analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Brute53.rar

Full analysis: https://app.any.run/tasks/b6257330-90d1-427a-b74b-c7782dc5592d
Verdict: Malicious activity
Analysis date: December 06, 2018, 08:43:34
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

2255555BF63FB6A34668EE4D759E9DCD

SHA1:

F94D347B5EC4DBB68D9816DE0E7384C878057E30

SHA256:

995C9C17C515B96081B4404D874922173AC305742807437F8913BB3215D0DAB5

SSDEEP:

3072:GG39hxHOWdwsc2h/El89SApGn3Sx0JdmjBJ115:b9eivc2zInixe8

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 53Brute.exe (PID: 3488)

    • Changes the autorun value in the registry

      • reg.exe (PID: 2664)

  • SUSPICIOUS

    • Starts Internet Explorer

      • 53Brute.exe (PID: 3488)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3588)

    • Creates files in the user directory

      • 53Brute.exe (PID: 3488)
      • Skype.exe (PID: 3416)
      • Skype.exe (PID: 2332)
      • Skype.exe (PID: 2100)

    • Reads CPU info

      • Skype.exe (PID: 3416)

    • Application launched itself

      • Skype.exe (PID: 3416)
      • Skype.exe (PID: 2332)
      • Skype.exe (PID: 2100)

    • Modifies the open verb of a shell class

      • Skype.exe (PID: 3416)

    • Uses REG.EXE to modify Windows registry

      • Skype.exe (PID: 3416)

  • INFO

    • Creates files in the user directory

      • iexplore.exe (PID: 2212)

    • Changes internet zones settings

      • iexplore.exe (PID: 3720)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2212)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2212)

    • Reads settings of System Certificates

      • Skype.exe (PID: 3416)

    • Dropped object may contain Bitcoin addresses

      • Skype.exe (PID: 3416)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
46
Monitored processes
12
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe 53brute.exe no specs iexplore.exe iexplore.exe skype.exe skype.exe reg.exe skype.exe no specs reg.exe no specs skype.exe skype.exe no specs skype.exe

Process information

PID
CMD
Path
Indicators
Parent process
3588"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Brute53.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3488"C:\Users\admin\Desktop\53Brute.exe" C:\Users\admin\Desktop\53Brute.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
53.com
Version:
1.0.0.0
3720"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
53Brute.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2212"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3720 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3416"C:\Program Files\Microsoft\Skype for Desktop\Skype.exe" -- "skype:live:35e62eee147b8752?chat"C:\Program Files\Microsoft\Skype for Desktop\Skype.exe
53Brute.exe
User:
admin
Company:
Skype Technologies S.A.
Integrity Level:
MEDIUM
Description:
Skype
Version:
8.29.0.50
2640"C:\Program Files\Microsoft\Skype for Desktop\Skype.exe" --reporter-url=https://rink.hockeyapp.net/api/2/apps/a741743329d94bc08826af367733939d/crashes/upload --application-name=skype-preview "--crashes-directory=C:\Users\admin\AppData\Local\Temp\skype-preview Crashes" --v=1C:\Program Files\Microsoft\Skype for Desktop\Skype.exe
Skype.exe
User:
admin
Company:
Skype Technologies S.A.
Integrity Level:
MEDIUM
Description:
Skype
Version:
8.29.0.50
2664C:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Skype for Desktop" /t REG_SZ /d "C:\Program Files\Microsoft\Skype for Desktop\Skype.exe" /fC:\Windows\system32\reg.exe
Skype.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2332"C:\Program Files\Microsoft\Skype for Desktop\Skype.exe" --type=renderer --ms-disable-indexeddb-transaction-timeout --no-sandbox --service-pipe-token=CE58E52EB02A37A9671D123AFE651EA3 --lang=en-US --app-user-model-id=Microsoft.Skype.SkypeDesktop --app-path="C:\Program Files\Microsoft\Skype for Desktop\resources\app.asar" --node-integration=false --webview-tag=true --no-sandbox --preload="C:\Program Files\Microsoft\Skype for Desktop\resources\app.asar\Preload.js" --context-id=2 --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --disable-accelerated-video-decode --disable-gpu-compositing --enable-gpu-async-worker-context --service-request-channel-token=CE58E52EB02A37A9671D123AFE651EA3 --renderer-client-id=3 --mojo-platform-channel-handle=1544 /prefetch:1C:\Program Files\Microsoft\Skype for Desktop\Skype.exe—Skype.exe
User:
admin
Company:
Skype Technologies S.A.
Integrity Level:
MEDIUM
Description:
Skype
Exit code:
0
Version:
8.29.0.50
2588C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Skype /v RestartForUpdateC:\Windows\system32\reg.exe—Skype.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2736"C:\Program Files\Microsoft\Skype for Desktop\Skype.exe" --reporter-url=https://rink.hockeyapp.net/api/2/apps/a741743329d94bc08826af367733939d/crashes/upload --application-name=skype-preview "--crashes-directory=C:\Users\admin\AppData\Local\Temp\skype-preview Crashes" --v=1C:\Program Files\Microsoft\Skype for Desktop\Skype.exe
Skype.exe
User:
admin
Company:
Skype Technologies S.A.
Integrity Level:
MEDIUM
Description:
Skype
Exit code:
2
Version:
8.29.0.50
Total events
862
Read events
798
Write events
64
Delete events
0

Modification events

(PID) Process:(3588) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3588) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3588) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3588) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Brute53.rar
(PID) Process:(3588) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3588) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3588) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3588) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3720) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3720) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
Executable files
2
Suspicious files
6
Text files
27
Unknown types
0

Dropped files

PID
Process
Filename
Type
3720iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\favicon[1].ico —
MD5:—
SHA256:—
3720iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
2212iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\brute_engin[1].txt —
MD5:—
SHA256:—
3416Skype.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\SGZBWIGLQMZGMXZRT4HY.temp —
MD5:—
SHA256:—
2212iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\telegram[1].csstext
MD5:8FE3B35433275E6759D9804C626E40C1
SHA256:0F94EA057599252447AD881F452BD8035ABDE39A994FA579F92C9FE60ED09852
3416Skype.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b916037c1e115fe0.customDestinations-msbinary
MD5:FF17E86FAAFB072686D650443C84A7D6
SHA256:3AD89CB552952707F86D8BDF449FBC9E6486943D07985F49009C477595A659CB
3416Skype.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b916037c1e115fe0.customDestinations-ms~RF1413b5.TMPbinary
MD5:FF17E86FAAFB072686D650443C84A7D6
SHA256:3AD89CB552952707F86D8BDF449FBC9E6486943D07985F49009C477595A659CB
2212iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\brute_engin[1].htmhtml
MD5:478AC7EDB25BF1D9761D5490E5A1A5B7
SHA256:26079CEB496DF25048EC2C3145658E332637E63CAAF2A691D67407F7488915FB
2212iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@t[1].txttext
MD5:D1E8465946B44D06FA9D040300089BB1
SHA256:DA0721F76F4F5D04B9018CF96186889E6FE763AAEC80C7BD9A435A2D2387FB20
3588WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3588.35293\53Brute.exeexecutable
MD5:1C68894915B67C5EE4C43CA1B76A0EF5
SHA256:2D22E0232F87F6173BD3C5A516C937CCB40A969F9485978701FB9DFB99F4B89E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
16
DNS requests
14
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3720
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3720
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3416
Skype.exe
23.101.156.198:443
a.config.skype.com
Microsoft Corporation
US
whitelisted
2212
iexplore.exe
172.217.168.14:443
www.google-analytics.com
Google Inc.
US
whitelisted
2212
iexplore.exe
172.217.168.42:443
fonts.googleapis.com
Google Inc.
US
whitelisted
3416
Skype.exe
13.90.95.57:443
get.skype.com
Microsoft Corporation
US
whitelisted
2212
iexplore.exe
149.154.167.99:443
t.me
Telegram Messenger LLP
GB
malicious
2212
iexplore.exe
216.58.215.227:443
fonts.gstatic.com
Google Inc.
US
whitelisted
3416
Skype.exe
13.107.3.128:443
config.edge.skype.com
Microsoft Corporation
US
whitelisted
3416
Skype.exe
152.199.19.160:443
endpoint920510.azureedge.net
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3416
Skype.exe
40.79.33.178:443
avatar.skype.com
Microsoft Corporation
US
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
t.me
  • 149.154.167.99
whitelisted
fonts.googleapis.com
  • 172.217.168.42
whitelisted
telegram.org
  • 149.154.167.99
whitelisted
get.skype.com
  • 13.90.95.57
whitelisted
a.config.skype.com
  • 23.101.156.198
whitelisted
fonts.gstatic.com
  • 216.58.215.227
whitelisted
www.google-analytics.com
  • 172.217.168.14
whitelisted
endpoint920510.azureedge.net
  • 152.199.19.160
whitelisted
login.live.com
  • 157.55.135.132
  • 157.55.135.130
  • 157.55.134.140
whitelisted

Threats

No threats detected
Process
Message
Skype.exe
[2736:2824:1206/084421.174:VERBOSE1:crash_service_main.cc(78)] Session start. cmdline is [--reporter-url=https://rink.hockeyapp.net/api/2/apps/a741743329d94bc08826af367733939d/crashes/upload --application-name=skype-preview "--crashes-directory=C:\Users\admin\AppData\Local\Temp\skype-preview Crashes" --v=1]
Skype.exe
[2736:2824:1206/084421.174:VERBOSE1:crash_service.cc(145)] window handle is 00040278
Skype.exe
[2736:2824:1206/084421.174:VERBOSE1:crash_service.cc(300)] pipe name is \\.\pipe\skype-preview Crash Service dumps at C:\Users\admin\AppData\Local\Temp\skype-preview Crashes
Skype.exe
[2736:2824:1206/084421.174:VERBOSE1:crash_service.cc(304)] checkpoint is C:\Users\admin\AppData\Local\Temp\skype-preview Crashes\crash_checkpoint.txt server is https://rink.hockeyapp.net/api/2/apps/a741743329d94bc08826af367733939d/crashes/upload maximum 128 reports/day reporter is electron-crash-service
Skype.exe
[2736:2824:1206/084421.174:ERROR:crash_service.cc(311)] could not start dumper
Skype.exe
[3272:3336:1206/084428.733:VERBOSE1:crash_service_main.cc(78)] Session start. cmdline is [--reporter-url=https://rink.hockeyapp.net/api/2/apps/a741743329d94bc08826af367733939d/crashes/upload --application-name=skype-preview "--crashes-directory=C:\Users\admin\AppData\Local\Temp\skype-preview Crashes" --v=1]
Skype.exe
[3272:3336:1206/084428.733:VERBOSE1:crash_service.cc(145)] window handle is 0001027C
Skype.exe
[3272:3336:1206/084428.733:VERBOSE1:crash_service.cc(300)] pipe name is \\.\pipe\skype-preview Crash Service dumps at C:\Users\admin\AppData\Local\Temp\skype-preview Crashes
Skype.exe
[3272:3336:1206/084428.733:VERBOSE1:crash_service.cc(304)] checkpoint is C:\Users\admin\AppData\Local\Temp\skype-preview Crashes\crash_checkpoint.txt server is https://rink.hockeyapp.net/api/2/apps/a741743329d94bc08826af367733939d/crashes/upload maximum 128 reports/day reporter is electron-crash-service
Skype.exe
[3272:3336:1206/084428.733:ERROR:crash_service.cc(311)] could not start dumper
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Brute53.rar