File name:

PACKAGE Aimbot AHK CPL.rar

Full analysis: https://app.any.run/tasks/a0d3780f-518f-4438-b497-d86e4410b6e4
Verdict: Malicious activity
Threats:

Crypto mining malware is a resource-intensive threat that infiltrates computers with the purpose of mining cryptocurrencies. This type of threat can be deployed either on an infected machine or a compromised website. In both cases the miner will utilize the computing power of the device and its network bandwidth.

Malware Trends Tracker     >>>
Analysis date: December 16, 2018, 12:31:39
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
miner
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

773F25EEB240463D70B1A73C9B63E0F2

SHA1:

AE793632A61902514A285F9B276176DB16111965

SHA256:

A7A7E2CC9266405F6F44FA631C701CDB4571C92D6317A72638DAC766238255C0

SSDEEP:

196608:pLo4AJSx0c8W5NyuZGnPyPb46qlltEXLw0c8kcZ4KUGfPO7wvKDLz+KddEvlT8Tv:pyj2NyuZGaPJcYs0b5/YRVgvwhzJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • AutoHotkey_1.1.30.01_setup.exe (PID: 3936)
      • AutoHotkey_1.1.30.01_setup.exe (PID: 2388)
      • NEW-CLIENT_Protected2.exe (PID: 2740)
      • GGVIINGSI.exe (PID: 2784)
      • pess.EXE (PID: 3472)
      • Pes.exe (PID: 2288)
      • setup.exe (PID: 2608)
      • service.exe (PID: 2392)
      • SystemProcess.exe (PID: 2408)
      • service.exe (PID: 2428)
      • service.exe (PID: 3612)
      • service.exe (PID: 3592)
      • SystemProcess.exe (PID: 3584)
      • service.exe (PID: 3976)
      • service.exe (PID: 2696)
      • service.exe (PID: 1700)
      • service.exe (PID: 2644)
      • SystemProcess.exe (PID: 2952)
      • service.exe (PID: 3144)
      • service.exe (PID: 3624)
      • service.exe (PID: 3820)
      • SystemProcess.exe (PID: 3268)
      • service.exe (PID: 3052)
      • SystemProcess.exe (PID: 3712)
      • service.exe (PID: 3184)
      • service.exe (PID: 3032)

    • Uses Task Scheduler to run other applications

      • AutoHotkey_1.1.30.01_setup.exe (PID: 3936)
      • NEW-CLIENT_Protected2.exe (PID: 2740)
      • service.exe (PID: 2428)
      • service.exe (PID: 2392)
      • service.exe (PID: 3976)
      • service.exe (PID: 3612)
      • service.exe (PID: 3592)
      • service.exe (PID: 2696)
      • service.exe (PID: 2644)
      • service.exe (PID: 1700)
      • service.exe (PID: 3144)
      • service.exe (PID: 3820)
      • service.exe (PID: 3624)
      • service.exe (PID: 3052)
      • Pes.exe (PID: 2288)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 3460)
      • schtasks.exe (PID: 2232)
      • schtasks.exe (PID: 3952)
      • schtasks.exe (PID: 3376)
      • schtasks.exe (PID: 3980)
      • schtasks.exe (PID: 3252)
      • schtasks.exe (PID: 1900)
      • schtasks.exe (PID: 2152)
      • schtasks.exe (PID: 3208)
      • schtasks.exe (PID: 2808)
      • schtasks.exe (PID: 3940)
      • schtasks.exe (PID: 3248)
      • schtasks.exe (PID: 1024)
      • schtasks.exe (PID: 1384)
      • schtasks.exe (PID: 2152)
      • schtasks.exe (PID: 2180)

    • Changes the autorun value in the registry

      • pess.EXE (PID: 3472)
      • Pes.exe (PID: 2288)

    • Connects to CnC server

      • GGVIINGSI.exe (PID: 2784)

    • Known privilege escalation attack

      • service.exe (PID: 2392)
      • service.exe (PID: 3592)
      • service.exe (PID: 2644)
      • service.exe (PID: 3624)

    • MINER was detected

      • GGVIINGSI.exe (PID: 2784)

  • SUSPICIOUS

    • Creates files in the user directory

      • NEW-CLIENT_Protected2.exe (PID: 2740)
      • AutoHotkey_1.1.30.01_setup.exe (PID: 3936)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3296)
      • AutoHotkey_1.1.30.01_setup.exe (PID: 3936)
      • NEW-CLIENT_Protected2.exe (PID: 2740)
      • pess.EXE (PID: 3472)
      • AutoHotkey_1.1.30.01_setup.exe (PID: 2388)
      • service.exe (PID: 2428)
      • service.exe (PID: 3976)
      • service.exe (PID: 3820)
      • service.exe (PID: 1700)
      • Pes.exe (PID: 2288)

    • Reads internet explorer settings

      • setup.exe (PID: 2608)

    • Connects to unusual port

      • RegSvcs.exe (PID: 3832)
      • GGVIINGSI.exe (PID: 2784)

    • Modifies the open verb of a shell class

      • service.exe (PID: 2392)
      • service.exe (PID: 3592)
      • service.exe (PID: 2644)
      • service.exe (PID: 3624)

    • Reads Environment values

      • RegSvcs.exe (PID: 3832)

  • INFO

    • Reads settings of System Certificates

      • RegSvcs.exe (PID: 3832)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
128
Monitored processes
62
Malicious processes
8
Suspicious processes
12

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start winrar.exe autohotkey_1.1.30.01_setup.exe schtasks.exe no specs autohotkey_1.1.30.01_setup.exe new-client_protected2.exe pess.exe regsvcs.exe schtasks.exe no specs pes.exe regasm.exe no specs setup.exe no specs schtasks.exe no specs schtasks.exe no specs #MINER ggviingsi.exe systemprocess.exe no specs service.exe no specs service.exe schtasks.exe no specs regsvcs.exe no specs schtasks.exe no specs eventvwr.exe no specs eventvwr.exe service.exe no specs schtasks.exe no specs regasm.exe no specs service.exe no specs systemprocess.exe no specs service.exe schtasks.exe no specs regsvcs.exe no specs schtasks.exe no specs eventvwr.exe no specs eventvwr.exe service.exe no specs schtasks.exe no specs regasm.exe no specs service.exe no specs systemprocess.exe no specs service.exe schtasks.exe no specs eventvwr.exe no specs schtasks.exe no specs regsvcs.exe no specs eventvwr.exe service.exe no specs schtasks.exe no specs regasm.exe no specs systemprocess.exe no specs service.exe no specs service.exe schtasks.exe no specs regsvcs.exe no specs schtasks.exe no specs eventvwr.exe no specs eventvwr.exe service.exe no specs schtasks.exe no specs regasm.exe no specs service.exe no specs systemprocess.exe no specs service.exe no specs schtasks.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1024"C:\Windows\System32\schtasks.exe" /create /tn chkntfs /tr "C:\Users\admin\AppData\Roaming\AudioSes\service.exe" /sc minute /mo 1 /FC:\Windows\System32\schtasks.exe—service.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1384"C:\Windows\System32\schtasks.exe" /create /tn IMJPSET /tr "C:\Users\admin\AppData\Roaming\MuiUnattend\service.exe" /sc minute /mo 1 /FC:\Windows\System32\schtasks.exe—service.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1428"C:\Windows\System32\eventvwr.exe" C:\Windows\System32\eventvwr.exe—service.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Event Viewer Snapin Launcher
Exit code:
3221226540
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\eventvwr.exe
c:\systemroot\system32\ntdll.dll
1604"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe—service.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft .NET Assembly Registration Utility
Exit code:
0
Version:
2.0.50727.5420 (Win7SP1.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\regasm.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
1660"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe—service.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Services Installation Utility
Exit code:
0
Version:
4.6.1055.0 built by: NETFXREL2
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regsvcs.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1700C:\Users\admin\AppData\Roaming\MuiUnattend\service.exe C:\Users\admin\AppData\Roaming\MuiUnattend\service.exe
taskeng.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\muiunattend\service.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\version.dll
1900"C:\Windows\System32\schtasks.exe" /create /tn chkntfs /tr "C:\Users\admin\AppData\Roaming\AudioSes\service.exe" /sc minute /mo 1 /FC:\Windows\System32\schtasks.exe—service.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1944"C:\Windows\System32\eventvwr.exe" C:\Windows\System32\eventvwr.exe—service.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Event Viewer Snapin Launcher
Exit code:
3221226540
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\eventvwr.exe
c:\systemroot\system32\ntdll.dll
2152schtasks.exe /create /tn DCXJAZCBVBAW /tr C:\Users\admin\AppData\Local\EJNHWXTEOOUKFZI\SystemProcess.exe /sc minute /mo 1C:\Windows\system32\schtasks.exe—Pes.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2152"C:\Windows\System32\schtasks.exe" /create /tn chkntfs /tr "C:\Users\admin\AppData\Roaming\AudioSes\service.exe" /sc minute /mo 1 /FC:\Windows\System32\schtasks.exe—service.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sspicli.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\sechost.dll
c:\windows\system32\version.dll
c:\windows\system32\imm32.dll
c:\windows\system32\ktmw32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
Total events
2 102
Read events
1 976
Write events
126
Delete events
0

Modification events

(PID) Process:(3296) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3296) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3296) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3296) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\PACKAGE Aimbot AHK CPL.rar
(PID) Process:(3296) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3296) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3296) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3296) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3936) AutoHotkey_1.1.30.01_setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3936) AutoHotkey_1.1.30.01_setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
25
Suspicious files
0
Text files
27
Unknown types
1

Dropped files

PID
Process
Filename
Type
3296WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3296.3509\PACKAGE Aimbot AHK CPL\Battlefield 1\Aim British.ahktext
MD5:—
SHA256:—
3296WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3296.3509\PACKAGE Aimbot AHK CPL\Battlefield 1\Aim Turcs.ahktext
MD5:—
SHA256:—
3296WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3296.3509\PACKAGE Aimbot AHK CPL\Battlefield 1\Aim German.ahktext
MD5:—
SHA256:—
3296WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3296.3509\PACKAGE Aimbot AHK CPL\Battlefield 1\Aim Hongry.ahktext
MD5:—
SHA256:—
3296WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3296.3509\PACKAGE Aimbot AHK CPL\QuakeChampions\Quake Champions.ahk —
MD5:—
SHA256:—
3296WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3296.3509\PACKAGE Aimbot AHK CPL\RB6S\RB6S.ahk —
MD5:—
SHA256:—
3296WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3296.3509\PACKAGE Aimbot AHK CPL\Readme.txt —
MD5:—
SHA256:—
3296WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3296.3509\PACKAGE Aimbot AHK CPL\AutoHotkey_1.1.30.01_setup.exeexecutable
MD5:—
SHA256:—
3296WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3296.3509\PACKAGE Aimbot AHK CPL\Battlefield 1\Aim Ita.ahktext
MD5:—
SHA256:—
3296WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3296.3509\PACKAGE Aimbot AHK CPL\CS1.6\Aim T.ahktext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
35
DNS requests
2
Threats
8

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2784
GGVIINGSI.exe
80.188.53.27:5555
xmr.bohemianpool.com
O2 Czech Republic, a.s.
CZ
suspicious
3832
RegSvcs.exe
88.5.62.76:8989
—
Telefonica De Espana
ES
malicious
3832
RegSvcs.exe
104.20.208.21:443
pastebin.com
Cloudflare Inc
US
shared

DNS requests

Domain
IP
Reputation
xmr.bohemianpool.com
  • 80.188.53.27
suspicious
pastebin.com
  • 104.20.208.21
  • 104.20.209.21
malicious

Threats

PID
Process
Class
Message
2784
GGVIINGSI.exe
Potential Corporate Privacy Violation
ET POLICY Cryptocurrency Miner Checkin
2784
GGVIINGSI.exe
Misc activity
MINER [PTsecurity] CoinMiner CryptoNight XMRig JSON_RPC Client Login
2784
GGVIINGSI.exe
Misc activity
MINER [PTsecurity] Riskware/CoinMiner JSON_RPC Response
2784
GGVIINGSI.exe
Misc activity
MINER [PTsecurity] Risktool.W32.coinminer!c
2784
GGVIINGSI.exe
Misc activity
MINER [PTsecurity] Riskware/CoinMiner JSON_RPC Response
2784
GGVIINGSI.exe
Misc activity
MINER [PTsecurity] Risktool.W32.coinminer!c
2784
GGVIINGSI.exe
Misc activity
MINER [PTsecurity] Riskware/CoinMiner JSON_RPC Response
2784
GGVIINGSI.exe
Misc activity
MINER [PTsecurity] Risktool.W32.coinminer!c
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
PACKAGE Aimbot AHK CPL.rar