File name: | ARCHIVOGHKSJDOCUMENTOIMAGEG873963430001 ARCHIVOGHKSJDOCUMENTOIMAGEG873963430002.UUE |
Full analysis: | https://app.any.run/tasks/3cc1c38e-16cf-47dd-8a1e-5d13cd96108f |
Verdict: | Malicious activity |
Threats: | njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world. |
Analysis date: | August 13, 2019, 20:31:03 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/x-rar |
File info: | RAR archive data, v5 |
MD5: | CD6FEBA3704B0D6AD103AE067C3D7007 |
SHA1: | 6C1D0FDE0E6A85F9FEEE11921887432CAC50778A |
SHA256: | A80CE3A16CD2BE1BE96E824B09C571519FCA7EE943EE3BED49CDE0CED956831F |
SSDEEP: | 12288:bPotu/nFU6f+jm7gPrBFfTbyLiSMbGGApGgZEgInvEizA1a5nGzEhy0M4mF:ctCFjf+jS8rBFfTGLicGCDI2is9 |
.rar | | | RAR compressed archive (v5.0) (61.5) |
---|---|---|
.rar | | | RAR compressed archive (gen) (38.4) |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2216 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\ARCHIVOGHKSJDOCUMENTOIMAGEG873963430001 ARCHIVOGHKSJDOCUMENTOIMAGEG873963430002.UUE" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
3572 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa2216.28937\ARCHIVOGHKSJDOCUMENTOIMAGEG873963430001 ARCHIVOGHKSJDOCUMENTOIMAGEG873963430002 ARCHIVOGHKSJDOCUMENTOIMAGEG873963430003.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa2216.28937\ARCHIVOGHKSJDOCUMENTOIMAGEG873963430001 ARCHIVOGHKSJDOCUMENTOIMAGEG873963430002 ARCHIVOGHKSJDOCUMENTOIMAGEG873963430003.exe | WinRAR.exe | |
User: admin Company: IMTCLNWZ Integrity Level: MEDIUM Description: BthpanContextHandler Version: 604.626.783.509 | ||||
2276 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | ARCHIVOGHKSJDOCUMENTOIMAGEG873963430001 ARCHIVOGHKSJDOCUMENTOIMAGEG873963430002 ARCHIVOGHKSJDOCUMENTOIMAGEG873963430003.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft .NET Services Installation Utility Exit code: 0 Version: 4.7.3062.0 built by: NET472REL1 | ||||
3460 | schtasks /Delete /tn NYAN /F | C:\Windows\system32\schtasks.exe | — | RegSvcs.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Manages scheduled tasks Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2908 | schtasks /create /tn NYAN /tr "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" /sc minute /mo 1 | C:\Windows\system32\schtasks.exe | — | RegSvcs.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Manages scheduled tasks Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2204 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | — | taskeng.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft .NET Services Installation Utility Exit code: 0 Version: 4.7.3062.0 built by: NET472REL1 | ||||
3640 | "C:\Program Files\Google\Chrome\Application\chrome.exe" | C:\Program Files\Google\Chrome\Application\chrome.exe | explorer.exe | |
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Version: 75.0.3770.100 | ||||
2236 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=75.0.3770.100 --initial-client-data=0x7c,0x80,0x84,0x78,0x88,0x6d4da9d0,0x6d4da9e0,0x6d4da9ec | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe |
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Version: 75.0.3770.100 | ||||
2164 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=3936 --on-initialized-event-handle=312 --parent-handle=316 /prefetch:6 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe |
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Version: 75.0.3770.100 | ||||
2160 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=944,12456735864564531178,17567588095913254776,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=7672213807720423053 --mojo-platform-channel-handle=948 --ignored=" --type=renderer " /prefetch:2 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe |
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Version: 75.0.3770.100 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3640 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\7ffef7d7-7fa9-4848-a35f-051d800021b9.tmp | — | |
MD5:— | SHA256:— | |||
3640 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000020.dbtmp | — | |
MD5:— | SHA256:— | |||
3640 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old | text | |
MD5:213AE3DA120D7862D60B5763B6C9D466 | SHA256:5736534D6EE654C1BF1A8E79E73330AF58F622E8657285330D2C7189A55604F4 | |||
3640 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB\LOG.old | text | |
MD5:3D551B6E929CF62F7AA66091E718704B | SHA256:1698A1B1BC3E86676392FB8BD4C712438302A5A2220503C08F290ED4B1790404 | |||
3640 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG.old | text | |
MD5:A519780ED0A2F4336DB4F5651D79C369 | SHA256:DA5B71BD0075B55757BF757BF5F4D4A1DCBCF0762CDA5B31B28680963E068C75 | |||
3572 | ARCHIVOGHKSJDOCUMENTOIMAGEG873963430001 ARCHIVOGHKSJDOCUMENTOIMAGEG873963430002 ARCHIVOGHKSJDOCUMENTOIMAGEG873963430003.exe | C:\Users\Public\stvbwdbunk.vbs | text | |
MD5:ABD9E0F7478BC6A597BFA04F5E077967 | SHA256:1863AB172193B0E1F53BB1CF9BA02BD7C6A918B6D6519A06163F919193385981 | |||
3640 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old | text | |
MD5:C4D6CBB269C626168A5D6D0D8CCE6C30 | SHA256:B62CDBB758278A0C2E50593357390119441D8DE09428EB29027F3DFD1332E348 | |||
3640 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old~RF37c3f0.TMP | text | |
MD5:DC32343F45B01764B6267AD36548102A | SHA256:A250F5AD57D4BD58AAE92810D50278E3BE2DBF869F126A3A3519691BCDFC2075 | |||
3572 | ARCHIVOGHKSJDOCUMENTOIMAGEG873963430001 ARCHIVOGHKSJDOCUMENTOIMAGEG873963430002 ARCHIVOGHKSJDOCUMENTOIMAGEG873963430003.exe | C:\Users\admin\AppData\Roaming\cttune\actxprxy.bat | executable | |
MD5:06F78774FCF108D1D2F28F4946326224 | SHA256:C7A932474B93FE39D6E2BE5DDA342AD46CD4E99F4688FC45DB0A86C0A2F92BCB | |||
3640 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old~RF37c3f0.TMP | text | |
MD5:C4D6CBB269C626168A5D6D0D8CCE6C30 | SHA256:B62CDBB758278A0C2E50593357390119441D8DE09428EB29027F3DFD1332E348 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2888 | chrome.exe | GET | 302 | 172.217.22.78:80 | http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvOWVmQUFXS041NV9ZVXlJVWwxbGc5TUM4dw/7519.422.0.3_pkedcjkdefgpdelpbcmbmeomcjbeemfm.crx | US | html | 516 b | whitelisted |
2888 | chrome.exe | GET | 200 | 173.194.183.103:80 | http://r2---sn-aigl6nek.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvOWVmQUFXS041NV9ZVXlJVWwxbGc5TUM4dw/7519.422.0.3_pkedcjkdefgpdelpbcmbmeomcjbeemfm.crx?cms_redirect=yes&mip=185.183.105.212&mm=28&mn=sn-aigl6nek&ms=nvh&mt=1565728234&mv=m&mvi=1&pl=24&shardbypass=yes | US | crx | 862 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2888 | chrome.exe | 172.217.18.170:443 | fonts.googleapis.com | Google Inc. | US | whitelisted |
2888 | chrome.exe | 172.217.23.131:443 | www.google.com.ua | Google Inc. | US | whitelisted |
2276 | RegSvcs.exe | 181.52.108.50:1990 | donberna.duckdns.org | Telmex Colombia S.A. | CO | malicious |
2888 | chrome.exe | 172.217.22.77:443 | accounts.google.com | Google Inc. | US | whitelisted |
2888 | chrome.exe | 172.217.18.110:443 | ogs.google.com | Google Inc. | US | whitelisted |
2888 | chrome.exe | 172.217.23.163:443 | www.gstatic.com | Google Inc. | US | whitelisted |
2888 | chrome.exe | 172.217.16.163:443 | fonts.gstatic.com | Google Inc. | US | whitelisted |
— | — | 216.58.206.3:443 | www.google.it | Google Inc. | US | whitelisted |
2888 | chrome.exe | 216.58.207.35:443 | clientservices.googleapis.com | Google Inc. | US | whitelisted |
2888 | chrome.exe | 172.217.22.78:443 | apis.google.com | Google Inc. | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
donberna.duckdns.org |
| malicious |
clientservices.googleapis.com |
| whitelisted |
accounts.google.com |
| shared |
www.google.com.ua |
| whitelisted |
fonts.googleapis.com |
| whitelisted |
www.gstatic.com |
| whitelisted |
fonts.gstatic.com |
| whitelisted |
apis.google.com |
| whitelisted |
ogs.google.com |
| whitelisted |
www.google.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
— | — | Misc activity | ET INFO DYNAMIC_DNS Query to *.duckdns. Domain |
2276 | RegSvcs.exe | A Network Trojan was detected | MALWARE [PTsecurity] njRAT.Gen RAT outbound connection |