File name:

1.rar

Full analysis: https://app.any.run/tasks/54d3ba74-95ef-4e04-bf87-31baa750adc2
Verdict: Malicious activity
Analysis date: January 05, 2020, 18:44:04
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

3668D0F63EADE4AB337684CAA2EAC6FB

SHA1:

B08BA0D3572C4FF3D39D40AEB1854A276EB78FA3

SHA256:

DE90E23BDFC1C244E97F4A8F1348DE953C999218E3174A66CE077DAA3DB6C045

SSDEEP:

24576:TcEwuUr9SM9qSrIYeuIwlOICcIeAkLazn8rSP3ZhrVIey1I6cIrAPxN27rS/O99/:zUkMJNeuI7IXwb7/HrVIjI/3B/u

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Xtool3 - Cracked by ge9d.exe (PID: 1704)
      • Xtool3.exe (PID: 2096)

    • Loads dropped or rewritten executable

      • explorer.exe (PID: 352)
      • Xtool3 - Cracked by ge9d.exe (PID: 1704)
      • Xtool3.exe (PID: 2096)
      • SearchProtocolHost.exe (PID: 3488)

  • SUSPICIOUS

    • Creates files in the user directory

      • Xtool3 - Cracked by ge9d.exe (PID: 1704)

    • Reads Environment values

      • Xtool3 - Cracked by ge9d.exe (PID: 1704)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2176)

  • INFO

    • Reads the hosts file

      • Xtool3 - Cracked by ge9d.exe (PID: 1704)
      • Xtool3.exe (PID: 2096)

    • Reads settings of System Certificates

      • Xtool3 - Cracked by ge9d.exe (PID: 1704)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
5
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start winrar.exe searchprotocolhost.exe no specs explorer.exe no specs xtool3 - cracked by ge9d.exe xtool3.exe

Process information

PID
CMD
Path
Indicators
Parent process
352C:\Windows\Explorer.EXEC:\Windows\explorer.exe——
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\winanr.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
1704"C:\Users\admin\Desktop\Xtool3 - Cracked by ge9d.exe" C:\Users\admin\Desktop\Xtool3 - Cracked by ge9d.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\xtool3 - cracked by ge9d.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2096"C:\Users\admin\Desktop\Xtool3.exe" C:\Users\admin\Desktop\Xtool3.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\xtool3.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2176"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\1.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3488"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
2 723
Read events
2 604
Write events
119
Delete events
0

Modification events

(PID) Process:(2176) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2176) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2176) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2176) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\1.rar
(PID) Process:(2176) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2176) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2176) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2176) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(352) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rar\OpenWithList
Operation:writeName:a
Value:
WinRAR.exe
(PID) Process:(352) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rar\OpenWithList
Operation:writeName:MRUList
Value:
a
Executable files
22
Suspicious files
0
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
352explorer.exeC:\Users\admin\Desktop\Configs —
MD5:—
SHA256:—
2176WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2176.37158\Microsoft.WindowsAPICodePack.ExtendedLinguisticServices.dllexecutable
MD5:—
SHA256:—
2176WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2176.37158\Update Log.txttext
MD5:—
SHA256:—
2176WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2176.37158\readme.txttext
MD5:—
SHA256:—
2176WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2176.37158\Xtool3.exeexecutable
MD5:—
SHA256:—
2176WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2176.37158\Xtool3 - Cracked by ge9d.exeexecutable
MD5:—
SHA256:—
352explorer.exeC:\Users\admin\Desktop\Microsoft.WindowsAPICodePack.ExtendedLinguisticServices.dllexecutable
MD5:—
SHA256:—
2176WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2176.37158\Microsoft.WindowsAPICodePack.Sensors.dllexecutable
MD5:—
SHA256:—
352explorer.exeC:\Users\admin\Desktop\Microsoft.WindowsAPICodePack.ShellExtensions.dllexecutable
MD5:—
SHA256:—
352explorer.exeC:\Users\admin\Desktop\Microsoft.WindowsAPICodePack.Sensors.dllexecutable
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2
DNS requests
2
Threats
3

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1704
Xtool3 - Cracked by ge9d.exe
104.27.78.111:443
www.nulled.to
Cloudflare Inc
US
unknown
1704
Xtool3 - Cracked by ge9d.exe
145.14.144.47:443
xtool3.000webhostapp.com
Hostinger International Limited
US
shared

DNS requests

Domain
IP
Reputation
www.nulled.to
  • 104.27.78.111
  • 104.27.79.111
unknown
xtool3.000webhostapp.com
  • 145.14.144.47
shared

Threats

PID
Process
Class
Message
1080
svchost.exe
Potentially Bad Traffic
ET DNS Query for .to TLD
1080
svchost.exe
Not Suspicious Traffic
ET INFO Observed Free Hosting Domain (*.000webhostapp .com in DNS Lookup)
1704
Xtool3 - Cracked by ge9d.exe
Not Suspicious Traffic
ET INFO Observed SSL Cert for Free Hosting Domain (*.000webhostapp .com)
Process
Message
Xtool3 - Cracked by ge9d.exe
%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s
Xtool3.exe
%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s