File name:

Natro Macro v1.0.0.2 - Kopie.rar

Full analysis: https://app.any.run/tasks/853843e9-81fb-4e6b-b413-79eb0bbb94be
Verdict: Malicious activity
Analysis date: September 12, 2024, 15:50:16
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
discord
github
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

39CA5F5C0EA1D53057A12030B55BB391

SHA1:

5DCC8DD0F0FC64DBAC264244F294B3AA5C48C114

SHA256:

E32A4FD0CC5401B17DEEDEBEECB15EBA6BEF849B70C01F305B5877EC9F9DD485

SSDEEP:

98304:Geznj9vv2IytR0xsweGcwsrTXs+XcxFkgomygg/KzHG/fQt1j9LIilZfLqJQbTji:jVytZ5zMpGwq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • WinRAR.exe (PID: 3812)
      • cmd.exe (PID: 6236)
      • cmd.exe (PID: 1124)
      • cmd.exe (PID: 2056)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 3812)
      • AutoHotkey32.exe (PID: 7108)
      • AutoHotkey32.exe (PID: 7156)

    • Starts application with an unusual extension

      • cmd.exe (PID: 6236)
      • cmd.exe (PID: 1124)
      • cmd.exe (PID: 2056)
      • cmd.exe (PID: 2524)
      • cmd.exe (PID: 2232)

    • Application launched itself

      • cmd.exe (PID: 6236)
      • cmd.exe (PID: 1124)
      • cmd.exe (PID: 2056)
      • AutoHotkey32.exe (PID: 7108)
      • AutoHotkey32.exe (PID: 7156)

    • Executing commands from a ".bat" file

      • WinRAR.exe (PID: 3812)

    • Checks Windows Trust Settings

      • AutoHotkey32.exe (PID: 7108)
      • AutoHotkey32.exe (PID: 7156)

    • There is functionality for taking screenshot (YARA)

      • AutoHotkey32.exe (PID: 7108)
      • AutoHotkey32.exe (PID: 7156)

  • INFO

    • The process uses the downloaded file

      • WinRAR.exe (PID: 3812)

    • Checks supported languages

      • chcp.com (PID: 1744)
      • chcp.com (PID: 3180)
      • chcp.com (PID: 936)
      • chcp.com (PID: 3660)
      • AutoHotkey32.exe (PID: 2724)
      • AutoHotkey32.exe (PID: 7108)
      • AutoHotkey64.exe (PID: 5980)
      • chcp.com (PID: 6244)
      • AutoHotkey32.exe (PID: 7156)
      • AutoHotkey32.exe (PID: 964)
      • AutoHotkey64.exe (PID: 6640)

    • Changes the display of characters in the console

      • cmd.exe (PID: 6236)
      • cmd.exe (PID: 1124)
      • cmd.exe (PID: 2056)
      • cmd.exe (PID: 2524)
      • cmd.exe (PID: 2232)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3812)

    • Manual execution by a user

      • cmd.exe (PID: 2524)
      • cmd.exe (PID: 2232)

    • Reads the software policy settings

      • AutoHotkey64.exe (PID: 5980)
      • AutoHotkey64.exe (PID: 6640)
      • AutoHotkey32.exe (PID: 7108)
      • AutoHotkey32.exe (PID: 7156)

    • Reads the machine GUID from the registry

      • AutoHotkey32.exe (PID: 7108)
      • AutoHotkey64.exe (PID: 5980)
      • AutoHotkey64.exe (PID: 6640)
      • AutoHotkey32.exe (PID: 7156)

    • Create files in a temporary directory

      • AutoHotkey32.exe (PID: 7108)
      • AutoHotkey32.exe (PID: 7156)

    • Reads the computer name

      • AutoHotkey64.exe (PID: 5980)
      • AutoHotkey32.exe (PID: 7108)
      • AutoHotkey64.exe (PID: 6640)
      • AutoHotkey32.exe (PID: 7156)

    • Checks proxy server information

      • AutoHotkey32.exe (PID: 7108)
      • AutoHotkey32.exe (PID: 7156)

    • Attempting to use instant messaging service

      • AutoHotkey64.exe (PID: 5980)
      • AutoHotkey64.exe (PID: 6640)

    • Reads security settings of Internet Explorer

      • OpenWith.exe (PID: 1640)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
147
Monitored processes
27
Malicious processes
1
Suspicious processes
5

Behavior graph

Click at the process to see the details
start winrar.exe cmd.exe no specs conhost.exe no specs chcp.com no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs cmd.exe no specs rundll32.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs THREAT autohotkey32.exe autohotkey32.exe no specs autohotkey64.exe openwith.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs THREAT autohotkey32.exe autohotkey32.exe no specs autohotkey64.exe

Process information

PID
CMD
Path
Indicators
Parent process
888C:\WINDOWS\system32\cmd.exe /c "prompt #$E# & for %E in (1) do rem"C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
936chcp 65001 C:\Windows\System32\chcp.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Change CodePage Utility
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\chcp.com
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
964"C:\Users\admin\Desktop\Natro Macro v1.0.0.2 - Kopie\submacros\AutoHotkey32.exe" /script "C:\Users\admin\Desktop\Natro Macro v1.0.0.2 - Kopie\submacros\Heartbeat.ahk"C:\Users\admin\Desktop\Natro Macro v1.0.0.2 - Kopie\submacros\AutoHotkey32.exe—AutoHotkey32.exe
User:
admin
Company:
AutoHotkey Foundation LLC
Integrity Level:
MEDIUM
Description:
AutoHotkey 32-bit
Version:
2.0.12
Modules
Images
c:\users\admin\desktop\natro macro v1.0.0.2 - kopie\submacros\autohotkey32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\psapi.dll
c:\windows\syswow64\shlwapi.dll
1124C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\Rar$DIa3812.5492\START.bat" "C:\Windows\System32\cmd.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
3221225786
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
1640C:\WINDOWS\system32\OpenWith.exe -EmbeddingC:\Windows\System32\OpenWith.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1744chcp 65001 C:\Windows\System32\chcp.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Change CodePage Utility
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\chcp.com
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
2056C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\Rar$DIa3812.6393\START.bat" "C:\Windows\System32\cmd.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
3221225786
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
2232C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\Desktop\Natro Macro v1.0.0.2 - Kopie\START.bat" "C:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
2268\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2368C:\WINDOWS\system32\cmd.exe /c "prompt #$E# & for %E in (1) do rem"C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
Total events
16 048
Read events
16 022
Write events
26
Delete events
0

Modification events

(PID) Process:(3812) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(3812) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Natro Macro v1.0.0.2 - Kopie.rar
(PID) Process:(3812) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3812) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3812) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3812) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3812) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
(PID) Process:(3812) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:name
Value:
256
(PID) Process:(3812) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3812) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:psize
Value:
80
Executable files
30
Suspicious files
0
Text files
444
Unknown types
0

Dropped files

PID
Process
Filename
Type
3812WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3812.7437\Natro Macro v1.0.0.2 - Kopie\lib\data\memorymatch.ahktext
MD5:1BD739FB4481F7FF53F57C42A6674F41
SHA256:C40415D3073AE1DB8034F43FBDABE9528E0A87862F540C61BE26CFF180D32B00
3812WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa3812.6393\START.bathtml
MD5:A58311373246197CE552CEBA70AD8B5C
SHA256:C48CD7DDF41DD81FAE4DB362C5C631EDB582F03FB170B1A858FA655D6CCADCE8
3812WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa3812.4273\START.bathtml
MD5:A58311373246197CE552CEBA70AD8B5C
SHA256:C48CD7DDF41DD81FAE4DB362C5C631EDB582F03FB170B1A858FA655D6CCADCE8
3812WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3812.7437\Natro Macro v1.0.0.2 - Kopie\lib\HyperSleep.ahktext
MD5:312B0170D0A84C7B88ACB6D4B6B66D93
SHA256:D8F20B8B223BEF194B435F0F0875761CAC3B74F39433EB9D9FF7260996F06D8D
3812WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3812.7437\Natro Macro v1.0.0.2 - Kopie\lib\nm_InventorySearch.ahktext
MD5:06EFD1811EE317D4C1595B6A6CB83451
SHA256:469CCAE055CC92CA4B04989554AEF43CFEDD8E3B3CA0F89D8DCF0AFB3BD6C9C6
3812WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3812.7437\Natro Macro v1.0.0.2 - Kopie\lib\nm_OpenMenu.ahktext
MD5:923D753BCC8F129B832CB9FB3C06E30E
SHA256:1285097ABDE439F5D37A48628480752D6D860F19F48AC3E78EB76CD27E9DD3DD
3812WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3812.7437\Natro Macro v1.0.0.2 - Kopie\lib\enum\EnumStr.ahktext
MD5:178B6DB95EF550A82E9B441BB91AF76A
SHA256:E9F850288C5E3B0205C1E033D7C1D2B0EBC68D5C4D9DCFFCCD15C0ACF14AD1D9
3812WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3812.7437\Natro Macro v1.0.0.2 - Kopie\lib\enum\EnumInt.ahktext
MD5:70FB319373461D48A4C49D5DA7226E0D
SHA256:AC5E3F1008F65CF51FBAE4A9E879075F65A155869F6D4D9A4196A3B6311163B8
3812WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3812.7437\Natro Macro v1.0.0.2 - Kopie\lib\DurationFromSeconds.ahktext
MD5:0FF21713A7EBFCAC269C4CA840D72816
SHA256:F55525FBC7588D8B4453BC86018C1341EAF12752F5C5D37B68679A2251A14651
3812WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3812.7437\Natro Macro v1.0.0.2 - Kopie\lib\Gdip_ImageSearch.ahktext
MD5:8FFAFCFD0FB2247C45A6597A69C20432
SHA256:25BD9B4B006A80E43DF94C30EED25DF33F3E27C1380280CEDD9559C8F00FAF70
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
32
DNS requests
7
Threats
8

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6856
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4324
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6856
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5980
AutoHotkey64.exe
162.159.128.233:443
discord.com
CLOUDFLARENET
—
whitelisted
7108
AutoHotkey32.exe
140.82.121.6:443
api.github.com
GITHUB
US
whitelisted
7108
AutoHotkey32.exe
185.199.110.133:443
raw.githubusercontent.com
FASTLY
US
shared

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
whitelisted
google.com
  • 216.58.206.78
whitelisted
discord.com
  • 162.159.128.233
  • 162.159.135.232
  • 162.159.138.232
  • 162.159.137.232
  • 162.159.136.232
whitelisted
api.github.com
  • 140.82.121.6
whitelisted
raw.githubusercontent.com
  • 185.199.110.133
  • 185.199.109.133
  • 185.199.108.133
  • 185.199.111.133
shared

Threats

PID
Process
Class
Message
2256
svchost.exe
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discord .com)
5980
AutoHotkey64.exe
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
2256
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
5980
AutoHotkey64.exe
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
5980
AutoHotkey64.exe
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
5980
AutoHotkey64.exe
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
6640
AutoHotkey64.exe
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
6640
AutoHotkey64.exe
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Natro Macro v1.0.0.2 - Kopie.rar