEP:

24576:ITYPAZNPaexcrk8t8FXAP/eTLeIQ5ocClD2mgQ0IfDkXzF2hvmD:ITYAiecrJWdAOj5cfIrkXEuD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Emv Reader Writer v8.6.exe (PID: 1244)
      • Emv Reader Writer v8.6.exe (PID: 1416)
      • Emv Reader Writer v8.6.exe (PID: 1012)
      • SynTPHelper.exe (PID: 2520)
      • SynTPHelper.exe (PID: 3044)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1856)
      • Emv Reader Writer v8.6.exe (PID: 1416)
      • SynTPHelper.exe (PID: 2520)

    • Creates files in the Windows directory

      • SynTPHelper.exe (PID: 2520)

    • Starts itself from another location

      • SynTPHelper.exe (PID: 2520)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • WinRAR.exe (PID: 1856)

    • Manual execution by user

      • Emv Reader Writer v8.6.exe (PID: 1416)
      • Emv Reader Writer v8.6.exe (PID: 1244)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
6
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start winrar.exe emv reader writer v8.6.exe no specs emv reader writer v8.6.exe emv reader writer v8.6.exe no specs syntphelper.exe syntphelper.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1012"C:\Users\admin\AppData\Local\Temp\Emv Reader Writer v8.6.exe" C:\Users\admin\AppData\Local\Temp\Emv Reader Writer v8.6.exe—Emv Reader Writer v8.6.exe
User:
admin
Company:
emv-global-solution
Integrity Level:
HIGH
Description:
EMV Reader/Writer v8.6
Exit code:
0
Version:
8.0.0.6
Modules
Images
c:\users\admin\appdata\local\temp\emv reader writer v8.6.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1244"C:\Users\admin\Desktop\EMV Reader Writer\Emv Reader Writer v8.6.exe" C:\Users\admin\Desktop\EMV Reader Writer\Emv Reader Writer v8.6.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\emv reader writer\emv reader writer v8.6.exe
c:\systemroot\system32\ntdll.dll
1416"C:\Users\admin\Desktop\EMV Reader Writer\Emv Reader Writer v8.6.exe" C:\Users\admin\Desktop\EMV Reader Writer\Emv Reader Writer v8.6.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\emv reader writer\emv reader writer v8.6.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
1856"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\EMV Reader Writer.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2520"C:\Users\admin\AppData\Local\Temp\SynTPHelper.exe" C:\Users\admin\AppData\Local\Temp\SynTPHelper.exe
Emv Reader Writer v8.6.exe
User:
admin
Company:
Synaptics Incorporated
Integrity Level:
HIGH
Description:
Synaptics Pointing Device Helper
Exit code:
0
Version:
19.2.17.59 26Apr17
Modules
Images
c:\users\admin\appdata\local\temp\syntphelper.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3044"C:\Windows\SynTPHelper.exe" C:\Windows\SynTPHelper.exe—SynTPHelper.exe
User:
admin
Company:
Synaptics Incorporated
Integrity Level:
HIGH
Description:
Synaptics Pointing Device Helper
Exit code:
0
Version:
19.2.17.59 26Apr17
Modules
Images
c:\windows\syntphelper.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
830
Read events
800
Write events
30
Delete events
0

Modification events

(PID) Process:(1856) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1856) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1856) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1856) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\EMV Reader Writer.rar
(PID) Process:(1856) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1856) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1856) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1856) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1856) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\DialogEditHistory\ExtrPath
Operation:writeName:0
Value:
C:\Users\admin\Desktop
(PID) Process:(1856) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
Executable files
5
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
1856WinRAR.exeC:\Users\admin\Desktop\EMV Reader Writer\EmvManual.rtf —
MD5:—
SHA256:—
1856WinRAR.exeC:\Users\admin\Desktop\EMV Reader Writer\Licente Key.txttext
MD5:—
SHA256:—
1856WinRAR.exeC:\Users\admin\Desktop\EMV Reader Writer\EMV Reader Writer Software V8.exeexecutable
MD5:A03920EC643F26A5D38676C953E6F4F6
SHA256:A1DE7BC1D00660B7416E91442BCB89DCB8A05351EB22F03F89258D9077E69A80
1416Emv Reader Writer v8.6.exeC:\Users\admin\AppData\Local\Temp\Emv Reader Writer v8.6.exeexecutable
MD5:7C32E612D843FA4F2E2129B3EEC7A304
SHA256:8BD2DE3A163F9643431328A81B09B9F1FA6D8FD38AF09286E8FF74D52DA4E60C
1856WinRAR.exeC:\Users\admin\Desktop\EMV Reader Writer\Emv Reader Writer v8.6.exeexecutable
MD5:C0ABD890D3617529EE9CB88744FD4E61
SHA256:EABC84E5138309AD062F89120664436AB14E44E23E746D0672C89DBEBB686073
1416Emv Reader Writer v8.6.exeC:\Users\admin\AppData\Local\Temp\SynTPHelper.exeexecutable
MD5:23D9967B8B71FC6431C16F90CAF111EA
SHA256:1DFD753AE5581A997A6357BEEF12576D40BCBF1B3974059ACFEBEBDB4176D8E7
2520SynTPHelper.exeC:\Windows\SynTPHelper.exeexecutable
MD5:23D9967B8B71FC6431C16F90CAF111EA
SHA256:1DFD753AE5581A997A6357BEEF12576D40BCBF1B3974059ACFEBEBDB4176D8E7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
EMV Reader Writer.rar