analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Nueva carpeta.rar

Full analysis: https://app.any.run/tasks/8d0ac1ef-752a-44d6-a8f8-f7ea68d1680c
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: December 14, 2018, 19:52:26
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
coinhive
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

7AF57F7CCFCC759162B1E207CBF12658

SHA1:

BC071D60CD11717D2AE15E6D580B78EB6AD66C09

SHA256:

B7404ED4340E0B8A1462D9AA2C66D72A7468194E92CE79214C33837C8FABD41E

SSDEEP:

12288:C83v57wF27g/f9kjjhShZMo9sUBfy+6fIPzVCqd1QeXA2:C83vaF60oSr6Ifv6QPzVtdJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • convert2.exe (PID: 4060)
      • convert2.exe (PID: 3440)
      • xNeatBuilder.exe (PID: 2664)
      • xNeatBuilder.exe (PID: 1808)

    • Downloads executable files from the Internet

      • chrome.exe (PID: 3420)
      • chrome.exe (PID: 2944)

    • Loads dropped or rewritten executable

      • convert2.exe (PID: 3440)

    • Changes the autorun value in the registry

      • convert2.exe (PID: 3440)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 3420)
      • convert2.exe (PID: 3440)
      • chrome.exe (PID: 2944)

    • Creates files in the program directory

      • convert2.exe (PID: 3440)

    • Creates a software uninstall entry

      • convert2.exe (PID: 3440)

    • Creates files in the user directory

      • convert2.exe (PID: 3440)

  • INFO

    • Reads Internet Cache Settings

      • chrome.exe (PID: 3420)
      • chrome.exe (PID: 2944)

    • Reads settings of System Certificates

      • chrome.exe (PID: 3420)
      • chrome.exe (PID: 2944)

    • Application launched itself

      • chrome.exe (PID: 3420)
      • chrome.exe (PID: 2944)

    • Application was crashed

      • xNeatBuilder.exe (PID: 1808)
      • xNeatBuilder.exe (PID: 2664)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
74
Monitored processes
35
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start winrar.exe no specs notepad.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs convert2.exe no specs convert2.exe chrome.exe no specs xneatbuilder.exe xneatbuilder.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs notepad.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2952"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Nueva carpeta.rar"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
3856"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\Nuevo documento de texto.txtC:\Windows\system32\NOTEPAD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3420"C:\Program Files\Google\Chrome\Application\chrome.exe" C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
3221225547
Version:
68.0.3440.106
2224"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=68.0.3440.106 --initial-client-data=0x78,0x7c,0x80,0x74,0x84,0x70fd00b0,0x70fd00c0,0x70fd00ccC:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
68.0.3440.106
3432"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=3436 --on-initialized-event-handle=304 --parent-handle=308 /prefetch:6C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
68.0.3440.106
2604"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=956,11167965423439855814,3112671678446753900,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAACAAwBAAQAAAAAAAAAAAGAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --service-request-channel-token=761AFBE03C49B52AAEB979626EF319F5 --mojo-platform-channel-handle=976 --ignored=" --type=renderer " /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
68.0.3440.106
3348"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=956,11167965423439855814,3112671678446753900,131072 --enable-features=PasswordImport --service-pipe-token=9525B6B502536635EC953B80CF7BA023 --lang=en-US --instant-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=9525B6B502536635EC953B80CF7BA023 --renderer-client-id=5 --mojo-platform-channel-handle=1896 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
68.0.3440.106
2180"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=956,11167965423439855814,3112671678446753900,131072 --enable-features=PasswordImport --service-pipe-token=7FE484D9A14A1D85F3304BE623814D93 --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=7FE484D9A14A1D85F3304BE623814D93 --renderer-client-id=3 --mojo-platform-channel-handle=2084 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
68.0.3440.106
4032"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=956,11167965423439855814,3112671678446753900,131072 --enable-features=PasswordImport --disable-gpu-compositing --service-pipe-token=2E37CA39C486A0A43DE4A9D0C6A09E73 --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=2E37CA39C486A0A43DE4A9D0C6A09E73 --renderer-client-id=6 --mojo-platform-channel-handle=3776 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
68.0.3440.106
4060"C:\Users\admin\Downloads\convert2.exe" C:\Users\admin\Downloads\convert2.exe—chrome.exe
User:
admin
Company:
XNeat Inc.
Integrity Level:
MEDIUM
Description:
xNeat Application Builder
Exit code:
3221226540
Version:
1.0.0.1
Total events
2 418
Read events
2 159
Write events
0
Delete events
0

Modification events

No data
Executable files
14
Suspicious files
145
Text files
213
Unknown types
14

Dropped files

PID
Process
Filename
Type
2952WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2952.17299\Nueva carpeta\____.js —
MD5:—
SHA256:—
3420chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\7e1fdab9-68ab-4bab-a182-42cffa58c2dd.tmp —
MD5:—
SHA256:—
3420chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB\000016.dbtmp —
MD5:—
SHA256:—
3420chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000016.dbtmp —
MD5:—
SHA256:—
3420chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\e38658f5-f434-4e2a-81de-66592991d6b7.tmp —
MD5:—
SHA256:—
2952WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2952.17299\Nueva carpeta\Nuevo documento de texto.txttext
MD5:8F8B388C6B478B8502BAEFADF0F7E992
SHA256:5BB88DED3EC6948E8A872167545762704D2E4E81CD49F652998BAE80FAD32801
3420chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.oldtext
MD5:92BE6B127E72365885AD4C3FB6534EE2
SHA256:54302A2573ACC775720E7DB0AD85873276713302B4F72596A8DCC44B01C70E51
3420chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\e6622492fa163609ddd4212f54512baa07929ed3\caecb3bd-7969-4305-84d6-3a376453ec73\index-dir\temp-index —
MD5:—
SHA256:—
3420chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG.oldtext
MD5:1AA66EFDB743FB0A8DCC1CD79B0B6542
SHA256:28D56532CCED7375A2A1C7731E57C1A1C2EC1AC9827F3E5BEEE7F8069A5F87DD
3420chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG.old~RF25003a.TMPtext
MD5:1AA66EFDB743FB0A8DCC1CD79B0B6542
SHA256:28D56532CCED7375A2A1C7731E57C1A1C2EC1AC9827F3E5BEEE7F8069A5F87DD
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
64
TCP/UDP connections
64
DNS requests
31
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3420
chrome.exe
GET
200
67.210.126.80:80
http://www.vbs2exe.com/layout.css
US
text
1.05 Kb
suspicious
3420
chrome.exe
GET
200
67.210.126.80:80
http://www.vbs2exe.com/ajaxtabs/shadeactive.gif
US
image
838 b
suspicious
3420
chrome.exe
GET
200
67.210.126.80:80
http://www.vbs2exe.com/ajaxtabs/ajaxtabs.js
US
text
10.1 Kb
suspicious
3420
chrome.exe
GET
200
67.210.126.80:80
http://www.vbs2exe.com/simple.htm
US
html
1.13 Kb
suspicious
2944
chrome.exe
GET
200
172.217.22.14:80
http://www.google-analytics.com/__utm.gif?utmwv=1.4&utmn=932165081&utmcs=windows-1252&utmsr=1280x720&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Online%20Vbscript%20%26%20HTML%20to%20EXE%20Converter&utmhn=www.vbs2exe.com&utmhid=1005018223&utmr=-&utmp=/&utmac=UA-3102514-2&utmcc=__utma%3D37367143.1042470993.1544817205.1544817205.1544817230.2%3B%2B__utmz%3D37367143.1544817205.1.1.utmccn%3D(direct)%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)%3B%2B
US
image
35 b
whitelisted
2944
chrome.exe
GET
404
67.210.126.80:80
http://www.vbs2exe.com/favicon.ico
US
html
328 b
suspicious
2944
chrome.exe
GET
200
67.210.126.80:80
http://www.vbs2exe.com/download/convert2.exe
US
executable
398 Kb
suspicious
3420
chrome.exe
GET
200
67.210.126.80:80
http://www.vbs2exe.com/ajaxtabs/shade.gif
US
image
949 b
suspicious
3420
chrome.exe
GET
200
67.210.126.80:80
http://www.vbs2exe.com/
US
html
2.67 Kb
suspicious
3420
chrome.exe
GET
200
67.210.126.80:80
http://www.vbs2exe.com/download/convert2.exe
US
executable
398 Kb
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3420
chrome.exe
172.217.16.202:443
safebrowsing.googleapis.com
Google Inc.
US
whitelisted
3420
chrome.exe
67.210.126.80:80
www.vbs2exe.com
Lunar Pages
US
suspicious
3420
chrome.exe
216.58.207.35:443
www.gstatic.com
Google Inc.
US
whitelisted
3420
chrome.exe
172.217.21.237:443
accounts.google.com
Google Inc.
US
whitelisted
3420
chrome.exe
172.217.22.3:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
3420
chrome.exe
216.58.206.3:443
www.google.de
Google Inc.
US
whitelisted
3420
chrome.exe
172.217.22.78:443
sb-ssl.google.com
Google Inc.
US
whitelisted
3420
chrome.exe
172.217.22.14:80
www.google-analytics.com
Google Inc.
US
whitelisted
3420
chrome.exe
172.217.22.68:443
www.google.com
Google Inc.
US
whitelisted
2944
chrome.exe
67.210.126.80:80
www.vbs2exe.com
Lunar Pages
US
suspicious

DNS requests

Domain
IP
Reputation
www.google.de
  • 216.58.206.3
whitelisted
clientservices.googleapis.com
  • 172.217.22.3
whitelisted
www.gstatic.com
  • 216.58.207.35
whitelisted
safebrowsing.googleapis.com
  • 172.217.16.202
whitelisted
accounts.google.com
  • 172.217.21.237
shared
ssl.gstatic.com
  • 216.58.206.3
whitelisted
www.google.com
  • 172.217.22.68
whitelisted
www.vbs2exe.com
  • 67.210.126.80
suspicious
www.google-analytics.com
  • 172.217.22.14
whitelisted
www.xneat.com
  • 67.210.126.80
malicious

Threats

PID
Process
Class
Message
3420
chrome.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3440
convert2.exe
A Network Trojan was detected
ET POLICY User-Agent (NSIS_Inetc (Mozilla)) - Sometimes used by hostile installers
3440
convert2.exe
Misc activity
SUSPICIOUS [PTsecurity] Suspicious HTTP header - Sometimes used by hostile installer
3440
convert2.exe
Misc activity
SUSPICIOUS [PTsecurity] Possible TrojanDownloader
2944
chrome.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Nueva carpeta.rar