File name:

Ancalog Exploit Builder AchillePower.rar

Full analysis: https://app.any.run/tasks/9d189b71-9cd4-44d2-b67f-936083dc9069
Verdict: Malicious activity
Threats:

Hawkeye often gets installed in a bundle with other malware. This is a Trojan and keylogger that is used to retrieve private information such as passwords and login credentials. This is an advanced malware that features strong anti-evasion functions.

Malware Trends Tracker     >>>
Analysis date: July 15, 2018, 11:34:13
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
keylogger
hawkeye
evasion
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

FB11F6D5AC9DFEFA6C9BB37E2103058C

SHA1:

D183B0A09B51C75CC0843C69542BA437292D5B90

SHA256:

9947E7706F0D321310340C526BAD437BBEC54A714E9F032C9634361DA22D01E7

SSDEEP:

98304:4iHN+VOEkLojG2XCSjWF0kb43dRZjLlBg3QX/2nYW:4aN+VoojGS6+VLlBz/2T

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 3132)
      • AncalogBuilder.exe (PID: 2256)

    • Application was dropped or rewritten from another process

      • AncalogBuilder.exe (PID: 2500)
      • AncalogBuilder.exe (PID: 2284)
      • AncalogBuilder.exe (PID: 2256)
      • svchost.exe (PID: 992)

    • Detected Hawkeye Keylogger

      • svchost.exe (PID: 992)

    • Changes the autorun value in the registry

      • svchost.exe (PID: 992)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 7zFM.exe (PID: 600)
      • AncalogBuilder.exe (PID: 2500)
      • svchost.exe (PID: 992)

    • Creates executable files which already exist in Windows

      • AncalogBuilder.exe (PID: 2500)

    • Creates files in the user directory

      • svchost.exe (PID: 992)

    • Checks for external IP

      • svchost.exe (PID: 992)

  • INFO

    • Dropped object may contain URL's

      • 7zFM.exe (PID: 600)
      • AncalogBuilder.exe (PID: 2500)
      • svchost.exe (PID: 992)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
7
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start 7zfm.exe searchprotocolhost.exe no specs ancalogbuilder.exe ancalogbuilder.exe no specs ancalogbuilder.exe THREAT svchost.exe vbc.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
600"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\admin\AppData\Local\Temp\Ancalog Exploit Builder AchillePower.rar"C:\Program Files\7-Zip\7zFM.exe
explorer.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
MEDIUM
Description:
7-Zip File Manager
Exit code:
0
Version:
16.04
Modules
Images
c:\program files\7-zip\7zfm.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
992"C:\Users\admin\AppData\Local\Temp\svchost.exe" 0C:\Users\admin\AppData\Local\Temp\svchost.exe
AncalogBuilder.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Phulli
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\svchost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2256"C:\Users\admin\AppData\Local\Temp\AncalogBuilder.exe" 0C:\Users\admin\AppData\Local\Temp\AncalogBuilder.exe
AncalogBuilder.exe
User:
admin
Company:
ancalog.tech
Integrity Level:
HIGH
Description:
Ancalog Multi Exploit Builder
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\ancalogbuilder.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2284"C:\Users\admin\AppData\Local\Temp\AncalogBuilder.exe" 0C:\Users\admin\AppData\Local\Temp\AncalogBuilder.exe—AncalogBuilder.exe
User:
admin
Company:
ancalog.tech
Integrity Level:
MEDIUM
Description:
Ancalog Multi Exploit Builder
Exit code:
3221226540
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\ancalogbuilder.exe
c:\systemroot\system32\ntdll.dll
2500"C:\Users\admin\Desktop\Ancalog Exploit Builder AchillePower\AncalogBuilder.exe" C:\Users\admin\Desktop\Ancalog Exploit Builder AchillePower\AncalogBuilder.exe
explorer.exe
User:
admin
Company:
BreakingSecurity.net
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.01.0001
Modules
Images
c:\users\admin\desktop\ancalog exploit builder achillepower\ancalogbuilder.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
3028C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\admin\AppData\Local\Temp\holdermail.txt"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual Basic Command Line Compiler
Exit code:
0
Version:
8.0.50727.5420
3132"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
788
Read events
758
Write events
30
Delete events
0

Modification events

(PID) Process:(600) 7zFM.exeKey:HKEY_CURRENT_USER\Software\7-Zip\FM
Operation:writeName:FolderShortcuts
Value:
(PID) Process:(600) 7zFM.exeKey:HKEY_CURRENT_USER\Software\7-Zip\FM
Operation:writeName:FolderHistory
Value:
43003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C004C006F00630061006C005C00540065006D0070005C0041006E00630061006C006F00670020004500780070006C006F006900740020004200750069006C00640065007200200041006300680069006C006C00650050006F007700650072002E007200610072005C000000
(PID) Process:(600) 7zFM.exeKey:HKEY_CURRENT_USER\Software\7-Zip\FM
Operation:writeName:PanelPath0
Value:
C:\Users\admin\AppData\Local\Temp\
(PID) Process:(600) 7zFM.exeKey:HKEY_CURRENT_USER\Software\7-Zip\FM
Operation:writeName:FlatViewArc0
Value:
0
(PID) Process:(600) 7zFM.exeKey:HKEY_CURRENT_USER\Software\7-Zip\FM
Operation:writeName:PanelPath1
Value:
(PID) Process:(600) 7zFM.exeKey:HKEY_CURRENT_USER\Software\7-Zip\FM
Operation:writeName:FlatViewArc1
Value:
0
(PID) Process:(600) 7zFM.exeKey:HKEY_CURRENT_USER\Software\7-Zip\FM
Operation:writeName:ListMode
Value:
771
(PID) Process:(600) 7zFM.exeKey:HKEY_CURRENT_USER\Software\7-Zip\FM
Operation:writeName:Position
Value:
1600000016000000D60300000B02000000000000
(PID) Process:(600) 7zFM.exeKey:HKEY_CURRENT_USER\Software\7-Zip\FM
Operation:writeName:Panels
Value:
0100000000000000DA010000
(PID) Process:(600) 7zFM.exeKey:HKEY_CURRENT_USER\Software\7-Zip\FM\Columns
Operation:writeName:7-Zip.Rar5
Value:
0100000004000000010000000400000001000000A00000000700000001000000640000000800000001000000640000000C00000001000000640000000A00000001000000640000000B00000001000000640000000900000001000000640000003F00000001000000640000000F00000001000000640000000D00000001000000640000001000000001000000640000001100000001000000640000001300000001000000640000001700000001000000640000001600000001000000640000003600000001000000640000005A00000001000000640000005F00000001000000640000001F00000001000000640000002000000001000000640000002E00000001000000640000003E0000000100000064000000
Executable files
10
Suspicious files
5
Text files
12
Unknown types
0

Dropped files

PID
Process
Filename
Type
6007zFM.exeC:\Users\admin\AppData\Local\Temp\7zE8521519A\Ancalog Exploit Builder AchillePower\doc.binbinary
MD5:—
SHA256:—
6007zFM.exeC:\Users\admin\AppData\Local\Temp\7zE8521519A\Ancalog Exploit Builder AchillePower\chm.binhtml
MD5:—
SHA256:—
6007zFM.exeC:\Users\admin\AppData\Local\Temp\7zE8521519A\Ancalog Exploit Builder AchillePower\enable-macro.pngimage
MD5:—
SHA256:—
6007zFM.exeC:\Users\admin\AppData\Local\Temp\7zE8521519A\Ancalog Exploit Builder AchillePower\cap.bintext
MD5:—
SHA256:—
6007zFM.exeC:\Users\admin\AppData\Local\Temp\7zE8521519A\Ancalog Exploit Builder AchillePower\AncalogBuilder.exeexecutable
MD5:—
SHA256:—
6007zFM.exeC:\Users\admin\AppData\Local\Temp\7zE8521519A\Ancalog Exploit Builder AchillePower\as.dlldocument
MD5:3E708E0E21631A387D76738AAEBD5C82
SHA256:65DB0EBD77ABBA9DB0406765FDED0EA13EBF49E9A3CEB7B4FA6069B46DF3D370
6007zFM.exeC:\Users\admin\AppData\Local\Temp\7zE8521519A\Ancalog Exploit Builder AchillePower\pdf.bintext
MD5:—
SHA256:—
6007zFM.exeC:\Users\admin\AppData\Local\Temp\7zE8521519A\Ancalog Exploit Builder AchillePower\fg.dlltext
MD5:948905E39EA0C6A42A81AC19F756F093
SHA256:989713BA5D8C72EB57C38EE9A939FB45FEF21B6C259328197F59A7A59F11CE4B
6007zFM.exeC:\Users\admin\AppData\Local\Temp\7zE8521519A\Ancalog Exploit Builder AchillePower\silent.bintext
MD5:—
SHA256:—
6007zFM.exeC:\Users\admin\AppData\Local\Temp\7zE8521519A\Ancalog Exploit Builder AchillePower\fl.dlldocument
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
992
svchost.exe
GET
403
104.16.16.96:80
http://whatismyipaddress.com/
US
text
100 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
992
svchost.exe
104.16.16.96:80
whatismyipaddress.com
Cloudflare Inc
US
shared

DNS requests

Domain
IP
Reputation
whatismyipaddress.com
  • 104.16.16.96
  • 104.16.17.96
  • 104.16.19.96
  • 104.16.18.96
  • 104.16.20.96
shared

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Ancalog Exploit Builder AchillePower.rar