File name:

Neverlose.cc Cracked Loader.rar

Full analysis: https://app.any.run/tasks/36741049-6929-4c03-a171-f6c342d089b3
Verdict: Malicious activity
Analysis date: May 19, 2021, 15:50:18
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

7994DDEBBFD7AFCBB00D421D968827B2

SHA1:

A1A08EDCA359C442819742DE55A03E930205FC08

SHA256:

D12C4158C844BF0AA5313332793D012733985E0CFE2EFB5381CFD67B73504367

SSDEEP:

196608:cebsi64awWa7XIetBAlyALR+4+wwy67r8/lrjKrrlNc3zw:9bsobttByyVxBr8/lolNmzw

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • Neverlose.cc Cracked Loader.exe (PID: 1380)

    • Application was dropped or rewritten from another process

      • Neverlose.cc Cracked Loader.exe (PID: 2500)
      • svchosts.exe (PID: 3512)
      • detecterfn.exe (PID: 1688)
      • crypted.exe (PID: 3888)
      • Neverlose.cc Cracked Loader.exe (PID: 1380)
      • AdvancedRun.exe (PID: 3452)
      • d9f4cza91c4aJb1eK154d1f3C3b8eQT34c7f444O1.exe (PID: 3556)
      • AdvancedRun.exe (PID: 3624)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 2440)

    • Writes to the hosts file

      • svchosts.exe (PID: 3512)

    • UAC/LUA settings modification

      • reg.exe (PID: 996)
      • crypted.exe (PID: 3888)
      • d9f4cza91c4aJb1eK154d1f3C3b8eQT34c7f444O1.exe (PID: 3556)

    • Stops/Deletes Windows Defender service via SC.exe

      • cmd.exe (PID: 2932)
      • cmd.exe (PID: 1548)

    • Changes settings of System certificates

      • detecterfn.exe (PID: 1688)

    • Uses Task Scheduler to autorun other applications

      • svchosts.exe (PID: 3512)

    • Modifies hosts file to block updates

      • svchosts.exe (PID: 3512)

    • Writes to a start menu file

      • crypted.exe (PID: 3888)

    • Changes the autorun value in the registry

      • crypted.exe (PID: 3888)
      • d9f4cza91c4aJb1eK154d1f3C3b8eQT34c7f444O1.exe (PID: 3556)

    • Disables Windows Defender

      • crypted.exe (PID: 3888)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 916)
      • svchosts.exe (PID: 3512)
      • Neverlose.cc Cracked Loader.exe (PID: 1380)
      • crypted.exe (PID: 3888)
      • d9f4cza91c4aJb1eK154d1f3C3b8eQT34c7f444O1.exe (PID: 3556)

    • Executes PowerShell scripts

      • svchosts.exe (PID: 3512)
      • crypted.exe (PID: 3888)
      • d9f4cza91c4aJb1eK154d1f3C3b8eQT34c7f444O1.exe (PID: 3556)

    • Uses REG.EXE to modify Windows registry

      • svchosts.exe (PID: 3512)

    • Drops a file with a compile date too recent

      • svchosts.exe (PID: 3512)
      • WinRAR.exe (PID: 916)
      • Neverlose.cc Cracked Loader.exe (PID: 1380)

    • Drops a file that was compiled in debug mode

      • crypted.exe (PID: 3888)
      • Neverlose.cc Cracked Loader.exe (PID: 1380)
      • svchosts.exe (PID: 3512)
      • d9f4cza91c4aJb1eK154d1f3C3b8eQT34c7f444O1.exe (PID: 3556)

    • Creates files in the Windows directory

      • svchosts.exe (PID: 3512)
      • crypted.exe (PID: 3888)

    • Low-level read access rights to disk partition

      • reagentc.exe (PID: 960)

    • Drops a file with too old compile date

      • Neverlose.cc Cracked Loader.exe (PID: 1380)
      • crypted.exe (PID: 3888)

    • Creates files in the user directory

      • powershell.exe (PID: 2800)
      • powershell.exe (PID: 3792)
      • powershell.exe (PID: 2404)
      • powershell.exe (PID: 3612)
      • powershell.exe (PID: 4000)
      • crypted.exe (PID: 3888)
      • powershell.exe (PID: 2280)
      • powershell.exe (PID: 2504)
      • powershell.exe (PID: 2108)
      • powershell.exe (PID: 2428)
      • powershell.exe (PID: 840)
      • powershell.exe (PID: 4064)
      • powershell.exe (PID: 2612)
      • powershell.exe (PID: 256)
      • powershell.exe (PID: 4024)
      • powershell.exe (PID: 2980)
      • powershell.exe (PID: 3388)
      • powershell.exe (PID: 3964)
      • powershell.exe (PID: 328)

    • Starts CMD.EXE for commands execution

      • AdvancedRun.exe (PID: 3452)
      • AdvancedRun.exe (PID: 3624)
      • d9f4cza91c4aJb1eK154d1f3C3b8eQT34c7f444O1.exe (PID: 3556)
      • crypted.exe (PID: 3888)

    • Reads Environment values

      • detecterfn.exe (PID: 1688)

    • Starts itself from another location

      • crypted.exe (PID: 3888)

    • Creates executable files which already exist in Windows

      • crypted.exe (PID: 3888)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 2932)
      • cmd.exe (PID: 1548)

    • Adds / modifies Windows certificates

      • detecterfn.exe (PID: 1688)

  • INFO

    • Manual execution by user

      • Neverlose.cc Cracked Loader.exe (PID: 1380)
      • Neverlose.cc Cracked Loader.exe (PID: 2500)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
147
Monitored processes
81
Malicious processes
7
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start winrar.exe neverlose.cc cracked loader.exe no specs neverlose.cc cracked loader.exe svchosts.exe crypted.exe detecterfn.exe powershell.exe no specs reagentc.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs reg.exe no specs schtasks.exe no specs advancedrun.exe no specs cmd.exe sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs d9f4cza91c4ajb1ek154d1f3c3b8eqt34c7f444o1.exe powershell.exe no specs powershell.exe no specs powershell.exe no specs cmd.exe no specs timeout.exe no specs applaunch.exe advancedrun.exe no specs cmd.exe sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs cmd.exe no specs timeout.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
256"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\2d2b2I4080fffI7p989t\svchost.exe" -ForceC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—crypted.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
328"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\2d2b2I4080fffI7p989t\svchost.exe" -ForceC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—d9f4cza91c4aJb1eK154d1f3C3b8eQT34c7f444O1.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
568sc config Sense start= disabledC:\Windows\system32\sc.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
A tool to aid in developing services for WindowsNT
Exit code:
1060
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
568sc stop SecurityHealthServiceC:\Windows\system32\sc.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
A tool to aid in developing services for WindowsNT
Exit code:
1060
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\sc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
576sc stop WdiSystemHostC:\Windows\system32\sc.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
A tool to aid in developing services for WindowsNT
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
576sc stop SenseC:\Windows\system32\sc.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
A tool to aid in developing services for WindowsNT
Exit code:
1060
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\sc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
840"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d9f4cza91c4aJb1eK154d1f3C3b8eQT34c7f444O1.exe" -ForceC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—d9f4cza91c4aJb1eK154d1f3C3b8eQT34c7f444O1.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
892sc config wuauserv start= disabledC:\Windows\system32\sc.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
A tool to aid in developing services for WindowsNT
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
916"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Neverlose.cc Cracked Loader.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
960reagentc.exe /disableC:\Windows\system32\reagentc.exe—svchosts.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Windows Recovery Agent
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reagentc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
6 486
Read events
5 402
Write events
1 064
Delete events
20

Modification events

(PID) Process:(916) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(916) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(916) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(916) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:@C:\Windows\system32\NetworkExplorer.dll,-1
Value:
Network
(PID) Process:(916) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Neverlose.cc Cracked Loader.rar
(PID) Process:(916) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(916) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(916) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(916) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(916) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:@C:\Windows\system32\notepad.exe,-469
Value:
Text Document
Executable files
12
Suspicious files
30
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
960reagentc.exeC:\Windows\system32\Recovery\Winre.wim —
MD5:—
SHA256:—
2404powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\FM2ZH3001NQAYV706CTH.temp —
MD5:—
SHA256:—
2800powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\FH82ZM8DXBHNLBI3OD4J.temp —
MD5:—
SHA256:—
3612powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\0MGIX2UIVK5TLJ9HMYEW.temp —
MD5:—
SHA256:—
4000powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\DJQME1KOZDB6ZT0LJG3P.temp —
MD5:—
SHA256:—
3792powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\NLGRMRZTBOECT797QCG7.temp —
MD5:—
SHA256:—
916WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb916.28729\Neverlose.cc Cracked Loader.exeexecutable
MD5:—
SHA256:—
1380Neverlose.cc Cracked Loader.exeC:\Users\admin\AppData\Local\Temp\etc1.exeexecutable
MD5:—
SHA256:—
1380Neverlose.cc Cracked Loader.exeC:\Users\admin\AppData\Local\Temp\eth1.exeexecutable
MD5:—
SHA256:—
1380Neverlose.cc Cracked Loader.exeC:\Users\admin\AppData\Local\Temp\svchosts.exeexecutable
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2
DNS requests
2
Threats
1

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1688
detecterfn.exe
162.159.136.232:443
discord.com
Cloudflare Inc
—
shared
2592
applaunch.exe
78.180.177.193:6606
geceler31.duckdns.org
Turk Telekom
TR
malicious

DNS requests

Domain
IP
Reputation
discord.com
  • 162.159.136.232
  • 162.159.137.232
  • 162.159.138.232
  • 162.159.128.233
  • 162.159.135.232
whitelisted
geceler31.duckdns.org
  • 78.180.177.193
malicious

Threats

PID
Process
Class
Message
1052
svchost.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
Process
Message
crypted.exe
b67bf2cd-dfc8-4f8f-9b2c-7f4ec2cc81b3
crypted.exe
a8aab37a-50bb-446b-8bee-31afdbe2b214
crypted.exe
c278d2a6-fe19-4d32-95bc-bc88a192813e
crypted.exe
dd24cde0-1548-4e04-9199-a5f3793b5f65
crypted.exe
f686fcd4-611e-4e70-ad5b-bda036ecb1d2
crypted.exe
8f6948da-772a-457a-b19d-3130e3181219
crypted.exe
435be3c8-0426-41d5-824d-bf5ad6520ca8
crypted.exe
291a2b98-81f8-4641-81fc-52e5d2fb2fba
crypted.exe
505d616a-ae47-4f29-8f79-073d9595e17e
crypted.exe
f3aafd7c-12e5-42fe-ac26-bf650256bfae
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Neverlose.cc Cracked Loader.rar