File name:

TempoRX.rar

Full analysis: https://app.any.run/tasks/7420aaf9-f49a-465d-bc7d-2ba444738d68
Verdict: Malicious activity
Threats:

Sality is a highly sophisticated malware known for infecting executable files and rapidly spreading across networks. It primarily creates a peer-to-peer botnet that is used for malicious activities such as spamming, data theft, and downloading additional malware. Sality has strong persistence mechanisms, including disabling security software, making it difficult to remove. Its ability to spread quickly and silently, along with its polymorphic nature, allows it to evade detection by traditional antivirus solutions.

Malware Trends Tracker     >>>
Analysis date: January 08, 2024, 19:41:07
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
sality
trojan
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

A200F355DD33ED2F4F0C0234F8BF4E4C

SHA1:

BA85EA9D9A198ECD3F8376DA7D9F9E441F311711

SHA256:

DC28A4E388FAECBB1C748182646ACDE53383B82A3D7E8E7CC5E82634E9503AE0

SSDEEP:

98304:Gzy5IPMBLTwCKiF8dVLVMPqRIl9uSm1Cjq1I7iMGjTu7jM1VCV1fXurAqQIXUFdq:/m/7/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes appearance of the Explorer extensions

      • VID001.exe (PID: 1652)
      • VID001.exe (PID: 1928)

    • Runs injected code in another process

      • VID001.exe (PID: 1652)

    • Create files in the Startup directory

      • VID001.exe (PID: 1928)

    • Starts CMD.EXE for self-deleting

      • VID001.exe (PID: 1928)

    • Actions looks like stealing of personal data

      • uihost32.exe (PID: 2052)

  • SUSPICIOUS

    • Reads the Internet Settings

      • VID001.exe (PID: 1652)
      • VID001.exe (PID: 1928)
      • uihost32.exe (PID: 2052)
      • uihost32.exe (PID: 2840)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 2880)
      • VID001.exe (PID: 1928)

    • Starts NET.EXE for network exploration

      • cmd.exe (PID: 2968)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 1860)
      • cmd.exe (PID: 2688)

  • INFO

    • Application was injected by another process

      • ctfmon.exe (PID: 1564)
      • dwm.exe (PID: 612)
      • explorer.exe (PID: 1164)
      • taskeng.exe (PID: 300)
      • dllhost.exe (PID: 2420)

    • Manual execution by a user

      • VID001.exe (PID: 1652)
      • uihost32.exe (PID: 2052)

    • Reads the Internet Settings

      • explorer.exe (PID: 1164)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 1056)
      • VID001.exe (PID: 1652)
      • VID001.exe (PID: 1928)
      • uihost32.exe (PID: 2840)
      • uihost32.exe (PID: 2052)

    • Checks supported languages

      • VID001.exe (PID: 1652)
      • VID001.exe (PID: 1928)
      • uihost32.exe (PID: 984)
      • uihost32.exe (PID: 2052)
      • uihost32.exe (PID: 2840)
      • uihost32.exe (PID: 2836)

    • Reads the computer name

      • VID001.exe (PID: 1652)
      • VID001.exe (PID: 1928)
      • uihost32.exe (PID: 2052)
      • uihost32.exe (PID: 2840)

    • Create files in a temporary directory

      • VID001.exe (PID: 1652)
      • VID001.exe (PID: 1928)
      • uihost32.exe (PID: 2052)
      • uihost32.exe (PID: 2840)

    • Creates files or folders in the user directory

      • VID001.exe (PID: 1652)
      • VID001.exe (PID: 1928)

    • Reads the machine GUID from the registry

      • VID001.exe (PID: 1652)
      • VID001.exe (PID: 1928)

    • Starts itself from another location

      • VID001.exe (PID: 1652)

    • Checks proxy server information

      • VID001.exe (PID: 1928)

    • Application launched itself

      • cmd.exe (PID: 2880)

    • SALITY has been detected (SURICATA)

      • VID001.exe (PID: 1928)

    • Connects to the CnC server

      • VID001.exe (PID: 1928)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
58
Monitored processes
23
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start inject inject inject inject winrar.exe no specs vid001.exe no specs taskeng.exe dwm.exe explorer.exe ctfmon.exe Thumbnail Cache Out of Proc Server #SALITY vid001.exe uihost32.exe uihost32.exe no specs cmd.exe no specs cmd.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs uihost32.exe no specs uihost32.exe no specs cmd.exe no specs cmd.exe no specs net.exe no specs find.exe no specs cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
300taskeng.exe {CE1452CD-5E82-4DCD-B0CC-498574D17563}C:\Windows\System32\taskeng.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Engine
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskeng.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
612"C:\Windows\system32\Dwm.exe"C:\Windows\System32\dwm.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Desktop Window Manager
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dwm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\uxtheme.dll
984"C:\Users\admin\AppData\Local\Temp\3582-490\uihost32.exe" C:\Users\admin\AppData\Local\Temp\3582-490\uihost32.exe—uihost32.exe
User:
admin
Company:
McAfee, Inc.
Integrity Level:
MEDIUM
Description:
McAfee WebAdvisor
Exit code:
2
Version:
3.2.0
Modules
Images
c:\users\admin\appdata\local\temp\3582-490\uihost32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
1056"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\TempoRX.rar"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1164C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1564C:\Windows\System32\ctfmon.exe C:\Windows\System32\ctfmon.exe
taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
CTF Loader
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ctfmon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msctfmonitor.dll
c:\windows\system32\msctf.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
1652"C:\Users\admin\Desktop\TempoRX\VID001.exe" C:\Users\admin\Desktop\TempoRX\VID001.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
2
Modules
Images
c:\users\admin\desktop\temporx\vid001.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
1860"C:\Windows\system32\cmd.exe" /c taskkill /f /im uihost* & taskkill /f /im DOC0*C:\Windows\System32\cmd.exe—VID001.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
128
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1928"C:\Users\admin\AppData\Roaming\TempoRX\VID001.exe" C:\Users\admin\AppData\Roaming\TempoRX\VID001.exe
VID001.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\temporx\vid001.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
2052"C:\Users\admin\Desktop\TempoRX\uihost32.exe" C:\Users\admin\Desktop\TempoRX\uihost32.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\temporx\uihost32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
8 661
Read events
8 452
Write events
118
Delete events
91

Modification events

(PID) Process:(1164) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
01000000D08C9DDF0115D1118C7A00C04FC297EB01000000DBDD10622BD67741A42163F361389C4700000000020000000000106600000001000020000000714C0B985B0540658F4A2080B484A48FEA0193B4945278E76DEADC9EF300F178000000000E80000000020000200000002B477AD6A48910EDA2BF44A8E4FAAFB7E2EDF3EE6F87B8965B303D8016BD90EA30000000CB02147CAA96DADF9F5A3BD08AC8A954F632048A3EC443FAA534C64E43A96953CAB4A202A2BC0443ADBC5B693897DBB44000000078BCD17E1DCD91E99A86D38616C049FA8C5E2A7C07BB269B76B0709DC8A01ABF25866BF6638D5C4422D1151CE173748901F5A2433E1BD07914E254B07BB130FD
(PID) Process:(1056) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1056) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(1056) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(1056) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(1056) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(1056) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1056) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1056) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1056) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
53
Suspicious files
2
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
1652VID001.exeC:\Users\admin\AppData\Local\Temp\000E2CF7_rar\VID001.exeexecutable
MD5:E23E3052FEEF30F1C52F7901017AC9A2
SHA256:80285E4017C567156DAF88CA558214B06F09CCBF5A487B2BA99F96C384035802
1928VID001.exeC:\Users\admin\AppData\Roaming\TempoRX\uihost32.exeexecutable
MD5:4FCA837855B3BCED7559889ADB41C4B7
SHA256:8A366B1D30DD4D03AD8C5C18D0FB978D00D16F5F465BD59DB6E09B034775C3EC
1928VID001.exeC:\Users\admin\AppData\Local\Temp\000E363E_rar\VID001.exeexecutable
MD5:E23E3052FEEF30F1C52F7901017AC9A2
SHA256:80285E4017C567156DAF88CA558214B06F09CCBF5A487B2BA99F96C384035802
1056WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1056.36840\TempoRX\VID001.exeexecutable
MD5:E23E3052FEEF30F1C52F7901017AC9A2
SHA256:80285E4017C567156DAF88CA558214B06F09CCBF5A487B2BA99F96C384035802
1928VID001.exeC:\Users\admin\AppData\Roaming\TempoRX\uihost64.exeexecutable
MD5:0211073FEB4BA88254F40A2E6611FCEF
SHA256:62DFE27768E6293EB9218BA22A3ACB528DF71E4CC4625B95726CD421B716F983
2052uihost32.exeC:\MSOCache\All Users\{90140000-006E-0407-0000-0000000FF1CE}-C\dwtrig20.exeexecutable
MD5:CF6C595D3E5E9667667AF096762FD9C4
SHA256:593E60CC30AE0789448547195AF77F550387F6648D45847EA244DD0DD7ABF03D
2052uihost32.exeC:\MSOCache\All Users\{90140000-006E-0410-0000-0000000FF1CE}-C\dwtrig20.exeexecutable
MD5:CF6C595D3E5E9667667AF096762FD9C4
SHA256:593E60CC30AE0789448547195AF77F550387F6648D45847EA244DD0DD7ABF03D
2052uihost32.exeC:\MSOCache\All Users\{90140000-006E-040C-0000-0000000FF1CE}-C\DW20.EXEexecutable
MD5:02EE6A3424782531461FB2F10713D3C1
SHA256:EAD58C483CB20BCD57464F8A4929079539D634F469B213054BF737D227C026DC
2052uihost32.exeC:\MSOCache\All Users\{90140000-006E-0407-0000-0000000FF1CE}-C\DW20.EXEexecutable
MD5:02EE6A3424782531461FB2F10713D3C1
SHA256:EAD58C483CB20BCD57464F8A4929079539D634F469B213054BF737D227C026DC
2052uihost32.exeC:\MSOCache\All Users\{90140000-006E-0411-0000-0000000FF1CE}-C\DW20.EXEexecutable
MD5:02EE6A3424782531461FB2F10713D3C1
SHA256:EAD58C483CB20BCD57464F8A4929079539D634F469B213054BF737D227C026DC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
95
DNS requests
3
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1928
VID001.exe
GET
404
185.26.112.217:80
http://kr1s.ru/javarx.dat
unknown
html
1.18 Kb
unknown
1928
VID001.exe
GET
200
217.160.0.172:80
http://clinicaeugenia.com/wp-content/sobakavolos.gif?fdfe7=8322872
unknown
binary
13.1 Kb
unknown
1928
VID001.exe
GET
404
185.26.112.217:80
http://kr1s.ru/tessrx.html
unknown
html
1.18 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1928
VID001.exe
185.26.112.217:80
kr1s.ru
Jsc ru-center
RU
unknown
1928
VID001.exe
217.160.0.172:80
clinicaeugenia.com
IONOS SE
DE
unknown
1928
VID001.exe
85.85.85.85:5517
—
—
—
unknown
1928
VID001.exe
105.62.38.78:5517
—
—
—
unknown
1928
VID001.exe
37.68.182.68:5517
—
—
—
unknown
1928
VID001.exe
48.0.73.23:5517
—
—
—
unknown
1928
VID001.exe
200.60.57.62:5517
—
—
—
unknown

DNS requests

Domain
IP
Reputation
kr1s.ru
  • 185.26.112.217
malicious
zcop.ru
  • —
unknown
clinicaeugenia.com
  • 217.160.0.172
unknown

Threats

PID
Process
Class
Message
1928
VID001.exe
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))
1928
VID001.exe
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))
1928
VID001.exe
Malware Command and Control Activity Detected
ET MALWARE Win32.Sality-GR Checkin
1928
VID001.exe
A Network Trojan was detected
ET MALWARE W32/Sality Executable Pack Digital Signature ASCII Marker
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
TempoRX.rar