analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

New VPN.rar

Full analysis: https://app.any.run/tasks/0fd8d04e-f12c-4f51-af4f-7078ee924656
Verdict: Malicious activity
Analysis date: September 18, 2019, 18:28:16
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v4, os: Win32
MD5:

9DE53118F3AAF1533635519197081CD9

SHA1:

67BD0E458215330793D4B2BCFAA1246E68CEF59D

SHA256:

E6518215FF44B425642106F2C7304CE351BF5E0C5869BC1EFD5C1F438A6DB669

SSDEEP:

98304:uTNBVagRWx5Q9hHipTj/QoNaWV4rIMuyMZtAlaZg4pUgHMfvxZs431P6xutTAu:uTNBRJCyoVVEadZg2UgH0Wim5u

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • arubanetsvc.exe (PID: 2888)

    • Application was dropped or rewritten from another process

      • arubanetsvc.exe (PID: 2888)
      • anuacui.exe (PID: 3008)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3072)
      • msiexec.exe (PID: 3512)
      • MsiExec.exe (PID: 3736)
      • DrvInst.exe (PID: 3592)
      • DrvInst.exe (PID: 3568)

    • Executed as Windows Service

      • vssvc.exe (PID: 504)
      • arubanetsvc.exe (PID: 2888)

    • Starts Microsoft Installer

      • WinRAR.exe (PID: 3072)

    • Executed via COM

      • DrvInst.exe (PID: 2508)
      • DrvInst.exe (PID: 3568)
      • DrvInst.exe (PID: 3592)
      • rundll32.exe (PID: 2900)

    • Creates files in the program directory

      • arubanetsvc.exe (PID: 2888)
      • anuacui.exe (PID: 3008)

    • Creates files in the Windows directory

      • DrvInst.exe (PID: 3568)
      • MsiExec.exe (PID: 3736)
      • DrvInst.exe (PID: 3592)

    • Removes files from Windows directory

      • DrvInst.exe (PID: 3568)
      • DrvInst.exe (PID: 3592)

    • Creates files in the driver directory

      • DrvInst.exe (PID: 3568)
      • DrvInst.exe (PID: 3592)

  • INFO

    • Searches for installed software

      • msiexec.exe (PID: 3512)

    • Low-level read access rights to disk partition

      • vssvc.exe (PID: 504)

    • Changes settings of System certificates

      • DrvInst.exe (PID: 2508)

    • Loads dropped or rewritten executable

      • MsiExec.exe (PID: 3736)

    • Application launched itself

      • msiexec.exe (PID: 3512)

    • Adds / modifies Windows certificates

      • DrvInst.exe (PID: 2508)

    • Creates files in the program directory

      • msiexec.exe (PID: 3512)
      • MsiExec.exe (PID: 3736)

    • Creates or modifies windows services

      • MsiExec.exe (PID: 3736)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 3512)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v-4.x) (58.3)
.rar | RAR compressed archive (gen) (41.6)

EXIF

ZIP

ArchivedFileName: New VPN\ansetup 32bit.msi
PackingMethod: Normal
ModifyDate: 2016:11:30 15:25:02
OperatingSystem: Win32
UncompressedSize: 4178008
CompressedSize: 3167686
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
50
Monitored processes
13
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe msiexec.exe msiexec.exe msiexec.exe no specs vssvc.exe no specs drvinst.exe no specs msiexec.exe no specs msiexec.exe arubanetsvc.exe no specs drvinst.exe drvinst.exe rundll32.exe no specs anuacui.exe

Process information

PID
CMD
Path
Indicators
Parent process
3072"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\New VPN.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3324"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\Rar$EXa3072.33083\New VPN\ansetup 64bit.msi" C:\Windows\System32\msiexec.exe
WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
1633
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
3512C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
3992"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\Rar$EXa3072.33850\New VPN\ansetup 32bit.msi" C:\Windows\System32\msiexec.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
504C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2508DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot22" "" "" "695c3f483" "00000000" "000005B8" "000002D4"C:\Windows\system32\DrvInst.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2784C:\Windows\system32\MsiExec.exe -Embedding D0A5DB997DB7CE86A4330E1777154763C:\Windows\system32\MsiExec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
3736C:\Windows\system32\MsiExec.exe -Embedding 00855403A75F571734E942B8299650C9 M Global\MSI0000C:\Windows\system32\MsiExec.exe
msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
2888"C:\Program Files\Aruba Networks\Virtual Internet Agent\arubanetsvc.exe"C:\Program Files\Aruba Networks\Virtual Internet Agent\arubanetsvc.exe—services.exe
User:
SYSTEM
Company:
Aruba Networks
Integrity Level:
SYSTEM
Description:
Aruba Networks Service
Version:
2.3.4.0.86416
3568DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{6129cb11-7ef0-4994-f116-1a1d8c07e822}\arubavnic.inf" "0" "6845f6017" "000002D4" "WinSta0\Default" "00000554" "208" "c:\program files\aruba networks\virtual internet agent"C:\Windows\system32\DrvInst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
2 001
Read events
1 190
Write events
0
Delete events
0

Modification events

No data
Executable files
29
Suspicious files
28
Text files
301
Unknown types
8

Dropped files

PID
Process
Filename
Type
3072WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3072.33083\New VPN\ansetup 64bit.msi —
MD5:—
SHA256:—
3324msiexec.exeC:\Users\admin\AppData\Local\Temp\CabDD26.tmp —
MD5:—
SHA256:—
3324msiexec.exeC:\Users\admin\AppData\Local\Temp\TarDD27.tmp —
MD5:—
SHA256:—
3324msiexec.exeC:\Users\admin\AppData\Local\Temp\CabDD37.tmp —
MD5:—
SHA256:—
3324msiexec.exeC:\Users\admin\AppData\Local\Temp\TarDD38.tmp —
MD5:—
SHA256:—
3324msiexec.exeC:\Users\admin\AppData\Local\Temp\CabDE14.tmp —
MD5:—
SHA256:—
3324msiexec.exeC:\Users\admin\AppData\Local\Temp\TarDE15.tmp —
MD5:—
SHA256:—
3072WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3072.33850\New VPN\ansetup 64bit.msi —
MD5:—
SHA256:—
3512msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
3072WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3072.33083\New VPN\ansetup 32bit.msiexecutable
MD5:FFA8B7BDCCF062D44226936405B50CEB
SHA256:B4126768EE14A8939EAB008FD0ACCA1673E13F7F9879BC6F847F815471093C1C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3324
msiexec.exe
GET
200
205.185.216.10:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
US
compressed
57.0 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3324
msiexec.exe
205.185.216.10:80
www.download.windowsupdate.com
Highwinds Network Group, Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
www.download.windowsupdate.com
  • 205.185.216.10
  • 205.185.216.42
whitelisted

Threats

No threats detected
Process
Message
anuacui.exe
Could not create the registry key.
anuacui.exe
Query User Token failed reason
anuacui.exe
Could not create the registry key.
anuacui.exe
Query User Token failed reason
anuacui.exe
Could not create the registry key.
anuacui.exe
Query User Token failed reason
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
New VPN.rar