| File name: | Downloads.rar |
| Full analysis: | https://app.any.run/tasks/84842bf5-c6c4-412a-bfc6-df623abe7665 |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | June 22, 2020, 00:08:20 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-rar |
| File info: | RAR archive data, v5 |
| MD5: | 00956316E44DE88A5CCBEFE1300D42A0 |
| SHA1: | 51EB449596B5712052DE20FCB9A7C038740A61CD |
| SHA256: | B04F45AE5DD5E962F54A133F956056E1FAA917188CE5D5DD877788D7DF02F78A |
| SSDEEP: | 24576:nupin0zYqJiiC3Dq0Nu/P7QB7Qdd17MBcliWMRmI:u8n0zJk3Dn65RMmymI |
MALICIOUS
Application was dropped or rewritten from another process
- setup.exe (PID: 4064)
- PacketEditor.exe (PID: 1752)
- GFNGui.exe (PID: 2496)
- oofer.exe (PID: 2532)
- AutoClicker.exe (PID: 2668)
Actions looks like stealing of personal data
- WinRAR.exe (PID: 860)
- PacketEditor.exe (PID: 1752)
- oofer.exe (PID: 2532)
Loads dropped or rewritten executable
- dfsvc.exe (PID: 2964)
- GFNGui.exe (PID: 2496)
- PacketEditor.exe (PID: 1752)
Downloads executable files from the Internet
- dfsvc.exe (PID: 2964)
Uses NirSoft utilities to collect credentials
- oofer.exe (PID: 2532)
Stealing of credential data
- oofer.exe (PID: 2532)
SUSPICIOUS
Reads internet explorer settings
- dfsvc.exe (PID: 2964)
Executable content was dropped or overwritten
- WinRAR.exe (PID: 860)
- dfsvc.exe (PID: 2964)
- GFNGui.exe (PID: 2496)
Reads Environment values
- dfsvc.exe (PID: 2964)
Reads Internet Cache Settings
- setup.exe (PID: 4064)
- dfsvc.exe (PID: 2964)
Creates files in the user directory
- dfsvc.exe (PID: 2964)
Creates a software uninstall entry
- dfsvc.exe (PID: 2964)
Reads the cookies of Google Chrome
- GFNGui.exe (PID: 2496)
Checks for external IP
- GFNGui.exe (PID: 2496)
INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .rar | | | RAR compressed archive (v5.0) (61.5) |
|---|---|---|
| .rar | | | RAR compressed archive (gen) (38.4) |
Total processes
44
Monitored processes
7
Malicious processes
6
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 860 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Downloads.rar" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 Modules
| |||||||||||||||
| 1752 | "C:\Users\admin\AppData\Local\Apps\2.0\HCJ7D8GB.95A\XWCXP82D.QBR\pack..tion_0000000000000000_0000.0002_7005f460244b9ab3\PacketEditor.exe" | C:\Users\admin\AppData\Local\Apps\2.0\HCJ7D8GB.95A\XWCXP82D.QBR\pack..tion_0000000000000000_0000.0002_7005f460244b9ab3\PacketEditor.exe | dfsvc.exe | ||||||||||||
User: admin Company: We Rule Computers LLC Integrity Level: MEDIUM Description: PacketEditor Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 2496 | "C:\Users\admin\Desktop\GFNGui.exe" | C:\Users\admin\Desktop\GFNGui.exe | PacketEditor.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 2532 | "C:\Users\admin\AppData\Local\oofer.exe" /stext creds.txt | C:\Users\admin\AppData\Local\oofer.exe | GFNGui.exe | ||||||||||||
User: admin Company: NirSoft Integrity Level: MEDIUM Description: Web Browser Password Viewer Exit code: 0 Version: 2.00 Modules
| |||||||||||||||
| 2668 | "C:\Users\admin\AppData\Local\Temp\AutoClicker.exe" | C:\Users\admin\AppData\Local\Temp\AutoClicker.exe | — | GFNGui.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: OP Auto Clicker Exit code: 0 Version: 3.0 Modules
| |||||||||||||||
| 2964 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe | setup.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: ClickOnce Exit code: 0 Version: 4.7.3062.0 built by: NET472REL1 Modules
| |||||||||||||||
| 4064 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa860.35553\setup.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa860.35553\setup.exe | WinRAR.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: Setup Exit code: 0 Version: 10.0.30319.1 built by: RTMRel Modules
| |||||||||||||||
Total events
1 946
Read events
1 656
Write events
271
Delete events
19
Modification events
| (PID) Process: | (860) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (860) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (860) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\12F\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (860) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\12F\52C64B7E |
| Operation: | write | Name: | @C:\Windows\system32\NetworkExplorer.dll,-1 |
Value: Network | |||
| (PID) Process: | (860) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\Desktop\Downloads.rar | |||
| (PID) Process: | (860) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (860) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (860) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (860) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (860) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
Executable files
10
Suspicious files
5
Text files
19
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2964 | dfsvc.exe | C:\Users\admin\AppData\Local\Temp\Deployment\0D2H7QG9.5OH\88MR1THD.DVV\Be.Windows.Forms.HexBox.dll | — | |
MD5:— | SHA256:— | |||
| 2964 | dfsvc.exe | C:\Users\admin\AppData\Local\Temp\Deployment\0D2H7QG9.5OH\88MR1THD.DVV\PacketEditor.exe.genman | — | |
MD5:— | SHA256:— | |||
| 2964 | dfsvc.exe | C:\Users\admin\AppData\Local\Temp\Deployment\0D2H7QG9.5OH\88MR1THD.DVV\Be.Windows.Forms.HexBox.dll.genman | — | |
MD5:— | SHA256:— | |||
| 4064 | setup.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\PacketEditor[1].application | xml | |
MD5:— | SHA256:— | |||
| 860 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa860.35553\setup.exe | executable | |
MD5:— | SHA256:— | |||
| 2964 | dfsvc.exe | C:\Users\admin\AppData\Local\Temp\Deployment\0D2H7QG9.5OH\88MR1THD.DVV\PacketEditor.exe.config | xml | |
MD5:— | SHA256:— | |||
| 2964 | dfsvc.exe | C:\Users\admin\AppData\Local\Temp\Deployment\0D2H7QG9.5OH\88MR1THD.DVV\icon16.ico | image | |
MD5:— | SHA256:— | |||
| 2964 | dfsvc.exe | C:\Users\admin\AppData\Local\Temp\Deployment\0D2H7QG9.5OH\88MR1THD.DVV\WSPE.dat | executable | |
MD5:— | SHA256:— | |||
| 2964 | dfsvc.exe | C:\Users\admin\AppData\Local\Temp\Deployment\0D2H7QG9.5OH\88MR1THD.DVV\PacketEditor.exe.manifest | xml | |
MD5:— | SHA256:— | |||
| 860 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa860.35553\GFNGui.exe | executable | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
5
DNS requests
3
Threats
2
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
4064 | setup.exe | GET | 200 | 18.191.128.41:80 | http://www.packeteditor.com/72656C65617365/PacketEditor.application | US | xml | 2.15 Kb | suspicious |
2964 | dfsvc.exe | GET | 200 | 18.191.128.41:80 | http://www.packeteditor.com/72656C65617365/PacketEditor.application | US | xml | 2.15 Kb | suspicious |
2964 | dfsvc.exe | GET | 200 | 18.191.128.41:80 | http://www.packeteditor.com/72656C65617365/Application%20Files/PacketEditor_0_2_2_1/PacketEditor.exe.manifest | US | xml | 5.78 Kb | suspicious |
2964 | dfsvc.exe | GET | 200 | 18.191.128.41:80 | http://www.packeteditor.com/72656C65617365/Application%20Files/PacketEditor_0_2_2_1/icon16.ico | US | image | 1.12 Kb | suspicious |
2964 | dfsvc.exe | GET | 200 | 18.191.128.41:80 | http://www.packeteditor.com/72656C65617365/Application%20Files/PacketEditor_0_2_2_1/WSPE.dat | US | executable | 22.5 Kb | suspicious |
2964 | dfsvc.exe | GET | 200 | 18.191.128.41:80 | http://www.packeteditor.com/72656C65617365/Application%20Files/PacketEditor_0_2_2_1/PacketEditor.exe.config | US | xml | 183 b | suspicious |
2964 | dfsvc.exe | GET | 200 | 18.191.128.41:80 | http://www.packeteditor.com/72656C65617365/Application%20Files/PacketEditor_0_2_2_1/Be.Windows.Forms.HexBox.dll | US | executable | 72.0 Kb | suspicious |
2964 | dfsvc.exe | GET | 200 | 18.191.128.41:80 | http://www.packeteditor.com/72656C65617365/Application%20Files/PacketEditor_0_2_2_1/PacketEditor.exe | US | executable | 114 Kb | suspicious |
2496 | GFNGui.exe | GET | 200 | 116.202.244.153:80 | http://icanhazip.com/ | IN | text | 16 b | shared |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4064 | setup.exe | 18.191.128.41:80 | www.packeteditor.com | — | US | suspicious |
2964 | dfsvc.exe | 18.191.128.41:80 | www.packeteditor.com | — | US | suspicious |
2496 | GFNGui.exe | 116.202.244.153:80 | icanhazip.com | 334,Udyog Vihar | IN | malicious |
2496 | GFNGui.exe | 162.159.135.233:443 | discordapp.com | Cloudflare Inc | — | shared |
DNS requests
Domain | IP | Reputation |
|---|---|---|
www.packeteditor.com |
| suspicious |
icanhazip.com |
| shared |
discordapp.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2964 | dfsvc.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
2496 | GFNGui.exe | Attempted Information Leak | ET POLICY IP Check Domain (icanhazip. com in HTTP Host) |
Process | Message |
|---|---|
dfsvc.exe |
*** Status originated: -1073741811
*** Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
|
dfsvc.exe |
*** Status originated: -1073741811
*** Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
|
dfsvc.exe |
*** Status originated: -1073741811
*** Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
|
dfsvc.exe |
*** Status originated: -1073741811
*** Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
|
dfsvc.exe |
*** Status originated: -1073741811
*** Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
|
dfsvc.exe |
*** Status originated: -1073741811
*** Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
|
dfsvc.exe |
*** Status Originated: -1073741772
*** Source File: d:\iso_whid\x86fre\base\isolation\win32\isoreg_direct.cpp, line 1127
|