analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
download:

DTG_v8_rar

Full analysis: https://app.any.run/tasks/ca8178df-abf7-4a7b-b53b-327d5f682a70
Verdict: Malicious activity
Analysis date: June 11, 2019, 08:47:00
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: text/html
File info: HTML document, UTF-8 Unicode text
MD5:

F6F07596576B17D8B49C0502C2ABB126

SHA1:

41DE6F7C0B4B2B32562DB3A0E6AA73C9CE9EF707

SHA256:

93B2E8A7433E95899E4DA9B97D2DFC87BD4E065F4FF01F4B160BADC6CA1FBCF6

SSDEEP:

192:/hNsPeBQzSlB0Qra684sq1LrwmPfcHWKKa2KgE+1O0X0yiJyQ:pNsPeBQzSlGQef4sq1LrwwcHWKKa2KKA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • DTG.exe (PID: 3384)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2632)

  • INFO

    • Reads internet explorer settings

      • iexplore.exe (PID: 3236)
      • iexplore.exe (PID: 3532)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3236)
      • iexplore.exe (PID: 3532)

    • Creates files in the user directory

      • iexplore.exe (PID: 3236)
      • iexplore.exe (PID: 3532)

    • Application launched itself

      • iexplore.exe (PID: 3368)

    • Changes internet zones settings

      • iexplore.exe (PID: 3368)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3236)
      • iexplore.exe (PID: 3368)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3236)
      • iexplore.exe (PID: 3368)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3236)
      • iexplore.exe (PID: 3368)

    • Dropped object may contain TOR URL's

      • DTG.exe (PID: 3384)
      • WinRAR.exe (PID: 2632)

    • Dropped object may contain Bitcoin addresses

      • DTG.exe (PID: 3384)
      • WinRAR.exe (PID: 2632)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.html | HyperText Markup Language (100)

EXIF

HTML

Title: DTG v8.rar - AnonFile
Robots: index, follow
viewport: width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no
HTTPEquivXUACompatible: IE=edge
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
6
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start iexplore.exe iexplore.exe iexplore.exe winrar.exe notepad.exe no specs dtg.exe

Process information

PID
CMD
Path
Indicators
Parent process
3368"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\admin\AppData\Local\Temp\DTG_v8_rar.htmlC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3236"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3368 CREDAT:79873C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3532"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3368 CREDAT:203009C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2632"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\8XV11775\DTG_v8[1].rar"C:\Program Files\WinRAR\WinRAR.exe
iexplore.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
1240"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\Temp\Rar$DIa2632.41792\avatars.txtC:\Windows\system32\NOTEPAD.EXE—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3384"C:\Users\admin\AppData\Local\Temp\Rar$EXa2632.42628\DTG v8\DTG.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2632.42628\DTG v8\DTG.exe
WinRAR.exe
User:
admin
Company:
DTG - Discord is a meme
Integrity Level:
MEDIUM
Description:
DTG: Fastest legit token generator.
Version:
8
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2632.42628\dtg v8\dtg.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\advapi32.dll
Total events
1 370
Read events
1 224
Write events
137
Delete events
9

Modification events

(PID) Process:(3368) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3368) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3368) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3368) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(3368) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3368) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000071000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(3368) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{8D25823B-8C25-11E9-A09E-5254004A04AF}
Value:
0
(PID) Process:(3368) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Type
Value:
4
(PID) Process:(3368) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Count
Value:
1
(PID) Process:(3368) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Time
Value:
E307060002000B0008002F0021004002
Executable files
1
Suspicious files
0
Text files
18
Unknown types
4

Dropped files

PID
Process
Filename
Type
3368iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\favicon[1].ico —
MD5:—
SHA256:—
3368iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
3532iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\8XV11775\DTG_v8[1].rar —
MD5:—
SHA256:—
3236iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\js[1]text
MD5:9A5D17AB36BEFDDAF5C1E2282FC7B2A1
SHA256:EBDE216A39A42EF8620C2C73265AC9E6F11925072296227B38D79D478551215A
3236iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012019061120190612\index.datdat
MD5:0D4978D62103FFEB8C3FEBE098692CE6
SHA256:BE3B086081B246010D036261AD9D33826BBCD87D59A443B5B164D090C4F88F09
3532iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.datdat
MD5:C47214253016F73CB0E0957B3FBD1940
SHA256:1F4AC7E3B48274A49FF97C7A03D29BF9F6567340304F47E76CC7DFCEBB20755E
3532iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\desktop.iniini
MD5:4A3DEB274BB5F0212C2419D3D8D08612
SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38
3532iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\8XV11775\desktop.iniini
MD5:4A3DEB274BB5F0212C2419D3D8D08612
SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38
3368iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Feeds Cache\desktop.iniini
MD5:4A3DEB274BB5F0212C2419D3D8D08612
SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38
3532iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\1I4HW4ZG\desktop.iniini
MD5:4A3DEB274BB5F0212C2419D3D8D08612
SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7 586
TCP/UDP connections
18 905
DNS requests
8
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3384
DTG.exe
CONNECT
—
202.121.178.244:80
http://202.121.178.244:80discordapp.com:443
CN
—
—
unknown
3384
DTG.exe
CONNECT
—
134.119.188.150:8080
http://134.119.188.150:8080discordapp.com:443
FR
—
—
unknown
3384
DTG.exe
CONNECT
—
35.221.163.22:80
http://35.221.163.22:80discordapp.com:443
US
—
—
unknown
3384
DTG.exe
CONNECT
—
95.65.89.96:32321
http://95.65.89.96:32321discordapp.com:443
MD
—
—
suspicious
3384
DTG.exe
CONNECT
—
54.39.24.37:3128
http://54.39.24.37:3128discordapp.com:443
FR
—
—
unknown
3384
DTG.exe
CONNECT
—
217.170.251.94:80
http://217.170.251.94:80discordapp.com:443
IR
—
—
unknown
3384
DTG.exe
CONNECT
—
112.25.6.24:80
http://112.25.6.24:80discordapp.com:443
CN
—
—
unknown
3384
DTG.exe
CONNECT
—
37.235.238.93:8080
http://37.235.238.93:8080discordapp.com:443
RU
—
—
unknown
3384
DTG.exe
CONNECT
—
87.121.77.67:4145
http://87.121.77.67:4145discordapp.com:443
BG
—
—
suspicious
3384
DTG.exe
CONNECT
—
181.94.195.65:8080
http://181.94.195.65:8080discordapp.com:443
AR
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3368
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
4
System
151.101.2.217:445
vjs.zencdn.net
Fastly
US
suspicious
—
—
151.101.194.217:137
vjs.zencdn.net
Fastly
US
suspicious
4
System
151.101.66.217:445
vjs.zencdn.net
Fastly
US
suspicious
4
System
151.101.130.217:445
vjs.zencdn.net
Fastly
US
suspicious
4
System
151.101.194.217:445
vjs.zencdn.net
Fastly
US
suspicious
3236
iexplore.exe
23.111.8.154:443
oss.maxcdn.com
netDNA
US
unknown
3384
DTG.exe
104.28.20.45:443
wumpuses.xyz
Cloudflare Inc
US
shared
3532
iexplore.exe
194.32.146.105:443
cdn-05.anonfile.com
—
—
unknown
3236
iexplore.exe
172.217.16.168:443
www.googletagmanager.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
vjs.zencdn.net
  • 151.101.2.217
  • 151.101.66.217
  • 151.101.130.217
  • 151.101.194.217
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
oss.maxcdn.com
  • 23.111.8.154
whitelisted
www.googletagmanager.com
  • 172.217.16.168
whitelisted
shermore.info
  • 104.18.38.148
  • 104.18.39.148
whitelisted
cdn-05.anonfile.com
  • 194.32.146.105
suspicious
wumpuses.xyz
  • 104.28.20.45
  • 104.28.21.45
malicious

Threats

PID
Process
Class
Message
3384
DTG.exe
Potentially Bad Traffic
ET POLICY HTTP traffic on port 443 (CONNECT)
3384
DTG.exe
Potentially Bad Traffic
ET POLICY HTTP traffic on port 443 (CONNECT)
3384
DTG.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 6
3384
DTG.exe
Potentially Bad Traffic
ET POLICY HTTP traffic on port 443 (CONNECT)
3384
DTG.exe
Potentially Bad Traffic
ET POLICY HTTP traffic on port 443 (CONNECT)
3384
DTG.exe
Potentially Bad Traffic
ET POLICY HTTP traffic on port 443 (CONNECT)
3384
DTG.exe
Potentially Bad Traffic
ET POLICY HTTP traffic on port 443 (CONNECT)
3384
DTG.exe
Potentially Bad Traffic
ET POLICY HTTP traffic on port 443 (CONNECT)
3384
DTG.exe
Misc Attack
ET TOR Known Tor Exit Node Traffic group 19
3384
DTG.exe
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 19
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
DTG_v8_rar