download:

DTG_v8_rar

Full analysis: https://app.any.run/tasks/ca8178df-abf7-4a7b-b53b-327d5f682a70
Verdict: Malicious activity
Analysis date: June 11, 2019, 08:47:00
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: text/html
File info: HTML document, UTF-8 Unicode text
MD5:

F6F07596576B17D8B49C0502C2ABB126

SHA1:

41DE6F7C0B4B2B32562DB3A0E6AA73C9CE9EF707

SHA256:

93B2E8A7433E95899E4DA9B97D2DFC87BD4E065F4FF01F4B160BADC6CA1FBCF6

SSDEEP:

192:/hNsPeBQzSlB0Qra684sq1LrwmPfcHWKKa2KgE+1O0X0yiJyQ:pNsPeBQzSlGQef4sq1LrwwcHWKKa2KKA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • DTG.exe (PID: 3384)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2632)

  • INFO

    • Reads internet explorer settings

      • iexplore.exe (PID: 3236)
      • iexplore.exe (PID: 3532)

    • Changes internet zones settings

      • iexplore.exe (PID: 3368)

    • Creates files in the user directory

      • iexplore.exe (PID: 3236)
      • iexplore.exe (PID: 3532)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3236)
      • iexplore.exe (PID: 3368)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3236)
      • iexplore.exe (PID: 3368)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3236)
      • iexplore.exe (PID: 3368)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3236)
      • iexplore.exe (PID: 3532)

    • Application launched itself

      • iexplore.exe (PID: 3368)

    • Dropped object may contain TOR URL's

      • DTG.exe (PID: 3384)
      • WinRAR.exe (PID: 2632)

    • Dropped object may contain Bitcoin addresses

      • DTG.exe (PID: 3384)
      • WinRAR.exe (PID: 2632)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.html | HyperText Markup Language (100)

EXIF

HTML

HTTPEquivXUACompatible: IE=edge
viewport: width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no
Robots: index, follow
Title: DTG v8.rar - AnonFile
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
6
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start iexplore.exe iexplore.exe iexplore.exe winrar.exe notepad.exe no specs dtg.exe

Process information

PID
CMD
Path
Indicators
Parent process
1240"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\Temp\Rar$DIa2632.41792\avatars.txtC:\Windows\system32\NOTEPAD.EXE—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2632"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\8XV11775\DTG_v8[1].rar"C:\Program Files\WinRAR\WinRAR.exe
iexplore.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
3236"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3368 CREDAT:79873C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3368"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\admin\AppData\Local\Temp\DTG_v8_rar.htmlC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3384"C:\Users\admin\AppData\Local\Temp\Rar$EXa2632.42628\DTG v8\DTG.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2632.42628\DTG v8\DTG.exe
WinRAR.exe
User:
admin
Company:
DTG - Discord is a meme
Integrity Level:
MEDIUM
Description:
DTG: Fastest legit token generator.
Exit code:
0
Version:
8
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2632.42628\dtg v8\dtg.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\advapi32.dll
3532"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3368 CREDAT:203009C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
Total events
1 370
Read events
1 224
Write events
137
Delete events
9

Modification events

(PID) Process:(3368) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3368) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3368) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3368) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(3368) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3368) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000071000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(3368) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{8D25823B-8C25-11E9-A09E-5254004A04AF}
Value:
0
(PID) Process:(3368) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Type
Value:
4
(PID) Process:(3368) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Count
Value:
1
(PID) Process:(3368) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Time
Value:
E307060002000B0008002F0021004002
Executable files
1
Suspicious files
0
Text files
18
Unknown types
4

Dropped files

PID
Process
Filename
Type
3368iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\favicon[1].ico —
MD5:—
SHA256:—
3368iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
3532iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\8XV11775\DTG_v8[1].rar —
MD5:—
SHA256:—
3236iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012019061120190612\index.datdat
MD5:—
SHA256:—
3236iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\js[1]text
MD5:—
SHA256:—
3368iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Feeds Cache\desktop.iniini
MD5:4A3DEB274BB5F0212C2419D3D8D08612
SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38
3236iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\html5shiv.min[1].jshtml
MD5:40BD440D29B3A9371B0C63FEC41EE64F
SHA256:DC9CBF19B48BAE0D28F72E59E67D6EC34AB1644087EC2E8E42954180D1586B48
3368iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\favicon[1].pngimage
MD5:9FB559A691078558E77D6848202F6541
SHA256:6D8A01DC7647BC218D003B58FE04049E24A9359900B7E0CEBAE76EDF85B8B914
3532iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.datdat
MD5:—
SHA256:—
3532iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012019061120190612\index.datdat
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7 586
TCP/UDP connections
18 905
DNS requests
8
Threats
39

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3384
DTG.exe
CONNECT
—
37.235.238.93:8080
http://37.235.238.93:8080discordapp.com:443
RU
—
—
unknown
3384
DTG.exe
CONNECT
—
54.39.24.37:3128
http://54.39.24.37:3128discordapp.com:443
FR
—
—
unknown
3384
DTG.exe
CONNECT
—
181.94.195.65:8080
http://181.94.195.65:8080discordapp.com:443
AR
—
—
unknown
3384
DTG.exe
CONNECT
—
87.121.77.67:4145
http://87.121.77.67:4145discordapp.com:443
BG
—
—
suspicious
3384
DTG.exe
CONNECT
—
95.65.89.96:32321
http://95.65.89.96:32321discordapp.com:443
MD
—
—
suspicious
3384
DTG.exe
CONNECT
—
149.5.39.93:8080
http://149.5.39.93:8080discordapp.com:443
IE
—
—
unknown
3384
DTG.exe
CONNECT
—
79.101.42.13:8080
http://79.101.42.13:8080discordapp.com:443
RS
—
—
unknown
3384
DTG.exe
CONNECT
—
112.25.6.24:80
http://112.25.6.24:80discordapp.com:443
CN
—
—
unknown
3384
DTG.exe
CONNECT
—
217.170.251.94:80
http://217.170.251.94:80discordapp.com:443
IR
—
—
unknown
3384
DTG.exe
CONNECT
—
202.121.178.244:80
http://202.121.178.244:80discordapp.com:443
CN
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3368
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
4
System
151.101.2.217:445
vjs.zencdn.net
Fastly
US
suspicious
4
System
151.101.194.217:445
vjs.zencdn.net
Fastly
US
suspicious
—
—
151.101.194.217:137
vjs.zencdn.net
Fastly
US
suspicious
3236
iexplore.exe
23.111.8.154:443
oss.maxcdn.com
netDNA
US
unknown
3236
iexplore.exe
172.217.16.168:443
www.googletagmanager.com
Google Inc.
US
whitelisted
3236
iexplore.exe
104.18.38.148:443
shermore.info
Cloudflare Inc
US
shared
3532
iexplore.exe
194.32.146.105:443
cdn-05.anonfile.com
—
—
unknown
3384
DTG.exe
104.28.20.45:443
wumpuses.xyz
Cloudflare Inc
US
shared
4
System
151.101.66.217:445
vjs.zencdn.net
Fastly
US
suspicious

DNS requests

Domain
IP
Reputation
vjs.zencdn.net
  • 151.101.2.217
  • 151.101.66.217
  • 151.101.130.217
  • 151.101.194.217
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
oss.maxcdn.com
  • 23.111.8.154
whitelisted
www.googletagmanager.com
  • 172.217.16.168
whitelisted
shermore.info
  • 104.18.38.148
  • 104.18.39.148
whitelisted
cdn-05.anonfile.com
  • 194.32.146.105
suspicious
wumpuses.xyz
  • 104.28.20.45
  • 104.28.21.45
malicious

Threats

PID
Process
Class
Message
3384
DTG.exe
Potentially Bad Traffic
ET POLICY HTTP traffic on port 443 (CONNECT)
3384
DTG.exe
Potentially Bad Traffic
ET POLICY HTTP traffic on port 443 (CONNECT)
3384
DTG.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 6
3384
DTG.exe
Potentially Bad Traffic
ET POLICY HTTP traffic on port 443 (CONNECT)
3384
DTG.exe
Potentially Bad Traffic
ET POLICY HTTP traffic on port 443 (CONNECT)
3384
DTG.exe
Potentially Bad Traffic
ET POLICY HTTP traffic on port 443 (CONNECT)
3384
DTG.exe
Potentially Bad Traffic
ET POLICY HTTP traffic on port 443 (CONNECT)
3384
DTG.exe
Potentially Bad Traffic
ET POLICY HTTP traffic on port 443 (CONNECT)
3384
DTG.exe
Misc Attack
ET TOR Known Tor Exit Node Traffic group 19
3384
DTG.exe
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 19
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
DTG_v8_rar