File name:

[Snipcola] Asshurt.rar

Full analysis: https://app.any.run/tasks/d061b1c5-19b5-451a-a233-cab82c62f71d
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: December 29, 2019, 21:00:59
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ransomware
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

A7C000EA7C4EE80888EC8C9A3C5F8BEF

SHA1:

073BAFD906161B35D39777B122D7874288EDF895

SHA256:

E852C2FEB1CDED5D8CF161BF3530E1DED83661841BACB85ABF7011ECDC8F3FB8

SSDEEP:

393216:Vth8C7sZoTrefEP+GfvKiNi1Gm9GmxDpIm4NoyNHBHF4nCIto:f6o7+iKiNixDpt4NFNHBHSnCIm

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Asshurt.exe (PID: 2832)
      • Multiple_ROBLOX.exe (PID: 2284)
      • Gravity_Switch.exe (PID: 3764)

    • Dropped file may contain instructions of ransomware

      • WinRAR.exe (PID: 2328)

    • Loads dropped or rewritten executable

      • Asshurt.exe (PID: 2832)
      • SearchProtocolHost.exe (PID: 3464)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2328)

    • Changes IE settings (feature browser emulation)

      • Asshurt.exe (PID: 2832)

    • Reads internet explorer settings

      • Asshurt.exe (PID: 2832)

    • Reads Internet Cache Settings

      • Asshurt.exe (PID: 2832)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • WinRAR.exe (PID: 2328)

    • Manual execution by user

      • Asshurt.exe (PID: 2832)
      • Multiple_ROBLOX.exe (PID: 2284)
      • Gravity_Switch.exe (PID: 3764)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
5
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe asshurt.exe no specs searchprotocolhost.exe no specs multiple_roblox.exe no specs gravity_switch.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2284"C:\Users\admin\Desktop\Asshurt\Multiple_ROBLOX.exe" C:\Users\admin\Desktop\Asshurt\Multiple_ROBLOX.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Multiple ROBLOX
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\asshurt\multiple_roblox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2328"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\[Snipcola] Asshurt.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2832"C:\Users\admin\Desktop\Asshurt\Asshurt.exe" C:\Users\admin\Desktop\Asshurt\Asshurt.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
AssHurt
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\asshurt\asshurt.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3464"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3764"C:\Users\admin\Desktop\Asshurt\Gravity_Switch.exe" C:\Users\admin\Desktop\Asshurt\Gravity_Switch.exe—explorer.exe
User:
admin
Company:
WeAreDevs
Integrity Level:
MEDIUM
Description:
Infinite Jump
Exit code:
3221225547
Version:
1.0.3.0
Modules
Images
c:\users\admin\desktop\asshurt\gravity_switch.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
940
Read events
905
Write events
34
Delete events
1

Modification events

(PID) Process:(2328) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2328) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2328) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2328) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\[Snipcola] Asshurt.rar
(PID) Process:(2328) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2328) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2328) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2328) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2328) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\DialogEditHistory\ExtrPath
Operation:writeName:0
Value:
C:\Users\admin\Desktop
(PID) Process:(2328) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
Executable files
12
Suspicious files
2
Text files
1 193
Unknown types
1

Dropped files

PID
Process
Filename
Type
2328WinRAR.exeC:\Users\admin\Desktop\Asshurt\FastColoredTextBox.dllexecutable
MD5:8610F4D3CDC6CC50022FEDDCED9FDAEB
SHA256:AC926C92CCFC3789A5AE571CC4415EB1897D500A79604D8495241C19ACDF01B9
2328WinRAR.exeC:\Users\admin\Desktop\Asshurt\Asshurt.exeexecutable
MD5:5F2630506F57B492AA0FEA7B8B752337
SHA256:297D0B5D8102C5B6646D48688D928031D4CCC8E4400434638406383ADB7E78BB
2328WinRAR.exeC:\Users\admin\Desktop\Asshurt\Monaco\Monaco.htmlhtml
MD5:999896134BD43CEFA865F37E514BA62F
SHA256:1ECDD9529EF5487F92736894D94FF680F6C32EE821615D29C0FC814F3A310B4A
2328WinRAR.exeC:\Users\admin\Desktop\Asshurt\MetroFramework.Design.dllexecutable
MD5:AB4C3529694FC8D2427434825F71B2B8
SHA256:0A4A96082E25767E4697033649B16C76A652E120757A2CECAB8092AD0D716B65
2328WinRAR.exeC:\Users\admin\Desktop\Asshurt\Monaco\base.txttext
MD5:0D834904A252E1AB786F9637BEF6819F
SHA256:DBE440C5DEE6367EBCA919886FFE593246E1E52618E4713373000C9FC77C87CC
2328WinRAR.exeC:\Users\admin\Desktop\Asshurt\Monaco\vs\base\worker\workerMain.jstext
MD5:27EAD90C7702154755785E0E53398755
SHA256:BDF9433692A08851E13DD58504EEF19F51BD2EC7241923A68EDF5772E0E53AF5
2328WinRAR.exeC:\Users\admin\Desktop\Asshurt\Monaco\classfunc.txttext
MD5:BF32E93D11011EB780619B3E17FB824A
SHA256:519DA000DE235C331F10660509FAB51A1815ACE566B8AE5B511B75813922DCB1
2328WinRAR.exeC:\Users\admin\Desktop\Asshurt\MetroFramework.dllexecutable
MD5:34EA7F7D66563F724318E322FF08F4DB
SHA256:C2C12D31B4844E29DE31594FC9632A372A553631DE0A0A04C8AF91668E37CF49
2328WinRAR.exeC:\Users\admin\Desktop\Asshurt\Monaco\globalv.txttext
MD5:5CF9F238D4E62C8BCDE351651C3A2A45
SHA256:EEB98F2C9911AE8DDD25F1B3BE3732000F16788BDA60AA962E9F8452012B1062
2328WinRAR.exeC:\Users\admin\Desktop\Asshurt\Monaco\vs\basic-languages\coffee\coffee.jstext
MD5:9D0C4AC1691EED0A480C3E9246490D29
SHA256:E706C9F8E5C5A0CB01B2F4E4879EC34A050D6EB2A8840284EB7BADD9D78099F9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
[Snipcola] Asshurt.rar