| File name: | Nueva carpeta.rar |
| Full analysis: | https://app.any.run/tasks/8d0ac1ef-752a-44d6-a8f8-f7ea68d1680c |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | December 14, 2018, 19:52:26 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-rar |
| File info: | RAR archive data, v5 |
| MD5: | 7AF57F7CCFCC759162B1E207CBF12658 |
| SHA1: | BC071D60CD11717D2AE15E6D580B78EB6AD66C09 |
| SHA256: | B7404ED4340E0B8A1462D9AA2C66D72A7468194E92CE79214C33837C8FABD41E |
| SSDEEP: | 12288:C83v57wF27g/f9kjjhShZMo9sUBfy+6fIPzVCqd1QeXA2:C83vaF60oSr6Ifv6QPzVtdJ |
MALICIOUS
Application was dropped or rewritten from another process
- convert2.exe (PID: 4060)
- convert2.exe (PID: 3440)
- xNeatBuilder.exe (PID: 2664)
- xNeatBuilder.exe (PID: 1808)
Downloads executable files from the Internet
- chrome.exe (PID: 3420)
- chrome.exe (PID: 2944)
Loads dropped or rewritten executable
- convert2.exe (PID: 3440)
Changes the autorun value in the registry
- convert2.exe (PID: 3440)
SUSPICIOUS
Executable content was dropped or overwritten
- chrome.exe (PID: 3420)
- convert2.exe (PID: 3440)
- chrome.exe (PID: 2944)
Creates files in the program directory
- convert2.exe (PID: 3440)
Creates files in the user directory
- convert2.exe (PID: 3440)
Creates a software uninstall entry
- convert2.exe (PID: 3440)
INFO
Application launched itself
- chrome.exe (PID: 3420)
- chrome.exe (PID: 2944)
Reads Internet Cache Settings
- chrome.exe (PID: 3420)
- chrome.exe (PID: 2944)
Reads settings of System Certificates
- chrome.exe (PID: 3420)
- chrome.exe (PID: 2944)
Application was crashed
- xNeatBuilder.exe (PID: 2664)
- xNeatBuilder.exe (PID: 1808)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .rar | | | RAR compressed archive (v5.0) (61.5) |
|---|---|---|
| .rar | | | RAR compressed archive (gen) (38.4) |
Total processes
74
Monitored processes
35
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 460 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=844,11011440401116836067,14812157408069511973,131072 --enable-features=PasswordImport --service-pipe-token=C382F63746240964D30A9EF66E043833 --lang=en-US --instant-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=C382F63746240964D30A9EF66E043833 --renderer-client-id=5 --mojo-platform-channel-handle=1892 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 68.0.3440.106 Modules
| |||||||||||||||
| 1476 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=844,11011440401116836067,14812157408069511973,131072 --enable-features=PasswordImport --disable-gpu-compositing --service-pipe-token=6CA94CC4F5B06189BE440D281C58E39B --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=6CA94CC4F5B06189BE440D281C58E39B --renderer-client-id=15 --mojo-platform-channel-handle=3444 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 68.0.3440.106 Modules
| |||||||||||||||
| 1644 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=956,11167965423439855814,3112671678446753900,131072 --enable-features=PasswordImport --disable-gpu-sandbox --gpu-preferences=KAAAAAAAAACAAwBAAQAAAAAAAAAAAGAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --service-request-channel-token=C35D72402498F3BA0F705A5C84E78780 --mojo-platform-channel-handle=4384 /prefetch:2 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 68.0.3440.106 Modules
| |||||||||||||||
| 1644 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=844,11011440401116836067,14812157408069511973,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAACAAwBAAQAAAAAAAAAAAGAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --service-request-channel-token=BD9C39A28A4835CDCCE647BD3809316C --mojo-platform-channel-handle=896 --ignored=" --type=renderer " /prefetch:2 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 68.0.3440.106 Modules
| |||||||||||||||
| 1688 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=68.0.3440.106 --initial-client-data=0x78,0x7c,0x80,0x74,0x84,0x70c700b0,0x70c700c0,0x70c700cc | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 68.0.3440.106 Modules
| |||||||||||||||
| 1808 | "C:\Program Files\xNeat Application Builder\xNeatBuilder.exe" | C:\Program Files\xNeat Application Builder\xNeatBuilder.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 3221225477 Modules
| |||||||||||||||
| 2180 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=956,11167965423439855814,3112671678446753900,131072 --enable-features=PasswordImport --service-pipe-token=7FE484D9A14A1D85F3304BE623814D93 --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=7FE484D9A14A1D85F3304BE623814D93 --renderer-client-id=3 --mojo-platform-channel-handle=2084 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 68.0.3440.106 Modules
| |||||||||||||||
| 2224 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=68.0.3440.106 --initial-client-data=0x78,0x7c,0x80,0x74,0x84,0x70fd00b0,0x70fd00c0,0x70fd00cc | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 68.0.3440.106 Modules
| |||||||||||||||
| 2228 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=844,11011440401116836067,14812157408069511973,131072 --enable-features=PasswordImport --disable-gpu-compositing --service-pipe-token=613017DBC2858B1B27F25038CF74FABE --lang=en-US --instant-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=613017DBC2858B1B27F25038CF74FABE --renderer-client-id=8 --mojo-platform-channel-handle=2928 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 68.0.3440.106 Modules
| |||||||||||||||
| 2320 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=2964 --on-initialized-event-handle=304 --parent-handle=308 /prefetch:6 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 68.0.3440.106 Modules
| |||||||||||||||
Total events
2 418
Read events
2 159
Write events
252
Delete events
7
Modification events
| (PID) Process: | (2952) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (2952) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (2952) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (2952) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\Nueva carpeta.rar | |||
| (PID) Process: | (2952) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (2952) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (2952) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (2952) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (2952) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin |
| Operation: | write | Name: | Placement |
Value: 2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000 | |||
| (PID) Process: | (2952) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\General |
| Operation: | write | Name: | LastFolder |
Value: C:\Users\admin\AppData\Local\Temp | |||
Executable files
14
Suspicious files
145
Text files
213
Unknown types
14
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2952 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2952.17299\Nueva carpeta\____.js | — | |
MD5:— | SHA256:— | |||
| 3420 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\7e1fdab9-68ab-4bab-a182-42cffa58c2dd.tmp | — | |
MD5:— | SHA256:— | |||
| 3420 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB\000016.dbtmp | — | |
MD5:— | SHA256:— | |||
| 3420 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000016.dbtmp | — | |
MD5:— | SHA256:— | |||
| 3420 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\e38658f5-f434-4e2a-81de-66592991d6b7.tmp | — | |
MD5:— | SHA256:— | |||
| 3420 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Last Version | text | |
MD5:— | SHA256:— | |||
| 2952 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2952.17299\Nueva carpeta\Nuevo documento de texto.txt | text | |
MD5:— | SHA256:— | |||
| 3420 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\e6622492fa163609ddd4212f54512baa07929ed3\caecb3bd-7969-4305-84d6-3a376453ec73\index-dir\temp-index | — | |
MD5:— | SHA256:— | |||
| 3420 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old~RF250059.TMP | text | |
MD5:— | SHA256:— | |||
| 3420 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old | text | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
64
TCP/UDP connections
64
DNS requests
31
Threats
5
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3420 | chrome.exe | GET | 200 | 67.210.126.80:80 | http://www.vbs2exe.com/layout.css | US | text | 1.05 Kb | suspicious |
3420 | chrome.exe | GET | 200 | 67.210.126.80:80 | http://www.vbs2exe.com/ajaxtabs/ajaxtabs.js | US | text | 10.1 Kb | suspicious |
3420 | chrome.exe | GET | 200 | 67.210.126.80:80 | http://www.vbs2exe.com/ | US | html | 2.67 Kb | suspicious |
3420 | chrome.exe | GET | 200 | 67.210.126.80:80 | http://www.vbs2exe.com/ajaxtabs/ajaxtabs.css | US | text | 2.86 Kb | suspicious |
3420 | chrome.exe | GET | 200 | 67.210.126.80:80 | http://www.vbs2exe.com/simple.htm | US | html | 1.13 Kb | suspicious |
2944 | chrome.exe | GET | 200 | 185.21.102.73:80 | http://www.f2ko.de/en/ov2e.php | DE | html | 3.23 Kb | malicious |
2944 | chrome.exe | GET | 200 | 185.21.102.73:80 | http://www.f2ko.de/css/jumbotron-narrow.css | DE | text | 334 b | malicious |
2944 | chrome.exe | GET | 200 | 185.21.102.73:80 | http://www.f2ko.de/css/justified-nav.css | DE | text | 635 b | malicious |
3420 | chrome.exe | GET | 200 | 67.210.126.80:80 | http://www.vbs2exe.com/ajaxtabs/shadeactive.gif | US | image | 838 b | suspicious |
3420 | chrome.exe | GET | 200 | 67.210.126.80:80 | http://www.vbs2exe.com/ajaxtabs/shade.gif | US | image | 949 b | suspicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3420 | chrome.exe | 216.58.206.3:443 | www.google.de | Google Inc. | US | whitelisted |
3420 | chrome.exe | 172.217.16.202:443 | safebrowsing.googleapis.com | Google Inc. | US | whitelisted |
3420 | chrome.exe | 216.58.207.35:443 | www.gstatic.com | Google Inc. | US | whitelisted |
3420 | chrome.exe | 172.217.21.237:443 | accounts.google.com | Google Inc. | US | whitelisted |
3420 | chrome.exe | 172.217.22.68:443 | www.google.com | Google Inc. | US | whitelisted |
3420 | chrome.exe | 67.210.126.80:80 | www.vbs2exe.com | Lunar Pages | US | suspicious |
3420 | chrome.exe | 172.217.22.14:80 | www.google-analytics.com | Google Inc. | US | whitelisted |
3420 | chrome.exe | 172.217.22.78:443 | sb-ssl.google.com | Google Inc. | US | whitelisted |
3440 | convert2.exe | 67.210.126.80:80 | www.vbs2exe.com | Lunar Pages | US | suspicious |
2944 | chrome.exe | 172.217.22.68:443 | www.google.com | Google Inc. | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
www.google.de |
| whitelisted |
clientservices.googleapis.com |
| whitelisted |
www.gstatic.com |
| whitelisted |
safebrowsing.googleapis.com |
| whitelisted |
accounts.google.com |
| shared |
ssl.gstatic.com |
| whitelisted |
www.google.com |
| malicious |
www.vbs2exe.com |
| suspicious |
www.google-analytics.com |
| whitelisted |
www.xneat.com |
| malicious |
Threats
PID | Process | Class | Message |
|---|---|---|---|
3420 | chrome.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
3440 | convert2.exe | A Network Trojan was detected | ET POLICY User-Agent (NSIS_Inetc (Mozilla)) - Sometimes used by hostile installers |
3440 | convert2.exe | Misc activity | SUSPICIOUS [PTsecurity] Suspicious HTTP header - Sometimes used by hostile installer |
3440 | convert2.exe | Misc activity | SUSPICIOUS [PTsecurity] Possible TrojanDownloader |
2944 | chrome.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |