File name:

Natro Macro v1.0.0.2 - Kopie.rar

Full analysis: https://app.any.run/tasks/853843e9-81fb-4e6b-b413-79eb0bbb94be
Verdict: Malicious activity
Analysis date: September 12, 2024, 15:50:16
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
discord
github
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

39CA5F5C0EA1D53057A12030B55BB391

SHA1:

5DCC8DD0F0FC64DBAC264244F294B3AA5C48C114

SHA256:

E32A4FD0CC5401B17DEEDEBEECB15EBA6BEF849B70C01F305B5877EC9F9DD485

SSDEEP:

98304:Geznj9vv2IytR0xsweGcwsrTXs+XcxFkgomygg/KzHG/fQt1j9LIilZfLqJQbTji:jVytZ5zMpGwq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 3812)
      • AutoHotkey32.exe (PID: 7156)
      • AutoHotkey32.exe (PID: 7108)

    • Executing commands from a ".bat" file

      • WinRAR.exe (PID: 3812)

    • Starts CMD.EXE for commands execution

      • WinRAR.exe (PID: 3812)
      • cmd.exe (PID: 6236)
      • cmd.exe (PID: 1124)
      • cmd.exe (PID: 2056)

    • Starts application with an unusual extension

      • cmd.exe (PID: 6236)
      • cmd.exe (PID: 1124)
      • cmd.exe (PID: 2056)
      • cmd.exe (PID: 2524)
      • cmd.exe (PID: 2232)

    • Application launched itself

      • cmd.exe (PID: 6236)
      • cmd.exe (PID: 1124)
      • cmd.exe (PID: 2056)
      • AutoHotkey32.exe (PID: 7108)
      • AutoHotkey32.exe (PID: 7156)

    • Checks Windows Trust Settings

      • AutoHotkey32.exe (PID: 7108)
      • AutoHotkey32.exe (PID: 7156)

    • There is functionality for taking screenshot (YARA)

      • AutoHotkey32.exe (PID: 7108)
      • AutoHotkey32.exe (PID: 7156)

  • INFO

    • Checks supported languages

      • chcp.com (PID: 1744)
      • chcp.com (PID: 3180)
      • chcp.com (PID: 936)
      • AutoHotkey32.exe (PID: 2724)
      • AutoHotkey64.exe (PID: 5980)
      • chcp.com (PID: 3660)
      • chcp.com (PID: 6244)
      • AutoHotkey32.exe (PID: 7156)
      • AutoHotkey32.exe (PID: 964)
      • AutoHotkey64.exe (PID: 6640)
      • AutoHotkey32.exe (PID: 7108)

    • Changes the display of characters in the console

      • cmd.exe (PID: 6236)
      • cmd.exe (PID: 1124)
      • cmd.exe (PID: 2056)
      • cmd.exe (PID: 2524)
      • cmd.exe (PID: 2232)

    • The process uses the downloaded file

      • WinRAR.exe (PID: 3812)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3812)

    • Reads the computer name

      • AutoHotkey64.exe (PID: 5980)
      • AutoHotkey32.exe (PID: 7108)
      • AutoHotkey64.exe (PID: 6640)
      • AutoHotkey32.exe (PID: 7156)

    • Create files in a temporary directory

      • AutoHotkey32.exe (PID: 7108)
      • AutoHotkey32.exe (PID: 7156)

    • Reads the software policy settings

      • AutoHotkey64.exe (PID: 5980)
      • AutoHotkey32.exe (PID: 7108)
      • AutoHotkey64.exe (PID: 6640)
      • AutoHotkey32.exe (PID: 7156)

    • Reads the machine GUID from the registry

      • AutoHotkey64.exe (PID: 5980)
      • AutoHotkey32.exe (PID: 7108)
      • AutoHotkey64.exe (PID: 6640)
      • AutoHotkey32.exe (PID: 7156)

    • Checks proxy server information

      • AutoHotkey32.exe (PID: 7108)
      • AutoHotkey32.exe (PID: 7156)

    • Manual execution by a user

      • cmd.exe (PID: 2524)
      • cmd.exe (PID: 2232)

    • Attempting to use instant messaging service

      • AutoHotkey64.exe (PID: 5980)
      • AutoHotkey64.exe (PID: 6640)

    • Reads security settings of Internet Explorer

      • OpenWith.exe (PID: 1640)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
147
Monitored processes
27
Malicious processes
1
Suspicious processes
5

Behavior graph

Click at the process to see the details
start winrar.exe cmd.exe no specs conhost.exe no specs chcp.com no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs cmd.exe no specs rundll32.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs THREAT autohotkey32.exe autohotkey32.exe no specs autohotkey64.exe openwith.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs THREAT autohotkey32.exe autohotkey32.exe no specs autohotkey64.exe

Process information

PID
CMD
Path
Indicators
Parent process
888C:\WINDOWS\system32\cmd.exe /c "prompt #$E# & for %E in (1) do rem"C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
936chcp 65001 C:\Windows\System32\chcp.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Change CodePage Utility
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\chcp.com
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
964"C:\Users\admin\Desktop\Natro Macro v1.0.0.2 - Kopie\submacros\AutoHotkey32.exe" /script "C:\Users\admin\Desktop\Natro Macro v1.0.0.2 - Kopie\submacros\Heartbeat.ahk"C:\Users\admin\Desktop\Natro Macro v1.0.0.2 - Kopie\submacros\AutoHotkey32.exe—AutoHotkey32.exe
User:
admin
Company:
AutoHotkey Foundation LLC
Integrity Level:
MEDIUM
Description:
AutoHotkey 32-bit
Version:
2.0.12
Modules
Images
c:\users\admin\desktop\natro macro v1.0.0.2 - kopie\submacros\autohotkey32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\psapi.dll
c:\windows\syswow64\shlwapi.dll
1124C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\Rar$DIa3812.5492\START.bat" "C:\Windows\System32\cmd.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
3221225786
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
1640C:\WINDOWS\system32\OpenWith.exe -EmbeddingC:\Windows\System32\OpenWith.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1744chcp 65001 C:\Windows\System32\chcp.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Change CodePage Utility
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\chcp.com
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
2056C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\Rar$DIa3812.6393\START.bat" "C:\Windows\System32\cmd.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
3221225786
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
2232C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\Desktop\Natro Macro v1.0.0.2 - Kopie\START.bat" "C:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
2268\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2368C:\WINDOWS\system32\cmd.exe /c "prompt #$E# & for %E in (1) do rem"C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
Total events
16 048
Read events
16 022
Write events
26
Delete events
0

Modification events

(PID) Process:(3812) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(3812) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Natro Macro v1.0.0.2 - Kopie.rar
(PID) Process:(3812) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3812) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3812) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3812) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3812) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
(PID) Process:(3812) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:name
Value:
256
(PID) Process:(3812) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3812) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:psize
Value:
80
Executable files
30
Suspicious files
0
Text files
444
Unknown types
0

Dropped files

PID
Process
Filename
Type
3812WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa3812.6393\START.bathtml
MD5:A58311373246197CE552CEBA70AD8B5C
SHA256:C48CD7DDF41DD81FAE4DB362C5C631EDB582F03FB170B1A858FA655D6CCADCE8
3812WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3812.7437\Natro Macro v1.0.0.2 - Kopie\lib\Gdip_All.ahktext
MD5:BDF3099831BFF1F4D7D57E0AEBE4AFE3
SHA256:72DCC0FC9BADA8E76E8D2F4868F6B23F7A42DB3B675A7A490360AB2D96B30FFF
3812WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa3812.5492\START.bathtml
MD5:A58311373246197CE552CEBA70AD8B5C
SHA256:C48CD7DDF41DD81FAE4DB362C5C631EDB582F03FB170B1A858FA655D6CCADCE8
3812WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3812.7437\Natro Macro v1.0.0.2 - Kopie\lib\enum\EnumInt.ahktext
MD5:70FB319373461D48A4C49D5DA7226E0D
SHA256:AC5E3F1008F65CF51FBAE4A9E879075F65A155869F6D4D9A4196A3B6311163B8
3812WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3812.7437\Natro Macro v1.0.0.2 - Kopie\lib\HyperSleep.ahktext
MD5:312B0170D0A84C7B88ACB6D4B6B66D93
SHA256:D8F20B8B223BEF194B435F0F0875761CAC3B74F39433EB9D9FF7260996F06D8D
3812WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3812.7437\Natro Macro v1.0.0.2 - Kopie\lib\DurationFromSeconds.ahktext
MD5:0FF21713A7EBFCAC269C4CA840D72816
SHA256:F55525FBC7588D8B4453BC86018C1341EAF12752F5C5D37B68679A2251A14651
3812WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3812.7437\Natro Macro v1.0.0.2 - Kopie\lib\Gdip_ImageSearch.ahktext
MD5:8FFAFCFD0FB2247C45A6597A69C20432
SHA256:25BD9B4B006A80E43DF94C30EED25DF33F3E27C1380280CEDD9559C8F00FAF70
3812WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3812.7437\Natro Macro v1.0.0.2 - Kopie\.gitignoretext
MD5:8F0CDB021FDD66FC5892B17387B5A614
SHA256:AA899CBB11DFA82912A1184C2CB2ABBA292B6F47FEC346AA6928A2A7C16724C7
3812WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3812.7437\Natro Macro v1.0.0.2 - Kopie\LICENSE.mdtext
MD5:1EBBD3E34237AF26DA5DC08A4E440464
SHA256:3972DC9744F6499F0F9B2DBF76696F2AE7AD8AF9B23DDE66D6AF86C9DFB36986
3812WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3812.7437\Natro Macro v1.0.0.2 - Kopie\lib\enum\EnumStr.ahktext
MD5:178B6DB95EF550A82E9B441BB91AF76A
SHA256:E9F850288C5E3B0205C1E033D7C1D2B0EBC68D5C4D9DCFFCCD15C0ACF14AD1D9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
32
DNS requests
7
Threats
8

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6856
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4324
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6856
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5980
AutoHotkey64.exe
162.159.128.233:443
discord.com
CLOUDFLARENET
—
whitelisted
7108
AutoHotkey32.exe
140.82.121.6:443
api.github.com
GITHUB
US
whitelisted
7108
AutoHotkey32.exe
185.199.110.133:443
raw.githubusercontent.com
FASTLY
US
shared

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
whitelisted
google.com
  • 216.58.206.78
whitelisted
discord.com
  • 162.159.128.233
  • 162.159.135.232
  • 162.159.138.232
  • 162.159.137.232
  • 162.159.136.232
whitelisted
api.github.com
  • 140.82.121.6
whitelisted
raw.githubusercontent.com
  • 185.199.110.133
  • 185.199.109.133
  • 185.199.108.133
  • 185.199.111.133
shared

Threats

PID
Process
Class
Message
—
—
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discord .com)
—
—
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
—
—
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
—
—
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
—
—
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
—
—
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
—
—
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
—
—
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Natro Macro v1.0.0.2 - Kopie.rar