| File name: | Fast RDP Brute GUI v2.0.rar |
| Full analysis: | https://app.any.run/tasks/ee800912-9c97-419f-b4e2-645fb61efae9 |
| Verdict: | Malicious activity |
| Analysis date: | March 08, 2019, 03:08:26 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/x-rar |
| File info: | RAR archive data, v5 |
| MD5: | 87376599154588F0EF54375CB38AD8A8 |
| SHA1: | CDED5347B43997AAEA4A069A8DCBDCAFCF941D94 |
| SHA256: | E3E01F2F717838404F2F3D14250B9DE38C6405A1BD8F3BBBC7CCB372A39DEB96 |
| SSDEEP: | 24576:XLHxC6aWDKqj4/p0VR3lHhpFi3l3CqqWbrmzarR94MAub5eHQc:XLknjqjY0rlDFi3l3CqDfFd5w |
MALICIOUS
Application was dropped or rewritten from another process
- frdpb_v2.exe (PID: 3652)
Loads dropped or rewritten executable
- SearchProtocolHost.exe (PID: 608)
SUSPICIOUS
Executable content was dropped or overwritten
- WinRAR.exe (PID: 3556)
Connects to unusual port
- frdpb_v2.exe (PID: 3652)
INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .rar | | | RAR compressed archive (v5.0) (61.5) |
|---|---|---|
| .rar | | | RAR compressed archive (gen) (38.4) |
Total processes
32
Monitored processes
3
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 3556 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Fast RDP Brute GUI v2.0.rar" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 Modules
| |||||||||||||||
| 608 | "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe6_ Global\UsGthrCtrlFltPipeMssGthrPipe6 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" | C:\Windows\System32\SearchProtocolHost.exe | — | SearchIndexer.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft Windows Search Protocol Host Version: 7.00.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3652 | "C:\Users\admin\Desktop\frdpb_v2.exe" | C:\Users\admin\Desktop\frdpb_v2.exe | explorer.exe | ||||||||||||
User: admin Company: Stas'M Corp. Integrity Level: MEDIUM Description: Fast RDP Brute GUI v2.0 by Stas'M Version: 2.0.0.0 Modules
| |||||||||||||||
Total events
436
Read events
414
Write events
22
Delete events
0
Modification events
| (PID) Process: | (3556) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (3556) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (3556) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (3556) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\Fast RDP Brute GUI v2.0.rar | |||
| (PID) Process: | (3556) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (3556) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (3556) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (3556) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (608) SearchProtocolHost.exe | Key: | HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\5F\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (608) SearchProtocolHost.exe | Key: | HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\5F\52C64B7E |
| Operation: | write | Name: | @C:\Windows\system32\notepad.exe,-469 |
Value: Text Document | |||
Executable files
6
Suspicious files
0
Text files
6
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3556 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3556.4492\ports.txt | text | |
MD5:E359250AFF757DFAACA0C389D8736D97 | SHA256:A0AE07C2EBB3513A1DE6DC4FC58743365019E06B131379213E4A8257D7B4C51E | |||
| 3556 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3556.4492\user.txt | text | |
MD5:02B6352817D415D85AD9618556726F5B | SHA256:A9CEB90EC47B9C50B3A40EE2621B54F8DB9875F92DAE93D36CAF754C82D75E9B | |||
| 3652 | frdpb_v2.exe | C:\Users\admin\Desktop\ports.txt | text | |
MD5:E359250AFF757DFAACA0C389D8736D97 | SHA256:A0AE07C2EBB3513A1DE6DC4FC58743365019E06B131379213E4A8257D7B4C51E | |||
| 3556 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3556.4492\ranges.txt | text | |
MD5:3C275DFFD4B07BB6CD708E3F35523659 | SHA256:E65A68F0B165E7F77E3B7750DD68A3344EB306821960B9632B8D6804BCB9505C | |||
| 3556 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3556.4492\frdpb_v2.exe | executable | |
MD5:52BA4221016C4542984CCBDA598CC7C3 | SHA256:6ED76751791141CF638881366A3A9784033B43F79D5E195809A97CFC1D3D576B | |||
| 3556 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3556.4492\pass.txt | text | |
MD5:FF28387D86A3FD43402641DA8F11BE3B | SHA256:3B282069E239EFC69A0561B64BE9AE925BEA7F54954EB8F66E84EC75117522C2 | |||
| 3652 | frdpb_v2.exe | C:\Users\admin\Desktop\ranges.txt | text | |
MD5:3C275DFFD4B07BB6CD708E3F35523659 | SHA256:E65A68F0B165E7F77E3B7750DD68A3344EB306821960B9632B8D6804BCB9505C | |||
| 3556 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3556.4492\rdpthread.exe | executable | |
MD5:08460B6F9D3FF0F8FF5D892E4E7854A5 | SHA256:4C47A02335BA89B9AE3C15C2BBCEFAEF78E282CCEF88257FA9FB4260D6DA5637 | |||
| 3556 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3556.4492\msvcr71.dll | executable | |
MD5:CA2F560921B7B8BE1CF555A5A18D54C3 | SHA256:C4D4339DF314A27FF75A38967B7569D9962337B8D4CD4B0DB3ABA5FF72B2BFBB | |||
| 3556 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3556.4492\ssleay32.dll | executable | |
MD5:6C06FB9E1D818FDE8D142EE180A65646 | SHA256:F07CE36B11699B2FAA37E2604A49D33DB7528262E8BB782A96E7CB2A3E18AA1C | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report