analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Вирус из вложения.rar

Full analysis: https://app.any.run/tasks/b20068db-1e41-4433-b2ce-c9f4c567831b
Verdict: Malicious activity
Analysis date: April 23, 2019, 12:34:08
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

8948D28CF6D6D9766012BB7A9CD4CD0C

SHA1:

F2086A2A206F3EE5D20F44028A4D618EA41686C4

SHA256:

BFB326C7DDE463A98CFD734C7A79D564E66CE93ADFFC2DF908771E696988810E

SSDEEP:

6144:shweYNW1gDlZbpLrAknASoyLhGmjHQWdP4mp:shyNW81LrAYh5Hzwi

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Заполнить договор март-апрель.exe (PID: 3984)

    • Changes the autorun value in the registry

      • Заполнить договор март-апрель.exe (PID: 3984)

    • Loads dropped or rewritten executable

      • rundll32.exe (PID: 1524)
      • WinRAR.exe (PID: 2956)
      • explorer.exe (PID: 2044)
      • rundll32.exe (PID: 3608)

    • Loads the Task Scheduler COM API

      • rundll32.exe (PID: 1524)

    • Changes settings of System certificates

      • rundll32.exe (PID: 3608)

  • SUSPICIOUS

    • Creates files in the user directory

      • explorer.exe (PID: 2044)

    • Reads Internet Cache Settings

      • explorer.exe (PID: 2044)

    • Executable content was dropped or overwritten

      • Заполнить договор март-апрель.exe (PID: 3984)
      • WinRAR.exe (PID: 2956)
      • rundll32.exe (PID: 1524)

    • Uses RUNDLL32.EXE to load library

      • Заполнить договор март-апрель.exe (PID: 3984)

    • Creates files in the program directory

      • rundll32.exe (PID: 1524)

    • Connects to server without host name

      • rundll32.exe (PID: 3608)

    • Adds / modifies Windows certificates

      • rundll32.exe (PID: 3608)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
7
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start winrar.exe no specs winrar.exe no specs winrar.exe заполнить договор март-апрель.exe rundll32.exe rundll32.exe explorer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
916"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Вирус из вложения.rar"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
1832"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Заполнить договор март-апрель.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
2956"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Заполнить договор март-апрель.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3984"C:\Users\admin\AppData\Local\Temp\Rar$EXa2956.40472\Заполнить договор март-апрель.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2956.40472\Заполнить договор март-апрель.exe
WinRAR.exe
User:
admin
Company:
Корпорация Майкрософт
Integrity Level:
MEDIUM
Description:
Самоизвлечение CAB-файлов Win32
Exit code:
0
Version:
6.00.2900.5512 (xpsp.080413-2105)
1524rundll32.exe v34.dll,DllGetClassObject root 000000000000 Post Install program: <None>C:\Windows\system32\rundll32.exe
Заполнить договор март-апрель.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3608rundll32.exe "C:\ProgramData\2401bf603c90\2702bc633f93.dat",DllGetClassObject rootC:\Windows\system32\rundll32.exe
taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2044C:\Windows\Explorer.EXEC:\Windows\explorer.exe——
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
3 021
Read events
2 924
Write events
0
Delete events
0

Modification events

No data
Executable files
3
Suspicious files
3
Text files
0
Unknown types
4

Dropped files

PID
Process
Filename
Type
2044explorer.exeC:\Users\admin\Desktop\Заполнить договор март-апрель.zipcompressed
MD5:CCEBFBB60504695706962195F561F830
SHA256:5247436D094EE281BD0500B126044F4CE5D60AB19EE2AC28B369E5A0DE08E232
3984Заполнить договор март-апрель.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\v34.dllexecutable
MD5:6BE6B5BD557062C6785DBE38970C51CF
SHA256:18F7E4644F8FED76C24EAE34E2CD136A1B075DFB8ED1BD2DC5BE17183E12893E
2044explorer.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\1b4dd67f29cb1962.automaticDestinations-msautomaticdestinations-ms
MD5:A35DE6433D248B1CB36DB5C996E1EEE4
SHA256:DA0242E37812965D1C95455C48631ED1831280989DAF4D366119A984C544D250
1524rundll32.exeC:\ProgramData\2401bf603c90\2702bc633f93.datexecutable
MD5:6BE6B5BD557062C6785DBE38970C51CF
SHA256:18F7E4644F8FED76C24EAE34E2CD136A1B075DFB8ED1BD2DC5BE17183E12893E
2044explorer.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\Заполнить договор март-апрель.zip.lnklnk
MD5:7554FCF91BDA3CB4CFE9B5B688E12D45
SHA256:EB55738E15B7D1E469F0CEE8D84FB6198C8E99093FD54C3CB2C35E513CD873B2
2044explorer.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012019042320190424\index.datdat
MD5:8070543D121640C4D98EAD7D8D588C2C
SHA256:949FB24829419D63F3B94A911EAE5674260700DCE8E2ABC9CAF9261E3EBE9B95
2044explorer.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\290532160612e071.automaticDestinations-msautomaticdestinations-ms
MD5:205728030B72DBF84D18CD673AA24EAA
SHA256:C4ADFACA77F25DBED3DAB1EB2F76DBC8C5305CFD5CD70E9B38DEF58DB0A3A535
916WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb916.37403\Заполнить договор март-апрель.7z_compressed
MD5:CCEBFBB60504695706962195F561F830
SHA256:5247436D094EE281BD0500B126044F4CE5D60AB19EE2AC28B369E5A0DE08E232
2956WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2956.40472\Заполнить договор март-апрель.exeexecutable
MD5:0B67D3A6C994E75ADDD23354395E467A
SHA256:57198018C1B8778547E255541504E536304ECFA34FD291CAA857FFC8554C006F
2044explorer.exeC:\Users\admin\Desktop\Заполнить договор март-апрель.7z_compressed
MD5:CCEBFBB60504695706962195F561F830
SHA256:5247436D094EE281BD0500B126044F4CE5D60AB19EE2AC28B369E5A0DE08E232
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
2
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3608
rundll32.exe
POST
200
195.123.245.202:80
http://195.123.245.202/index.php
UA
binary
9 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3608
rundll32.exe
52.36.204.116:443
namecoin.cyphrs.com
Amazon.com, Inc.
US
unknown
3608
rundll32.exe
195.123.245.202:80
—
—
UA
malicious

DNS requests

Domain
IP
Reputation
namecoin.cyphrs.com
  • 52.36.204.116
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Вирус из вложения.rar