File name:

Monotone-HWID-Spoofer-0.0.1.7z

Full analysis: https://app.any.run/tasks/d9e8bd72-c180-4d04-b510-d7de569ad5df
Verdict: Malicious activity
Analysis date: August 08, 2023, 13:04:30
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

AF1D2B3725C153BD093D2A0929D8DA6B

SHA1:

97445399186405C5B41F72B1E23E3C8DA97EAB33

SHA256:

BF8206D858EFFDD6F2DE6DA41A9DCDF53DB710DBFEF5EEB98944CD21D61EFE94

SSDEEP:

12288:CpTQTtDfboQpDmUO4xS9f5a4XYjPT8QQk6RuYWC5G9Y:ATSbbo+mCxSa38mYWkGW

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • GetInput.exe (PID: 2952)
      • batbox.exe (PID: 2504)
      • GetInput.exe (PID: 3876)

  • SUSPICIOUS

    • Get information on the list of running processes

      • cmd.exe (PID: 3724)

    • Drops a system driver (possible attempt to evade defenses)

      • WinRAR.exe (PID: 1276)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1276)

    • Manual execution by a user

      • GetInput.exe (PID: 2952)
      • cmd.exe (PID: 3724)
      • notepad.exe (PID: 3576)
      • batbox.exe (PID: 2504)
      • GetInput.exe (PID: 3876)
      • cmd.exe (PID: 2600)
      • cmd.exe (PID: 1900)
      • cmd.exe (PID: 2344)

    • The process checks LSA protection

      • tasklist.exe (PID: 1916)

    • Checks supported languages

      • batbox.exe (PID: 2504)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
59
Monitored processes
12
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe batbox.exe no specs getinput.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs getinput.exe no specs cmd.exe no specs ping.exe no specs tasklist.exe no specs find.exe no specs notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1276"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Monotone-HWID-Spoofer-0.0.1.7z"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
1900C:\Windows\system32\cmd.exe /c ""C:\Users\admin\Desktop\Monotone-HWID-Spoofer-0.0.1\Box.bat" "C:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1916tasklist /NH /FI "imagename eq Monotone.exe" C:\Windows\System32\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2344C:\Windows\system32\cmd.exe /c ""C:\Users\admin\Desktop\Monotone-HWID-Spoofer-0.0.1\Getlen.bat" "C:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2504"C:\Users\admin\Desktop\Monotone-HWID-Spoofer-0.0.1\batbox.exe" C:\Users\admin\Desktop\Monotone-HWID-Spoofer-0.0.1\batbox.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2580find /i "Monotone.exe"C:\Windows\System32\find.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (grep) Utility
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2600C:\Windows\system32\cmd.exe /c ""C:\Users\admin\Desktop\Monotone-HWID-Spoofer-0.0.1\Button.bat" "C:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2952"C:\Users\admin\Desktop\Monotone-HWID-Spoofer-0.0.1\GetInput.exe" C:\Users\admin\Desktop\Monotone-HWID-Spoofer-0.0.1\GetInput.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3576"C:\Windows\System32\NOTEPAD.EXE" C:\Users\admin\Desktop\Monotone-HWID-Spoofer-0.0.1\Commands\Hidden\process.batC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3676ping localhost C:\Windows\System32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
0
Read events
0
Write events
0
Delete events
0

Modification events

No data
Executable files
10
Suspicious files
0
Text files
10
Unknown types
0

Dropped files

PID
Process
Filename
Type
1276WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1276.37214\Monotone-HWID-Spoofer-0.0.1\Button.battext
MD5:96FEFE69F2FACF74197A8AF3004A6167
SHA256:38AA0C1AD69D96732C776CBD73275F5CCB881D42158158B32815DAD869EF9876
1276WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1276.37214\Monotone-HWID-Spoofer-0.0.1\Commands\Hidden\process.battext
MD5:2D3F9B2D001ABD6E58AC6F0E7337C619
SHA256:EF702CE2F8FB1BC71FB60E8B95CB83CEF4FA66AA96AFD7CA4FD67C96530B6E53
1276WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1276.37214\Monotone-HWID-Spoofer-0.0.1\Commands\Hidden\AlternateStreamView.cfgtext
MD5:D298348206017D0CB04217887A677334
SHA256:2E44DAD813EFA86DDBD849A53962C5BDCACC9BCC2039DC09BCB2C25C770F3D8B
1276WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1276.37214\Monotone-HWID-Spoofer-0.0.1\Box.battext
MD5:A95505942D3EBCF724F080B49D4E981F
SHA256:64556D24498BCD280CD7CC248A98ED22C4DB921495D825F141AF1547C8FDD275
1276WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1276.37214\Monotone-HWID-Spoofer-0.0.1\Commands\Hidden\UnbanComplete.vbstext
MD5:4EDF8ECAF575C93E307BDCE09AA46E8C
SHA256:537F70F7B018610DFEDD4BCECF041D845EAB0C673E129185C2345EB68A95FE77
1276WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1276.37214\Monotone-HWID-Spoofer-0.0.1\Getlen.battext
MD5:8C1812E76BA7BF09CB87384089A0AB7F
SHA256:83CE5342710A2F2E385A363402661E3426728DD6BCFE9D87E22F2FB858B07BDE
1276WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1276.37214\Monotone-HWID-Spoofer-0.0.1\Commands\Hidden\Adapters.exeexecutable
MD5:934BBC5411C532964F3BBE42CB1C1785
SHA256:B3DE6D10D9F94037B88F736609E50A8A4C4D516CA50107DEDD575797A654C28E
1276WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1276.37214\Monotone-HWID-Spoofer-0.0.1\mac.txttext
MD5:58726BCB98B77AFE581A7833C8F35F9A
SHA256:E53A19F0F36D7E7BE98522239E8AC2AF3248F4FE4B046D9FE270E3907CE11401
1276WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1276.37214\Monotone-HWID-Spoofer-0.0.1\Commands\Hidden\Adapters2.exeexecutable
MD5:BB36D4578CE201DC932AB6BBC079875C
SHA256:4C831252AA6F193C4474BA74F352BEE7D00099DFAF5AC6E98AB1253E21999B4A
1276WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1276.37214\Monotone-HWID-Spoofer-0.0.1\batbox.exeexecutable
MD5:CB4A44BAA20AD26BF74615A7FC515A84
SHA256:9553BC17FA0FD08E026C1865812B3388E3D5495A5394BBF671E5A8F21C79989A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2640
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Monotone-HWID-Spoofer-0.0.1.7z