File name:

ProSpy RAT Builder.a.7z

Full analysis: https://app.any.run/tasks/93b39d07-16b6-49c2-a77d-6929bb14711b
Verdict: Malicious activity
Analysis date: July 03, 2024, 07:13:26
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

7D608E8AA9E3E5107CD745054047EE8F

SHA1:

C2D59DB09486BF649A3951B36AC35442F5564D84

SHA256:

D92614EF8EC35ABDB5E4810E9662E1D05D8B0EAE89018AB3C4D8349D26B046E7

SSDEEP:

98304:dgSq83gqReijNhVQWVKz2OT275myG+IMi1NlXMs/Cvya8khckHB//eF2h4z39MCf:9NCpuy

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • server.exe (PID: 452)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 2636)

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 2636)

    • Starts CMD.EXE for commands execution

      • Server_Builder.exe (PID: 2212)

    • Executable content was dropped or overwritten

      • server.exe (PID: 452)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2636)

    • Checks supported languages

      • server.exe (PID: 452)
      • Server_Builder.exe (PID: 2212)
      • server.exe (PID: 4424)

    • Reads the computer name

      • server.exe (PID: 452)

    • Creates files in the program directory

      • server.exe (PID: 452)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 2636)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
136
Monitored processes
7
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe server.exe server_builder.exe no specs conhost.exe no specs cmd.exe no specs server.exe no specs rundll32.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
452"C:\Users\admin\AppData\Local\Temp\Rar$EXb2636.13573\ProSpy RAT Builder.a\server.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb2636.13573\ProSpy RAT Builder.a\server.exe
WinRAR.exe
User:
admin
Company:
Microsoft
Integrity Level:
MEDIUM
Description:
Actualizacion de Windows de prioridad maxima
Version:
1.00
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb2636.13573\prospy rat builder.a\server.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
2196C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
2212"C:\Users\admin\AppData\Local\Temp\Rar$EXb2636.15377\ProSpy RAT Builder.a\Server_Builder.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb2636.15377\ProSpy RAT Builder.a\Server_Builder.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb2636.15377\prospy rat builder.a\server_builder.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\sechost.dll
2568\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—Server_Builder.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2636"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\ProSpy RAT Builder.a.7z"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4424C:\WINDOWS\system32\cmd.exe /c pauseC:\Windows\SysWOW64\cmd.exe—Server_Builder.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
4424"C:\Users\admin\AppData\Local\Temp\Rar$EXb2636.16459\ProSpy RAT Builder.a\server.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb2636.16459\ProSpy RAT Builder.a\server.exe—WinRAR.exe
User:
admin
Company:
Microsoft
Integrity Level:
MEDIUM
Description:
Actualizacion de Windows de prioridad maxima
Exit code:
0
Version:
1.00
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb2636.16459\prospy rat builder.a\server.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
Total events
6 587
Read events
6 568
Write events
19
Delete events
0

Modification events

(PID) Process:(2636) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2636) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2636) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(2636) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(2636) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\ProSpy RAT Builder.a.7z
(PID) Process:(2636) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2636) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2636) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2636) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2636) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
70
Suspicious files
3
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
2636WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2636.13573\ProSpy RAT Builder.a\CODEJOCK\COAABA~1.OCAexecutable
MD5:3CE9696BAAF1B02079961021DE9D75DB
SHA256:EF01940FC377C06FD1E11FFC7C251957995CF271C4B2D6634599AB1BFF8B04DC
2636WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2636.13573\ProSpy RAT Builder.a\CODEJOCK\Codejock.SyntaxEdit.v13.0.0.Demo.ocxexecutable
MD5:A1146F05BD7E16B4E4A05F965B100A0E
SHA256:95AE7C469D61ACBE34E8A05D6DA8D98DF4454AB47A854139CE9520E60B947AB5
2636WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2636.13573\ProSpy RAT Builder.a\SKINS\Thumbs.dbbinary
MD5:54F7FB72433440CE5526473FC0E24135
SHA256:7D2F75473AE20A4C5F966FB4E215909D16C7F5CD65A89917988ED3332AA9E645
2636WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2636.13573\ProSpy RAT Builder.a\CODEJOCK\Codejock.CommandBars.v13.0.0.Demo.ocxexecutable
MD5:CF73808B6F9C7B52EFF7719BA909FED8
SHA256:3C3BDA5BEC1868F44FD1F16E9364644DFAA4D196521AC35CB176EFE522AFC8BB
2636WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2636.13573\ProSpy RAT Builder.a\CODEJOCK\COMCTL32.DLLexecutable
MD5:A77DFB85FAEE49D66C74DA6024EBC69B
SHA256:587FDA8821B611B213ADFEEA7B94E8B3A83870F843D46AF0335584832E9D8644
2636WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2636.13573\ProSpy RAT Builder.a\CODEJOCK\Codejock.SkinFramework.v13.0.0.Demo.ocxexecutable
MD5:048B6FDDF7F896881EF9076067720E9C
SHA256:5FA198C49FAFE09DB574C4856A9A8ABBA999C9F05411FA5187757449AEC82BB5
2636WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2636.13573\ProSpy RAT Builder.a\CODEJOCK\Codejock.Controls.v13.0.0.Demo.ocxexecutable
MD5:55494584D369F207E6E1B071E7168EC0
SHA256:025EFDC63C61B3567DC8EB244517C715DDA12CF2AA4BC595E427E8D7B751FED7
2636WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2636.13573\ProSpy RAT Builder.a\CODEJOCK\MSCOMCTL.OCXexecutable
MD5:ECC7D7F0D3446DE36045D1D9E964FAFE
SHA256:BC58D624CEEA02AB086F1CCE809C992BF5A7105E88931853317A2F5AA5AFD6E4
2636WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2636.13573\ProSpy RAT Builder.a\CODEJOCK\Codejock.TaskPanel.v13.0.0.Demo.ocxexecutable
MD5:49940553FFB43BD562286B32D6196C8B
SHA256:DD60482FDA3299418066C0536A3D0E54B3527D0292CC9368A7B8607BA92619FC
2636WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2636.13573\ProSpy RAT Builder.a\CODEJOCK\CODEJO~3.OCAexecutable
MD5:C14A418CDE7E767F86D1E5656AA2F76F
SHA256:65F1782049E7907CCC82FA82C70487E64CA6A03A52FB759533E5C539FA7DCFCA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
52
DNS requests
14
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3040
OfficeClickToRun.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
unknown
4656
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
unknown
2912
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
unknown
1544
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
4820
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
4820
MoUsoCoreWorker.exe
GET
200
23.216.77.21:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4032
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4820
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2504
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
2624
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
3040
OfficeClickToRun.exe
52.182.143.208:443
self.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
3040
OfficeClickToRun.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4656
SearchApp.exe
104.126.37.136:443
r.bing.com
Akamai International B.V.
DE
unknown
4656
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
self.events.data.microsoft.com
  • 52.182.143.208
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.32.138
  • 40.126.32.68
  • 40.126.32.76
  • 40.126.32.140
  • 20.190.160.14
  • 20.190.160.20
  • 20.190.160.22
  • 40.126.32.133
whitelisted
r.bing.com
  • 104.126.37.137
  • 104.126.37.145
  • 104.126.37.147
  • 104.126.37.136
  • 104.126.37.152
  • 104.126.37.138
  • 104.126.37.139
  • 104.126.37.129
  • 104.126.37.146
  • 104.126.37.123
  • 104.126.37.178
  • 104.126.37.168
  • 104.126.37.128
  • 104.126.37.163
  • 104.126.37.171
  • 104.126.37.176
  • 104.126.37.186
  • 104.126.37.185
whitelisted
crl.microsoft.com
  • 23.216.77.21
  • 23.216.77.19
  • 23.216.77.18
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
slscr.update.microsoft.com
  • 52.165.165.26
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ProSpy RAT Builder.a.7z