analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

http://put.nu/files/DtI0a01.rar

Full analysis: https://app.any.run/tasks/2f4422dd-0f53-4025-a073-e4068ce39d5e
Verdict: Malicious activity
Analysis date: July 12, 2020, 16:55:34
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

3C39D600F984792A1C9197B6A96928FA

SHA1:

14EC785B556D3A17A52EFA8E47053AD9FD2F50DA

SHA256:

CCAAD1D75B234E6A4F31C729A1B0314194626CC21FB910EE072BACC9FA5FC474

SSDEEP:

3:N1KOQRDzHsQX:COuDsQX

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Minecraft_Launcher.exe (PID: 1752)
      • Minecraft_Launcher.exe (PID: 1568)

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 532)
      • Minecraft_Launcher.exe (PID: 1752)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1088)

    • Executed via COM

      • DllHost.exe (PID: 3912)

    • Creates files in the Windows directory

      • DllHost.exe (PID: 3912)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 632)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 1888)
      • iexplore.exe (PID: 632)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 632)

    • Changes internet zones settings

      • iexplore.exe (PID: 632)

    • Reads the hosts file

      • Minecraft_Launcher.exe (PID: 1752)
      • Minecraft_Launcher.exe (PID: 1568)

    • Manual execution by user

      • Minecraft_Launcher.exe (PID: 1752)
      • Minecraft_Launcher.exe (PID: 1568)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 632)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 632)

    • Changes settings of System certificates

      • iexplore.exe (PID: 632)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
58
Monitored processes
16
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe winrar.exe searchprotocolhost.exe no specs minecraft_launcher.exe arp.exe no specs arp.exe no specs arp.exe no specs fontview.exe no specs DllHost.exe no specs minecraft_launcher.exe arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
632"C:\Program Files\Internet Explorer\iexplore.exe" http://put.nu/files/DtI0a01.rarC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
1888"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:632 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
1088"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\DtI0a01.rar"C:\Program Files\WinRAR\WinRAR.exe
iexplore.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
532"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1752"C:\Users\admin\Desktop\DtI0a01\Minecraft_Launcher.exe" C:\Users\admin\Desktop\DtI0a01\Minecraft_Launcher.exe
explorer.exe
User:
admin
Company:
Mojang
Integrity Level:
MEDIUM
Description:
Minecraft Launcher
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\dti0a01\minecraft_launcher.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\aclayers.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
3584"C:\Windows\System32\arp.exe" -aC:\Windows\System32\arp.exe—Minecraft_Launcher.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Arp Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\arp.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\snmpapi.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\advapi32.dll
3276"C:\Windows\System32\arp.exe" -aC:\Windows\System32\arp.exe—Minecraft_Launcher.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Arp Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\arp.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\snmpapi.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\advapi32.dll
2336"C:\Windows\System32\arp.exe" -aC:\Windows\System32\arp.exe—Minecraft_Launcher.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Arp Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\arp.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\snmpapi.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\advapi32.dll
1488"C:\Windows\System32\fontview.exe" C:\Users\admin\Desktop\DtI0a01\Oswald.ttfC:\Windows\System32\fontview.exe—Minecraft_Launcher.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Font Viewer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\fontview.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3912C:\Windows\system32\DllHost.exe /Processid:{642EF9D6-48A5-476B-919A-A507CFD02C0F}C:\Windows\system32\DllHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
9 294
Read events
2 498
Write events
0
Delete events
0

Modification events

No data
Executable files
3
Suspicious files
11
Text files
2
Unknown types
5

Dropped files

PID
Process
Filename
Type
632iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF385AB9CC75768B8F.TMP —
MD5:—
SHA256:—
632iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\DtI0a01.rar.db1w1g5.partial:Zone.Identifier —
MD5:—
SHA256:—
632iexplore.exeC:\Users\admin\AppData\Local\Temp\Cab9E7F.tmp —
MD5:—
SHA256:—
632iexplore.exeC:\Users\admin\AppData\Local\Temp\Tar9E80.tmp —
MD5:—
SHA256:—
632iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver9EC0.tmp —
MD5:—
SHA256:—
1888iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\DtI0a01[1].rarcompressed
MD5:66D7CBEFCD108172C63135FFE803F326
SHA256:48BC1DF9E4BCAFD69713486B31A47BFCA4B77B5C1C4F4A8B504F091132BB0832
1088WinRAR.exeC:\Users\admin\Desktop\DtI0a01\Guna.UI2.dllexecutable
MD5:E0874624E2C8613AFF1773ABD93CA790
SHA256:21EF27B505AC4814DE4FFB73A40EA4F249E93A878F7BE6727F2FD776FBCF438F
632iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\DtI0a01.rarcompressed
MD5:66D7CBEFCD108172C63135FFE803F326
SHA256:48BC1DF9E4BCAFD69713486B31A47BFCA4B77B5C1C4F4A8B504F091132BB0832
632iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{88D5E48B-C460-11EA-B03F-5254004A04AF}.datbinary
MD5:AF5A71646974AC85A5C84C40F8ED8F00
SHA256:6711EBFBA2CD17D3303DE931D9928CD1CFE0525EB4AD67CEE0533D66BA8D8BC1
1088WinRAR.exeC:\Users\admin\Desktop\DtI0a01\Minecraft_Launcher.exeexecutable
MD5:02FDAE46D73583AC61258648BDD15960
SHA256:8FD3D2B21E92CCBA523981042EB7C5F4167CCE96B52DD4EA00B058C627842FC8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
11
DNS requests
8
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1888
iexplore.exe
GET
200
52.70.201.25:80
http://put.nu/files/DtI0a01.rar
US
compressed
3.07 Mb
suspicious
632
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D
US
der
1.47 Kb
whitelisted
632
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D
US
der
1.47 Kb
whitelisted
632
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D
US
der
1.47 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
52.70.201.25:80
put.nu
Amazon.com, Inc.
US
suspicious
1888
iexplore.exe
52.70.201.25:80
put.nu
Amazon.com, Inc.
US
suspicious
1752
Minecraft_Launcher.exe
104.24.111.151:443
api.auth.gg
Cloudflare Inc
US
shared
1752
Minecraft_Launcher.exe
162.159.133.233:443
cdn.discordapp.com
Cloudflare Inc
—
shared
632
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
632
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
1568
Minecraft_Launcher.exe
104.24.111.151:443
api.auth.gg
Cloudflare Inc
US
shared

DNS requests

Domain
IP
Reputation
put.nu
  • 52.70.201.25
suspicious
api.auth.gg
  • 104.24.111.151
  • 104.24.110.151
  • 172.67.187.231
whitelisted
cdn.discordapp.com
  • 162.159.133.233
  • 162.159.129.233
  • 162.159.130.233
  • 162.159.134.233
  • 162.159.135.233
shared
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
http://put.nu/files/DtI0a01.rar