File name:

all kinds of malware.rar

Full analysis: https://app.any.run/tasks/52c21621-4deb-4caf-a3a9-f1b5322f0be0
Verdict: Malicious activity
Analysis date: October 19, 2020, 14:48:54
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

E05E357F1533DA10E3E074AE6F3856FC

SHA1:

9FBA9C014E83D2735D09B304D80668D736CA257C

SHA256:

A03D4D762D0099E1D55C252503A2EB5598CFF9B657EC9BF91E9D7173E660596B

SSDEEP:

98304:H+oFIxSh4w9NnpTVf8JBwxgQ9Dr++rUBvBOstKXvsIQOFi:eoFywtTV0tQJ++QBzmsIQO0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Trojan.Rootkit.exe (PID: 3396)
      • Email-Worm.Win32.White.exe (PID: 2984)
      • Trojan.Win32.Malantern.exe (PID: 548)
      • Virus.Win32.Rigel.exe (PID: 3440)
      • Virus.Win32.Savior.exe (PID: 3492)
      • Email-Worm.Win32.ZippedFiles.exe (PID: 3888)
      • Virus.Win32.ZHymn.exe (PID: 2956)
      • Virus.Win32.CTX.exe (PID: 2944)
      • Virus.Win32.exe (PID: 2888)
      • Virus.Win32.Saynob.exe (PID: 1964)
      • Virus.Win32.Yerg.exe (PID: 944)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3452)
      • cmd.exe (PID: 2624)
      • Virus.Win32.Savior.exe (PID: 3492)
      • Virus.Win32.exe (PID: 2888)

    • Removes files from Windows directory

      • Trojan.Win32.Malantern.exe (PID: 548)

    • Creates files in the program directory

      • Email-Worm.Win32.ZippedFiles.exe (PID: 3888)

  • INFO

    • Manual execution by user

      • cmd.exe (PID: 2624)
      • Virus.Win32.Rigel.exe (PID: 3440)
      • Trojan.Win32.Malantern.exe (PID: 548)
      • Trojan.Rootkit.exe (PID: 3396)
      • rundll32.exe (PID: 1072)
      • Virus.Win32.Savior.exe (PID: 3492)
      • Email-Worm.Win32.White.exe (PID: 2984)
      • Virus.Win32.ZHymn.exe (PID: 2956)
      • Virus.Win32.CTX.exe (PID: 2944)
      • ntvdm.exe (PID: 3544)
      • Virus.Win32.exe (PID: 2888)
      • Email-Worm.Win32.ZippedFiles.exe (PID: 3888)
      • Virus.Win32.Saynob.exe (PID: 1964)
      • Virus.Win32.Yerg.exe (PID: 944)
      • taskmgr.exe (PID: 3200)

    • Reads Microsoft Office registry keys

      • Email-Worm.Win32.ZippedFiles.exe (PID: 3888)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
68
Monitored processes
17
Malicious processes
10
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe cmd.exe email-worm.win32.white.exe no specs trojan.rootkit.exe rundll32.exe no specs trojan.win32.malantern.exe no specs virus.win32.rigel.exe no specs virus.win32.savior.exe virus.win32.saynob.exe no specs virus.win32.yerg.exe no specs mspaint.exe no specs virus.win32.zhymn.exe ntvdm.exe no specs virus.win32.ctx.exe no specs virus.win32.exe email-worm.win32.zippedfiles.exe no specs taskmgr.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
548"C:\Users\admin\AppData\Local\Temp\all kinds of malware\all kinds of malware\Trojan.Win32.Malantern.exe" C:\Users\admin\AppData\Local\Temp\all kinds of malware\all kinds of malware\Trojan.Win32.Malantern.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
IE Security Patch
Exit code:
0
Version:
1.00
Modules
Images
c:\users\admin\appdata\local\temp\all kinds of malware\all kinds of malware\trojan.win32.malantern.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
944"C:\Users\admin\AppData\Local\Temp\all kinds of malware\all kinds of malware\Virus.Win32.Yerg.exe" C:\Users\admin\AppData\Local\Temp\all kinds of malware\all kinds of malware\Virus.Win32.Yerg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Paintbrush
Exit code:
0
Version:
4.10.1998
Modules
Images
c:\users\admin\appdata\local\temp\all kinds of malware\all kinds of malware\virus.win32.yerg.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1072"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\all kinds of malware\all kinds of malware\Trojan.Win32.DesktopPuzzleC:\Windows\system32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
1964"C:\Users\admin\AppData\Local\Temp\all kinds of malware\all kinds of malware\Virus.Win32.Saynob.exe" C:\Users\admin\AppData\Local\Temp\all kinds of malware\all kinds of malware\Virus.Win32.Saynob.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\all kinds of malware\all kinds of malware\virus.win32.saynob.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
2624cmd /c ""C:\Users\admin\AppData\Local\Temp\all kinds of malware\all kinds of malware\rename and runall.bat" "C:\Windows\system32\cmd.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2888"C:\Users\admin\AppData\Local\Temp\all kinds of malware\all kinds of malware\Virus.Win32.exe" C:\Users\admin\AppData\Local\Temp\all kinds of malware\all kinds of malware\Virus.Win32.exe
explorer.exe
User:
admin
Company:
littlepeter.com
Integrity Level:
MEDIUM
Description:
littlepeter mines
Exit code:
0
Version:
1.0.0
Modules
Images
c:\users\admin\appdata\local\temp\all kinds of malware\all kinds of malware\virus.win32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ddraw.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2944"C:\Users\admin\AppData\Local\Temp\all kinds of malware\all kinds of malware\Virus.Win32.CTX.exe" C:\Users\admin\AppData\Local\Temp\all kinds of malware\all kinds of malware\Virus.Win32.CTX.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\all kinds of malware\all kinds of malware\virus.win32.ctx.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
2956"C:\Users\admin\AppData\Local\Temp\all kinds of malware\all kinds of malware\Virus.Win32.ZHymn.exe" C:\Users\admin\AppData\Local\Temp\all kinds of malware\all kinds of malware\Virus.Win32.ZHymn.exe
explorer.exe
User:
admin
Company:
Корпорация Microsoft
Integrity Level:
MEDIUM
Description:
Текстовый редактор "Блокнот"
Exit code:
3221225477
Version:
4.10.1998
Modules
Images
c:\users\admin\appdata\local\temp\all kinds of malware\all kinds of malware\virus.win32.zhymn.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2984"C:\Users\admin\AppData\Local\Temp\all kinds of malware\all kinds of malware\Email-Worm.Win32.White.exe" C:\Users\admin\AppData\Local\Temp\all kinds of malware\all kinds of malware\Email-Worm.Win32.White.exe—explorer.exe
User:
admin
Company:
[P54C]-133mhz
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.01
Modules
Images
c:\users\admin\appdata\local\temp\all kinds of malware\all kinds of malware\email-worm.win32.white.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
3200"C:\Windows\system32\taskmgr.exe" /4C:\Windows\system32\taskmgr.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Task Manager
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
2 053
Read events
1 926
Write events
127
Delete events
0

Modification events

(PID) Process:(3452) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3452) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3452) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3452) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\all kinds of malware.rar
(PID) Process:(3452) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3452) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3452) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3452) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3452) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\DialogEditHistory\ExtrPath
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\all kinds of malware
(PID) Process:(944) Virus.Win32.Yerg.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
Executable files
165
Suspicious files
14
Text files
4
Unknown types
69

Dropped files

PID
Process
Filename
Type
3452WinRAR.exeC:\Users\admin\AppData\Local\Temp\all kinds of malware\all kinds of malware\Email-Worm.Win32.Gruel.aexecutable
MD5:B0FECCDDD78039AED7F1D68DAE4D73D3
SHA256:5714EFD4746F7796BBC52A272F8E354F67EDFB50129D5FDAA1396E920956D0D6
3452WinRAR.exeC:\Users\admin\AppData\Local\Temp\all kinds of malware\all kinds of malware\Email-Worm.Win32.Anap.aexecutable
MD5:0231C3A7D92EAD1BAD77819D5BDA939D
SHA256:DA1798C0A49B991FBDA674F02007B0A3BE4703E2B07EE540539DB7E5BF983278
3452WinRAR.exeC:\Users\admin\AppData\Local\Temp\all kinds of malware\all kinds of malware\Email-Worm.Win32.Alcaul.hexecutable
MD5:B994A4BAC6126F3C09DC202AB98ACF1E
SHA256:0CAE69E5A68182AB60562F5ED565FC453E85C0DED1D9D70BF7E285A9CCEEBD3C
3452WinRAR.exeC:\Users\admin\AppData\Local\Temp\all kinds of malware\all kinds of malware\Email-Worm.Win32.Laconexecutable
MD5:CB0F7B3FD927CF0D0BA36302E6F9AF86
SHA256:9B3F73A12A793D1648F3209E1E3F10BBB548B1EC21D53B8AC060B7B95AE4EF1F
3452WinRAR.exeC:\Users\admin\AppData\Local\Temp\all kinds of malware\all kinds of malware\Email-Worm.Win32.Amusexecutable
MD5:47ABD68080EEE0EA1B95AE31968A3069
SHA256:B5FC4FD50E4BA69F0C8C8E5C402813C107C605CAB659960AC31B3C8356C4E0EC
3452WinRAR.exeC:\Users\admin\AppData\Local\Temp\all kinds of malware\all kinds of malware\Email-Worm.Win32.Magistr.aexecutable
MD5:9890349FE3C68F5923B29347BBA021A4
SHA256:068F2EE28AF7645DBF2A1684F0A5FC5CCB6AA1027F71DA4468E0CBA56C65E058
3452WinRAR.exeC:\Users\admin\AppData\Local\Temp\all kinds of malware\all kinds of malware\Email-Worm.Win32.Axam.aexecutable
MD5:0FBF8022619BA56C545B20D172BF3B87
SHA256:4AE7D63EC497143C2ACDE1BA79F1D9EED80086A420B6F0A07B1E2917DA0A6C74
3452WinRAR.exeC:\Users\admin\AppData\Local\Temp\all kinds of malware\all kinds of malware\Email-Worm.Win32.Dukstenexecutable
MD5:900EBFF3E658825F828AB95B30FAD2E7
SHA256:CAEC6E664B3CFF5717DD2EFEA8DCD8715ABDCFE7F611456BE7009771F22A8F50
3452WinRAR.exeC:\Users\admin\AppData\Local\Temp\all kinds of malware\all kinds of malware\Email-Worm.Win32.Funsoulexecutable
MD5:A13A4DB860D743A088EF7AB9BACB4DDA
SHA256:69EE59CEE5A1D39739D935701CFA917F75787B29E0B9BDA9ADA9E2642ADE434C
3452WinRAR.exeC:\Users\admin\AppData\Local\Temp\all kinds of malware\all kinds of malware\Email-Worm.Win32.Lentin.dexecutable
MD5:D9CE0273F791DA275ED2A69446413A87
SHA256:AA2E8D70654E30CF11E2B57E92CEA72A9823A048F75FC9029DA04E1E4D8A9810
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
Process
Message
Trojan.Rootkit.exe
sssssssssss
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
all kinds of malware.rar