analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

bill notice 05.2019.rar

Full analysis: https://app.any.run/tasks/f363c1d5-45ed-4b08-ab3c-54f1f5ac1636
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: May 20, 2019, 13:40:07
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
rms
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

0569CA387F8B950E00B99E9ACB612BE9

SHA1:

33D0CDACED6249AA93B4B1B54D2005A907EE563F

SHA256:

BF5E00FA491B76FCCEEA0B8DE133F5C28E20C556FACCE6652E6BCA60FA946746

SSDEEP:

1536:Tr99BZ4Hi14xpjaCvCl7fnrZ0L/gCwKzDQV+o5p5t/1MxxJZ/dd6mEpjKCqvDawE:d9BZ4Hddsl50LpwKzcV+CqxrZWFsawE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads the Task Scheduler COM API

      • OSPPSVC.EXE (PID: 2328)

    • Executable content was dropped or overwritten

      • EXCEL.EXE (PID: 1824)

    • Unusual execution from Microsoft Office

      • EXCEL.EXE (PID: 1824)

    • Application was dropped or rewritten from another process

      • wprgxyeqd79.exe (PID: 3892)
      • exit.exe (PID: 3824)
      • rtegre.exe (PID: 3184)
      • veter1605_MAPS_10cr0.exe (PID: 1924)
      • uninstall.exe (PID: 3904)
      • exit.exe (PID: 2656)
      • winserv.exe (PID: 3128)

    • Loads dropped or rewritten executable

      • cmd.exe (PID: 2472)
      • taskkill.exe (PID: 1668)
      • taskkill.exe (PID: 2844)
      • taskkill.exe (PID: 588)
      • taskkill.exe (PID: 3068)
      • taskkill.exe (PID: 2204)
      • EXCEL.EXE (PID: 1824)
      • exit.exe (PID: 3824)
      • exit.exe (PID: 2656)
      • rtegre.exe (PID: 3184)
      • OSPPSVC.EXE (PID: 2328)
      • cmd.exe (PID: 2632)
      • svchost.exe (PID: 1920)
      • veter1605_MAPS_10cr0.exe (PID: 1924)
      • winserv.exe (PID: 3128)
      • PING.EXE (PID: 2760)
      • PING.EXE (PID: 3484)
      • taskkill.exe (PID: 3976)
      • WinRAR.exe (PID: 3016)
      • taskkill.exe (PID: 1668)
      • wprgxyeqd79.exe (PID: 3892)
      • taskkill.exe (PID: 1260)
      • taskkill.exe (PID: 3540)
      • taskkill.exe (PID: 2308)
      • taskkill.exe (PID: 2284)
      • taskkill.exe (PID: 928)
      • taskkill.exe (PID: 352)
      • conhost.exe (PID: 1652)
      • taskkill.exe (PID: 1020)
      • taskkill.exe (PID: 796)
      • taskkill.exe (PID: 3368)
      • taskkill.exe (PID: 3800)
      • taskkill.exe (PID: 2892)
      • taskkill.exe (PID: 2952)
      • taskkill.exe (PID: 3804)
      • taskkill.exe (PID: 3992)
      • taskkill.exe (PID: 3504)
      • taskkill.exe (PID: 3636)
      • taskkill.exe (PID: 4088)
      • taskkill.exe (PID: 3064)
      • taskkill.exe (PID: 3336)
      • taskkill.exe (PID: 3004)
      • reg.exe (PID: 1484)
      • taskkill.exe (PID: 576)
      • taskkill.exe (PID: 3824)
      • uninstall.exe (PID: 3904)
      • taskkill.exe (PID: 3680)
      • wmiprvse.exe (PID: 3848)
      • conhost.exe (PID: 3176)
      • taskkill.exe (PID: 2680)
      • taskkill.exe (PID: 2980)
      • taskkill.exe (PID: 2800)
      • taskkill.exe (PID: 2832)
      • taskkill.exe (PID: 3728)
      • taskkill.exe (PID: 2964)
      • taskkill.exe (PID: 2224)
      • taskkill.exe (PID: 1928)
      • taskkill.exe (PID: 1356)
      • taskkill.exe (PID: 1768)
      • taskkill.exe (PID: 456)
      • taskkill.exe (PID: 2836)
      • taskkill.exe (PID: 3916)
      • taskkill.exe (PID: 2888)
      • taskkill.exe (PID: 3024)
      • taskkill.exe (PID: 2824)
      • taskkill.exe (PID: 1244)
      • taskkill.exe (PID: 2504)
      • taskkill.exe (PID: 2732)
      • taskkill.exe (PID: 3336)
      • taskkill.exe (PID: 1672)
      • taskkill.exe (PID: 3988)
      • taskkill.exe (PID: 3216)
      • taskkill.exe (PID: 1096)
      • taskkill.exe (PID: 1672)
      • taskkill.exe (PID: 3656)
      • taskkill.exe (PID: 3876)
      • taskkill.exe (PID: 2840)
      • taskkill.exe (PID: 896)
      • taskkill.exe (PID: 3968)
      • taskkill.exe (PID: 2888)
      • taskkill.exe (PID: 1548)
      • taskkill.exe (PID: 1476)
      • taskkill.exe (PID: 1244)
      • taskkill.exe (PID: 2560)
      • taskkill.exe (PID: 856)
      • taskkill.exe (PID: 2128)
      • taskkill.exe (PID: 2968)
      • taskkill.exe (PID: 2836)
      • taskkill.exe (PID: 300)
      • taskkill.exe (PID: 3900)
      • taskkill.exe (PID: 2660)
      • taskkill.exe (PID: 3660)
      • taskkill.exe (PID: 3300)
      • taskkill.exe (PID: 2680)
      • taskkill.exe (PID: 2232)
      • taskkill.exe (PID: 3756)
      • taskkill.exe (PID: 3352)
      • taskkill.exe (PID: 3104)
      • taskkill.exe (PID: 3004)
      • taskkill.exe (PID: 2504)
      • taskkill.exe (PID: 1836)
      • taskkill.exe (PID: 1664)
      • taskkill.exe (PID: 3036)
      • taskkill.exe (PID: 1796)
      • taskkill.exe (PID: 3308)
      • taskkill.exe (PID: 928)
      • taskkill.exe (PID: 796)
      • taskkill.exe (PID: 2316)
      • taskkill.exe (PID: 2300)
      • taskkill.exe (PID: 3952)
      • taskkill.exe (PID: 3216)
      • taskkill.exe (PID: 3132)
      • taskkill.exe (PID: 3440)
      • taskkill.exe (PID: 4084)
      • taskkill.exe (PID: 2708)
      • taskkill.exe (PID: 3768)
      • taskkill.exe (PID: 3924)
      • taskkill.exe (PID: 3868)
      • taskkill.exe (PID: 760)
      • taskkill.exe (PID: 1928)
      • taskkill.exe (PID: 1356)
      • taskkill.exe (PID: 1740)
      • taskkill.exe (PID: 3096)
      • taskkill.exe (PID: 3536)
      • taskkill.exe (PID: 2988)
      • taskkill.exe (PID: 3180)
      • taskkill.exe (PID: 2700)
      • taskkill.exe (PID: 1344)
      • taskkill.exe (PID: 2924)
      • taskkill.exe (PID: 3460)
      • taskkill.exe (PID: 2176)
      • taskkill.exe (PID: 1832)
      • taskkill.exe (PID: 1184)
      • taskkill.exe (PID: 1032)
      • taskkill.exe (PID: 3544)
      • taskkill.exe (PID: 3300)
      • taskkill.exe (PID: 3132)
      • taskkill.exe (PID: 1156)
      • taskkill.exe (PID: 540)
      • taskkill.exe (PID: 2668)
      • taskkill.exe (PID: 3224)
      • taskkill.exe (PID: 3620)
      • taskkill.exe (PID: 3656)
      • taskkill.exe (PID: 296)
      • taskkill.exe (PID: 1436)
      • taskkill.exe (PID: 2968)
      • taskkill.exe (PID: 2900)
      • taskkill.exe (PID: 2368)
      • taskkill.exe (PID: 1944)
      • taskkill.exe (PID: 3468)
      • taskkill.exe (PID: 1532)
      • taskkill.exe (PID: 916)
      • taskkill.exe (PID: 3708)
      • taskkill.exe (PID: 3332)
      • taskkill.exe (PID: 2484)
      • taskkill.exe (PID: 3352)
      • taskkill.exe (PID: 1308)
      • taskkill.exe (PID: 3428)
      • taskkill.exe (PID: 476)
      • taskkill.exe (PID: 2492)
      • taskkill.exe (PID: 2296)
      • taskkill.exe (PID: 3068)
      • taskkill.exe (PID: 3244)
      • taskkill.exe (PID: 3680)
      • taskkill.exe (PID: 292)
      • taskkill.exe (PID: 1000)
      • taskkill.exe (PID: 3832)
      • taskkill.exe (PID: 3764)
      • taskkill.exe (PID: 2376)
      • taskkill.exe (PID: 2560)
      • taskkill.exe (PID: 3812)
      • taskkill.exe (PID: 2524)
      • taskkill.exe (PID: 3260)
      • taskkill.exe (PID: 3072)
      • taskkill.exe (PID: 3984)
      • taskkill.exe (PID: 896)
      • taskkill.exe (PID: 2684)
      • taskkill.exe (PID: 2088)
      • taskkill.exe (PID: 3096)
      • taskkill.exe (PID: 1184)
      • taskkill.exe (PID: 3408)
      • taskkill.exe (PID: 1464)
      • taskkill.exe (PID: 948)
      • taskkill.exe (PID: 2172)
      • taskkill.exe (PID: 3308)
      • taskkill.exe (PID: 2536)
      • taskkill.exe (PID: 1064)
      • taskkill.exe (PID: 3748)
      • taskkill.exe (PID: 2936)
      • taskkill.exe (PID: 936)
      • taskkill.exe (PID: 2284)
      • taskkill.exe (PID: 3496)
      • taskkill.exe (PID: 2548)
      • taskkill.exe (PID: 3780)
      • taskkill.exe (PID: 2120)
      • taskkill.exe (PID: 3708)
      • taskkill.exe (PID: 3492)
      • taskkill.exe (PID: 3692)
      • taskkill.exe (PID: 2192)
      • taskkill.exe (PID: 3756)
      • taskkill.exe (PID: 3960)
      • taskkill.exe (PID: 1836)
      • taskkill.exe (PID: 576)
      • taskkill.exe (PID: 2996)
      • taskkill.exe (PID: 2656)
      • taskkill.exe (PID: 2832)
      • taskkill.exe (PID: 2868)
      • taskkill.exe (PID: 3248)
      • taskkill.exe (PID: 3536)
      • taskkill.exe (PID: 2088)
      • taskkill.exe (PID: 252)
      • taskkill.exe (PID: 3412)
      • taskkill.exe (PID: 300)
      • taskkill.exe (PID: 2116)
      • taskkill.exe (PID: 2964)
      • taskkill.exe (PID: 3408)
      • taskkill.exe (PID: 948)
      • taskkill.exe (PID: 3112)
      • taskkill.exe (PID: 3244)
      • taskkill.exe (PID: 588)
      • taskkill.exe (PID: 3928)
      • taskkill.exe (PID: 3868)
      • taskkill.exe (PID: 3224)
      • taskkill.exe (PID: 1964)
      • taskkill.exe (PID: 1696)
      • taskkill.exe (PID: 2684)
      • taskkill.exe (PID: 2072)
      • taskkill.exe (PID: 3424)
      • taskkill.exe (PID: 4088)
      • taskkill.exe (PID: 4084)
      • taskkill.exe (PID: 2096)
      • taskkill.exe (PID: 2364)
      • taskkill.exe (PID: 3436)
      • taskkill.exe (PID: 292)
      • taskkill.exe (PID: 2692)
      • taskkill.exe (PID: 2132)
      • taskkill.exe (PID: 3460)
      • taskkill.exe (PID: 2068)
      • taskkill.exe (PID: 3124)
      • taskkill.exe (PID: 1064)
      • taskkill.exe (PID: 1096)
      • taskkill.exe (PID: 2200)
      • taskkill.exe (PID: 3984)
      • taskkill.exe (PID: 1728)
      • taskkill.exe (PID: 3864)
      • taskkill.exe (PID: 3160)
      • taskkill.exe (PID: 2372)
      • taskkill.exe (PID: 1012)
      • taskkill.exe (PID: 2980)
      • taskkill.exe (PID: 3540)
      • taskkill.exe (PID: 3552)
      • taskkill.exe (PID: 1388)
      • taskkill.exe (PID: 2468)
      • WerFault.exe (PID: 1108)
      • taskkill.exe (PID: 2436)
      • taskkill.exe (PID: 2000)
      • taskkill.exe (PID: 2264)
      • taskkill.exe (PID: 2060)
      • taskkill.exe (PID: 2712)
      • taskkill.exe (PID: 1964)
      • taskkill.exe (PID: 3424)
      • taskkill.exe (PID: 2572)
      • taskkill.exe (PID: 3808)
      • taskkill.exe (PID: 1276)
      • taskkill.exe (PID: 3860)
      • taskkill.exe (PID: 2844)
      • taskkill.exe (PID: 2308)
      • taskkill.exe (PID: 2640)
      • taskkill.exe (PID: 2436)
      • taskkill.exe (PID: 2532)
      • taskkill.exe (PID: 3376)
      • taskkill.exe (PID: 3000)
      • taskkill.exe (PID: 3348)
      • taskkill.exe (PID: 3468)
      • taskkill.exe (PID: 3628)
      • taskkill.exe (PID: 2516)
      • taskkill.exe (PID: 2956)
      • taskkill.exe (PID: 1644)
      • taskkill.exe (PID: 3292)
      • taskkill.exe (PID: 3584)
      • taskkill.exe (PID: 1260)
      • taskkill.exe (PID: 3732)
      • taskkill.exe (PID: 1592)
      • taskkill.exe (PID: 2204)
      • taskkill.exe (PID: 2180)
      • taskkill.exe (PID: 2368)
      • taskkill.exe (PID: 3732)
      • taskkill.exe (PID: 3748)
      • taskkill.exe (PID: 2812)
      • taskkill.exe (PID: 2364)
      • taskkill.exe (PID: 2104)
      • taskkill.exe (PID: 1000)
      • taskkill.exe (PID: 2280)
      • taskkill.exe (PID: 3724)
      • taskkill.exe (PID: 2808)
      • taskkill.exe (PID: 3908)
      • taskkill.exe (PID: 3796)
      • taskkill.exe (PID: 1796)
      • taskkill.exe (PID: 1100)
      • taskkill.exe (PID: 856)
      • taskkill.exe (PID: 3852)
      • taskkill.exe (PID: 3104)
      • taskkill.exe (PID: 2868)
      • taskkill.exe (PID: 3040)
      • taskkill.exe (PID: 296)
      • taskkill.exe (PID: 2196)
      • taskkill.exe (PID: 900)
      • taskkill.exe (PID: 2764)
      • taskkill.exe (PID: 2596)
      • taskkill.exe (PID: 2916)
      • taskkill.exe (PID: 2416)
      • taskkill.exe (PID: 2800)
      • taskkill.exe (PID: 3144)
      • taskkill.exe (PID: 3112)
      • taskkill.exe (PID: 3288)
      • taskkill.exe (PID: 3640)
      • taskkill.exe (PID: 2580)
      • taskkill.exe (PID: 832)
      • taskkill.exe (PID: 1532)
      • taskkill.exe (PID: 2972)
      • taskkill.exe (PID: 2120)
      • taskkill.exe (PID: 3092)
      • taskkill.exe (PID: 2552)
      • taskkill.exe (PID: 2812)
      • taskkill.exe (PID: 3628)
      • taskkill.exe (PID: 3060)
      • taskkill.exe (PID: 2136)
      • taskkill.exe (PID: 3360)
      • taskkill.exe (PID: 2148)
      • taskkill.exe (PID: 900)
      • taskkill.exe (PID: 3456)
      • taskkill.exe (PID: 280)
      • taskkill.exe (PID: 3344)
      • taskkill.exe (PID: 2148)
      • taskkill.exe (PID: 3800)
      • taskkill.exe (PID: 2096)
      • taskkill.exe (PID: 1336)
      • taskkill.exe (PID: 2928)
      • taskkill.exe (PID: 3832)
      • taskkill.exe (PID: 2268)
      • taskkill.exe (PID: 3116)
      • taskkill.exe (PID: 2460)
      • taskkill.exe (PID: 3772)
      • taskkill.exe (PID: 3212)
      • taskkill.exe (PID: 4092)
      • taskkill.exe (PID: 2828)
      • taskkill.exe (PID: 3064)
      • taskkill.exe (PID: 4072)
      • taskkill.exe (PID: 2876)
      • taskkill.exe (PID: 676)
      • taskkill.exe (PID: 1436)
      • taskkill.exe (PID: 2420)
      • taskkill.exe (PID: 2488)
      • taskkill.exe (PID: 1780)
      • taskkill.exe (PID: 1944)
      • taskkill.exe (PID: 3144)
      • taskkill.exe (PID: 2732)
      • taskkill.exe (PID: 1256)
      • taskkill.exe (PID: 2712)
      • taskkill.exe (PID: 3388)
      • taskkill.exe (PID: 2064)
      • taskkill.exe (PID: 4000)
      • taskkill.exe (PID: 2072)
      • taskkill.exe (PID: 2316)
      • taskkill.exe (PID: 2484)
      • taskkill.exe (PID: 2408)
      • taskkill.exe (PID: 3660)
      • taskkill.exe (PID: 1420)
      • taskkill.exe (PID: 1012)
      • taskkill.exe (PID: 3616)
      • taskkill.exe (PID: 2700)
      • taskkill.exe (PID: 2084)
      • taskkill.exe (PID: 2992)
      • taskkill.exe (PID: 1420)
      • taskkill.exe (PID: 540)
      • taskkill.exe (PID: 584)
      • taskkill.exe (PID: 2420)
      • taskkill.exe (PID: 1100)
      • taskkill.exe (PID: 3632)
      • taskkill.exe (PID: 2176)
      • taskkill.exe (PID: 2908)
      • taskkill.exe (PID: 2460)
      • taskkill.exe (PID: 2952)
      • taskkill.exe (PID: 3552)
      • taskkill.exe (PID: 852)
      • taskkill.exe (PID: 2652)
      • taskkill.exe (PID: 2820)
      • taskkill.exe (PID: 3752)
      • taskkill.exe (PID: 1896)
      • taskkill.exe (PID: 2736)
      • taskkill.exe (PID: 1276)
      • taskkill.exe (PID: 2652)
      • taskkill.exe (PID: 3312)
      • taskkill.exe (PID: 2864)
      • taskkill.exe (PID: 3696)
      • taskkill.exe (PID: 3124)
      • taskkill.exe (PID: 1896)
      • taskkill.exe (PID: 3716)
      • taskkill.exe (PID: 3640)
      • taskkill.exe (PID: 3968)
      • taskkill.exe (PID: 2500)
      • taskkill.exe (PID: 3116)
      • taskkill.exe (PID: 2552)
      • taskkill.exe (PID: 952)
      • taskkill.exe (PID: 2776)
      • taskkill.exe (PID: 3864)
      • taskkill.exe (PID: 2820)
      • taskkill.exe (PID: 2280)
      • taskkill.exe (PID: 3324)
      • taskkill.exe (PID: 3596)
      • taskkill.exe (PID: 3452)
      • taskkill.exe (PID: 3720)
      • taskkill.exe (PID: 2852)
      • taskkill.exe (PID: 764)
      • taskkill.exe (PID: 3676)
      • taskkill.exe (PID: 3652)
      • taskkill.exe (PID: 2532)
      • taskkill.exe (PID: 2928)
      • taskkill.exe (PID: 3664)
      • taskkill.exe (PID: 2060)
      • taskkill.exe (PID: 3324)
      • taskkill.exe (PID: 2668)
      • taskkill.exe (PID: 4072)
      • taskkill.exe (PID: 3056)
      • taskkill.exe (PID: 2404)

    • Changes the autorun value in the registry

      • reg.exe (PID: 1484)

    • RMS RAT was detected

      • winserv.exe (PID: 3128)

  • SUSPICIOUS

    • Starts Microsoft Office Application

      • WinRAR.exe (PID: 3016)

    • Executable content was dropped or overwritten

      • wprgxyeqd79.exe (PID: 3892)
      • cmd.exe (PID: 2472)
      • uninstall.exe (PID: 3904)
      • veter1605_MAPS_10cr0.exe (PID: 1924)

    • Starts CMD.EXE for commands execution

      • exit.exe (PID: 3824)
      • exit.exe (PID: 2656)

    • Creates files in the program directory

      • uninstall.exe (PID: 3904)

    • Uses REG.EXE to modify Windows registry

      • cmd.exe (PID: 2632)

    • Reads Environment values

      • winserv.exe (PID: 3128)

    • Creates files in the user directory

      • winserv.exe (PID: 3128)

    • Reads Windows Product ID

      • winserv.exe (PID: 3128)

    • Reads the machine GUID from the registry

      • winserv.exe (PID: 3128)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 2632)

  • INFO

    • Reads Microsoft Office registry keys

      • EXCEL.EXE (PID: 1824)

    • Creates files in the user directory

      • EXCEL.EXE (PID: 1824)

    • Dropped object may contain Bitcoin addresses

      • wprgxyeqd79.exe (PID: 3892)

    • Application was crashed

      • rtegre.exe (PID: 3184)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
459
Monitored processes
428
Malicious processes
10
Suspicious processes
21

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start winrar.exe no specs excel.exe wprgxyeqd79.exe exit.exe no specs cmd.exe ping.exe no specs ping.exe no specs rtegre.exe uninstall.exe veter1605_maps_10cr0.exe exit.exe no specs cmd.exe no specs reg.exe #RMS winserv.exe taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs osppsvc.exe no specs conhost.exe no specs svchost.exe no specs conhost.exe no specs wmiprvse.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs werfault.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3016"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\bill notice 05.2019.rar"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
1824"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /ddeC:\Program Files\Microsoft Office\Office14\EXCEL.EXE
WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Version:
14.0.6024.1000
3892C:\Users\Public\wprgxyeqd79.exeC:\Users\Public\wprgxyeqd79.exe
EXCEL.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3824"C:\Users\admin\AppData\Local\Temp\exit.exe" C:\Users\admin\AppData\Local\Temp\exit.exe—wprgxyeqd79.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2472cmd /c i.cmdC:\Windows\system32\cmd.exe
exit.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3484ping www.cloudflare.com -n 3 -w 3000C:\Windows\system32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2760ping www.cloudflare.com -n 3 -w 1000C:\Windows\system32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3184C:\Users\Public\rtegre.exeC:\Users\Public\rtegre.exe
EXCEL.EXE
User:
admin
Company:
x264 project
Integrity Level:
MEDIUM
Description:
Nkcreatestaticmapping Aboriginal Year
Exit code:
3221225477
Version:
5.7.3.790
3904uninstall.exe x -pQELRatcwbU2EJ5 -yC:\Users\admin\AppData\Local\Temp\uninstall.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
1924veter1605_MAPS_10cr0.exe C:\Users\admin\AppData\Local\Temp\veter1605_MAPS_10cr0.exe
cmd.exe
User:
admin
Company:
Miranda IM
Integrity Level:
MEDIUM
Description:
Tile Textheight Clipbook Mostly Wading
Exit code:
0
Version:
8.7.56.236
Total events
2 658
Read events
2 582
Write events
0
Delete events
0

Modification events

No data
Executable files
11
Suspicious files
3
Text files
5
Unknown types
1

Dropped files

PID
Process
Filename
Type
1824EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVR2478.tmp.cvr —
MD5:—
SHA256:—
3016WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa3016.12620\bill notice 05.2019.xlsdocument
MD5:99AC3F1416CAC91098DAFA8400EB08D4
SHA256:BF6D31FACA12C2A33477AF2C17A01049171ABEC4640B4B14067D8D8779D3BE57
3892wprgxyeqd79.exeC:\Users\admin\AppData\Local\Temp\exit.exeexecutable
MD5:E488DECBB44AD1A3430E82B57A70615E
SHA256:FD701894E7EC8D8319BC9B32BBA5892B11BDF608C3D04C2F18EFF83419EB6DF0
1824EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\ananas[1].exeexecutable
MD5:7E77BB853D227E06B635E6EB3E0B31F0
SHA256:385F0A0CCAEC6272C8270F0D5228F2641CCA916E84825EBB35DBEBB036FA2165
3892wprgxyeqd79.exeC:\Users\admin\AppData\Local\Temp\i.cmdtext
MD5:E8E66827FFE84E0C28A2EB6A5073354F
SHA256:C69CE39AC3E178A89076136AF7418C6CB664844B0CE5CB643912ED56C373A08A
3892wprgxyeqd79.exeC:\Users\admin\AppData\Local\Temp\veter1605_MAPS_10cr0.exeexecutable
MD5:6DF420B5D8BDDB0F5FFE3EDCC9A4464B
SHA256:1EE1BA514212F11A69D002005DFC623B1871CC808F18DDFA2191102BBB9F623B
3904uninstall.exeC:\ProgramData\Windows Anytime Upgrade\exit.exeexecutable
MD5:E488DECBB44AD1A3430E82B57A70615E
SHA256:FD701894E7EC8D8319BC9B32BBA5892B11BDF608C3D04C2F18EFF83419EB6DF0
1108WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\rtegre.exe.3184.dmpdmp
MD5:B381FAA84F798635B7A7A8D1FEF3D80F
SHA256:0EE95C08040AFF0AE714B62D8CBC69B96CCCBD636D2A5958E19BA2D0EE55F5DE
2472cmd.exeC:\Users\admin\AppData\Local\Temp\uninstall.exeexecutable
MD5:9F63EF6993F98DDD56E1E2CDF2D67B27
SHA256:5310C2397BA4C783F7EE9724711A6DA9B5C603B5C9781FFF3407B46725E338B3
3128winserv.exeC:\Users\admin\AppData\Roaming\RMS_settings\Logs\rms_log_2019-05.htmlhtml
MD5:888DA986B78C29212F1B1A82B8719745
SHA256:B5E6DCD082D1FFD9BC93CC9777EFB4D12B472B366BCFFE9B58C1AED7CF96CE76
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
13
DNS requests
7
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3184
rtegre.exe
GET
—
212.186.71.38:80
http://212.186.71.38/tor/server/fp/3687fec7e73f61ac66f7ae251e7dee6bbd8c0252
AT
—
—
suspicious
3184
rtegre.exe
GET
—
198.50.211.194:80
http://198.50.211.194/tor/server/fp/bc30e810ffd274b3a2c454047e56e599a9c86497
PA
—
—
malicious
3184
rtegre.exe
GET
—
51.255.206.74:80
http://51.255.206.74/tor/server/fp/bc30e810ffd274b3a2c454047e56e599a9c86497
FR
—
—
suspicious
3184
rtegre.exe
GET
—
204.13.164.118:80
http://204.13.164.118/tor/status-vote/current/consensus
US
—
—
suspicious
3184
rtegre.exe
GET
—
66.111.2.131:9030
http://66.111.2.131:9030/tor/status-vote/current/consensus
US
—
—
suspicious
3184
rtegre.exe
GET
—
104.218.63.76:80
http://104.218.63.76/tor/server/fp/5ed7e5eec5fe07ee7eef8005519adb175e24b6db
CA
—
—
suspicious
3184
rtegre.exe
GET
—
104.223.45.150:80
http://104.223.45.150/tor/server/fp/592031cfdba17dd46e1e365e6c60ad1f81655033
US
—
—
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3128
winserv.exe
217.12.201.159:5655
—
ITL Company
NL
suspicious
1824
EXCEL.EXE
47.245.58.124:443
kentona.su
—
US
suspicious
3184
rtegre.exe
204.13.164.118:80
—
Riseup Networks
US
suspicious
3184
rtegre.exe
66.111.2.131:9030
—
The New York Internet Company
US
suspicious
3184
rtegre.exe
54.243.198.12:443
api.ipify.org
Amazon.com, Inc.
US
malicious
3184
rtegre.exe
198.50.211.194:80
—
OVH SAS
PA
malicious
3184
rtegre.exe
94.140.116.189:443
—
Makonix SIA
LV
suspicious
3184
rtegre.exe
129.6.15.28:13
time-a.nist.gov
National Bureau of Standards
US
unknown
3184
rtegre.exe
51.255.206.74:80
—
OVH SAS
FR
suspicious
3184
rtegre.exe
81.7.16.182:80
—
ISPpro Internet KG
DE
suspicious

DNS requests

Domain
IP
Reputation
kentona.su
  • 47.245.58.124
malicious
www.cloudflare.com
  • 104.17.210.9
  • 104.17.209.9
whitelisted
api.ipify.org
  • 54.243.198.12
  • 54.235.124.112
  • 23.21.121.219
  • 54.204.36.156
  • 50.19.247.198
  • 107.22.215.20
  • 54.225.171.237
  • 50.16.229.140
shared
time-a.nist.gov
  • 129.6.15.28
whitelisted
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET DNS Query for .su TLD (Soviet Union) Often Malware Related
3184
rtegre.exe
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 333
3184
rtegre.exe
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 550
3184
rtegre.exe
Misc activity
SUSPICIOUS [PTsecurity] ipify.org External IP Check
3184
rtegre.exe
Misc activity
SUSPICIOUS [PTsecurity] ipify.org External IP Check
3184
rtegre.exe
Misc activity
SUSPICIOUS [PTsecurity] ipify.org External IP Check
3184
rtegre.exe
Misc activity
SUSPICIOUS [PTsecurity] ipify.org External IP Check
3184
rtegre.exe
Misc activity
SUSPICIOUS [PTsecurity] ipify.org External IP Check
3184
rtegre.exe
Misc activity
SUSPICIOUS [PTsecurity] ipify.org External IP Check
3184
rtegre.exe
Misc activity
SUSPICIOUS [PTsecurity] ipify.org External IP Check
3 ETPRO signatures available at the full report
Process
Message
winserv.exe
Error WTSQueryUserToken #1314
winserv.exe
20-05-2019_14:40:45:132#T:Error #20 @2
winserv.exe
20-05-2019_14:41:20:710#T:Msg Size: 104
winserv.exe
20-05-2019_14:41:20:710#T:Msg code: 3
winserv.exe
20-05-2019_14:41:20:710#T:MSG_KEEP_ALIVE
winserv.exe
MSG_KEEP_ALIVE
winserv.exe
20-05-2019_14:41:43:898#T:Msg Size: 104
winserv.exe
20-05-2019_14:41:43:898#T:Msg code: 3
winserv.exe
20-05-2019_14:41:43:898#T:MSG_KEEP_ALIVE
winserv.exe
MSG_KEEP_ALIVE
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
bill notice 05.2019.rar