File name:

Subsa 2.0 Updated.rar

Full analysis: https://app.any.run/tasks/a62735c3-8b70-4ee1-8420-c55293d7987a
Verdict: Malicious activity
Analysis date: December 25, 2024, 16:05:16
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
github
python
pyinstaller
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

7873DDFD47EC81B6651D9A6079064388

SHA1:

9DAA2DBB91074193216CC26F655162FCAF3236C9

SHA256:

CC04E4E1C7D6E8E5999CFF665A639B0A1EFFF8A47676133FAB0E49E1B72FFD9C

SSDEEP:

98304:FhJhJneZYJDqznYYCtYU9G4/F/PRAYR+imKgm+RHH4yoYTmveECHbvXiZJd+zjxl:xaMF/HXTuNT7w8caGKok

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 6680)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 6680)

    • Executable content was dropped or overwritten

      • main.exe (PID: 7112)

    • The process drops C-runtime libraries

      • main.exe (PID: 7112)

    • Process drops legitimate windows executable

      • main.exe (PID: 7112)

    • Process drops python dynamic module

      • main.exe (PID: 7112)

    • Application launched itself

      • main.exe (PID: 7112)

    • Loads Python modules

      • main.exe (PID: 644)

    • Starts CMD.EXE for commands execution

      • main.exe (PID: 644)

  • INFO

    • The process uses the downloaded file

      • WinRAR.exe (PID: 6680)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6680)

    • Checks supported languages

      • main.exe (PID: 7112)
      • main.exe (PID: 644)

    • Reads the computer name

      • main.exe (PID: 7112)
      • main.exe (PID: 644)

    • The sample compiled with english language support

      • main.exe (PID: 7112)

    • Create files in a temporary directory

      • main.exe (PID: 7112)

    • Reads the machine GUID from the registry

      • main.exe (PID: 644)

    • Checks proxy server information

      • main.exe (PID: 644)

    • PyInstaller has been detected (YARA)

      • main.exe (PID: 7112)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)

EXIF

ZIP

FileVersion: RAR v5
CompressedSize: 11
UncompressedSize: 11
OperatingSystem: Win32
ArchivedFileName: Subsa 2.0 Updated/config.json
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
128
Monitored processes
7
Malicious processes
0
Suspicious processes
3

Behavior graph

Click at the process to see the details
start winrar.exe main.exe conhost.exe no specs main.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
436C:\WINDOWS\system32\cmd.exe /c C:\Windows\SysWOW64\cmd.exe—main.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
644"C:\Users\admin\AppData\Local\Temp\Rar$EXa6680.3858\Subsa 2.0 Updated\main.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa6680.3858\Subsa 2.0 Updated\main.exe
main.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa6680.3858\subsa 2.0 updated\main.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
6384C:\WINDOWS\system32\cmd.exe /c clsC:\Windows\SysWOW64\cmd.exe—main.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
6448C:\WINDOWS\system32\cmd.exe /c clsC:\Windows\SysWOW64\cmd.exe—main.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
6680"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Subsa 2.0 Updated.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
7112"C:\Users\admin\AppData\Local\Temp\Rar$EXa6680.3858\Subsa 2.0 Updated\main.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa6680.3858\Subsa 2.0 Updated\main.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa6680.3858\subsa 2.0 updated\main.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
7120\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—main.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
2 508
Read events
2 500
Write events
8
Delete events
0

Modification events

(PID) Process:(6680) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6680) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6680) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6680) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Subsa 2.0 Updated.rar
(PID) Process:(6680) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6680) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6680) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6680) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
38
Suspicious files
2
Text files
16
Unknown types
0

Dropped files

PID
Process
Filename
Type
7112main.exeC:\Users\admin\AppData\Local\Temp\_MEI71122\VCRUNTIME140.dllexecutable
MD5:AFA8FB684EDED0D4CA6AA03AEBEA446F
SHA256:44DE8D0DC9994BFF357344C44F12E8BFFF8150442F7CA313298B98E6C23A588E
7112main.exeC:\Users\admin\AppData\Local\Temp\_MEI71122\_ctypes.pydexecutable
MD5:A1773307030425D15F9DB87AF6B00196
SHA256:2A4C83EB7153D2174E9CA138DB451A7DB3C73C905511A887EA5DFA61CF86818A
7112main.exeC:\Users\admin\AppData\Local\Temp\_MEI71122\_bz2.pydexecutable
MD5:3894B2EA6B749B83880708BD59462A97
SHA256:1DA79987502B5363E37F06CB952F025556B24D9DA601D49784F8DACD6799C004
7112main.exeC:\Users\admin\AppData\Local\Temp\_MEI71122\_decimal.pydexecutable
MD5:5C4426327478796D3FE7658EF543C5E6
SHA256:156A787269E8E59B5F6CD882E885BF6296EF3BD43FB97AB74AAEB543A1CAB76E
6680WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa6680.3858\Subsa 2.0 Updated\main.exeexecutable
MD5:2DF44ACA573E9DF007C7F48ADD987FE8
SHA256:404C22E5942A83E0DD7F1ED84C3C360C60DBC208B63977CD1DA2ED189FFEC3C0
7112main.exeC:\Users\admin\AppData\Local\Temp\_MEI71122\_hashlib.pydexecutable
MD5:89756B9601C19F82592CA27192A05878
SHA256:84B71DDD3F2D594EE144D421A13FF9EE01F5E4D757D28623D8C616334324D97B
7112main.exeC:\Users\admin\AppData\Local\Temp\_MEI71122\certifi\cacert.pemtext
MD5:D3E74C9D33719C8AB162BAA4AE743B27
SHA256:7A347CA8FEF6E29F82B6E4785355A6635C17FA755E0940F65F15AA8FC7BD7F92
7112main.exeC:\Users\admin\AppData\Local\Temp\_MEI71122\_lzma.pydexecutable
MD5:13F3A5F3CD238887532A489A18C98F4D
SHA256:953779EAB6949F49940B7D8C9747350A51262423F640CD4B929D258CF41AA063
7112main.exeC:\Users\admin\AppData\Local\Temp\_MEI71122\_multiprocessing.pydexecutable
MD5:785F35C3C452D3C401721603746531C7
SHA256:D34038F1CED0661950140BA5A6505CA6567B9CB66901B85C96A6B7CB52E6485C
6680WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa6680.3858\Subsa 2.0 Updated\config.jsonbinary
MD5:C0ADCCB9105B50FB9724225E7A7FCA9B
SHA256:30428A3206C817F42E49331138BA5D36E2A29124876F75FAD011F4C1F5B94661
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
35
DNS requests
17
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6520
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
6284
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6284
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4712
MoUsoCoreWorker.exe
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4712
MoUsoCoreWorker.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5064
SearchApp.exe
2.23.209.179:443
www.bing.com
Akamai International B.V.
GB
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1176
svchost.exe
40.126.32.140:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 2.16.164.49
  • 2.16.164.120
whitelisted
www.microsoft.com
  • 88.221.169.152
whitelisted
www.bing.com
  • 2.23.209.179
  • 2.23.209.185
  • 2.23.209.182
  • 2.23.209.187
  • 2.23.209.177
  • 2.23.209.176
  • 2.23.209.161
  • 2.23.209.150
  • 2.23.209.149
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
google.com
  • 142.250.186.174
whitelisted
login.live.com
  • 40.126.32.140
  • 20.190.160.20
  • 40.126.32.68
  • 40.126.32.74
  • 20.190.160.14
  • 40.126.32.133
  • 20.190.160.22
  • 40.126.32.72
whitelisted
go.microsoft.com
  • 184.28.89.167
unknown
raw.githubusercontent.com
  • 185.199.111.133
  • 185.199.108.133
  • 185.199.110.133
  • 185.199.109.133
shared
arc.msn.com
  • 20.103.156.88
whitelisted

Threats

PID
Process
Class
Message
—
—
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Subsa 2.0 Updated.rar