File name:

[Snipcola] Asshurt.rar

Full analysis: https://app.any.run/tasks/d061b1c5-19b5-451a-a233-cab82c62f71d
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: December 29, 2019, 21:00:59
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ransomware
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

A7C000EA7C4EE80888EC8C9A3C5F8BEF

SHA1:

073BAFD906161B35D39777B122D7874288EDF895

SHA256:

E852C2FEB1CDED5D8CF161BF3530E1DED83661841BACB85ABF7011ECDC8F3FB8

SSDEEP:

393216:Vth8C7sZoTrefEP+GfvKiNi1Gm9GmxDpIm4NoyNHBHF4nCIto:f6o7+iKiNixDpt4NFNHBHSnCIm

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Asshurt.exe (PID: 2832)
      • Multiple_ROBLOX.exe (PID: 2284)
      • Gravity_Switch.exe (PID: 3764)

    • Dropped file may contain instructions of ransomware

      • WinRAR.exe (PID: 2328)

    • Loads dropped or rewritten executable

      • Asshurt.exe (PID: 2832)
      • SearchProtocolHost.exe (PID: 3464)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2328)

    • Changes IE settings (feature browser emulation)

      • Asshurt.exe (PID: 2832)

    • Reads internet explorer settings

      • Asshurt.exe (PID: 2832)

    • Reads Internet Cache Settings

      • Asshurt.exe (PID: 2832)

  • INFO

    • Manual execution by user

      • Asshurt.exe (PID: 2832)
      • Multiple_ROBLOX.exe (PID: 2284)
      • Gravity_Switch.exe (PID: 3764)

    • Dropped object may contain Bitcoin addresses

      • WinRAR.exe (PID: 2328)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
5
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe asshurt.exe no specs searchprotocolhost.exe no specs multiple_roblox.exe no specs gravity_switch.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2284"C:\Users\admin\Desktop\Asshurt\Multiple_ROBLOX.exe" C:\Users\admin\Desktop\Asshurt\Multiple_ROBLOX.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Multiple ROBLOX
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\asshurt\multiple_roblox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2328"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\[Snipcola] Asshurt.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2832"C:\Users\admin\Desktop\Asshurt\Asshurt.exe" C:\Users\admin\Desktop\Asshurt\Asshurt.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
AssHurt
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\asshurt\asshurt.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3464"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3764"C:\Users\admin\Desktop\Asshurt\Gravity_Switch.exe" C:\Users\admin\Desktop\Asshurt\Gravity_Switch.exe—explorer.exe
User:
admin
Company:
WeAreDevs
Integrity Level:
MEDIUM
Description:
Infinite Jump
Exit code:
3221225547
Version:
1.0.3.0
Modules
Images
c:\users\admin\desktop\asshurt\gravity_switch.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
940
Read events
905
Write events
34
Delete events
1

Modification events

(PID) Process:(2328) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2328) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2328) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2328) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\[Snipcola] Asshurt.rar
(PID) Process:(2328) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2328) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2328) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2328) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2328) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\DialogEditHistory\ExtrPath
Operation:writeName:0
Value:
C:\Users\admin\Desktop
(PID) Process:(2328) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
Executable files
12
Suspicious files
2
Text files
1 193
Unknown types
1

Dropped files

PID
Process
Filename
Type
2328WinRAR.exeC:\Users\admin\Desktop\Asshurt\MetroFramework.dllexecutable
MD5:34EA7F7D66563F724318E322FF08F4DB
SHA256:C2C12D31B4844E29DE31594FC9632A372A553631DE0A0A04C8AF91668E37CF49
2328WinRAR.exeC:\Users\admin\Desktop\Asshurt\Monaco\globalf.txttext
MD5:1700DF0210CDA593D3DF64F51B3CAAEA
SHA256:DEAE98F86C62749E4B642ACB41EA5DFCE0CAF09BC77036AAE82EE814A04ED9E0
2328WinRAR.exeC:\Users\admin\Desktop\Asshurt\Bunifu_UI_v1.5.3.dllexecutable
MD5:E0EF2817EE5A7C8CD1EB837195768BD2
SHA256:76E1D3EC95FDEF74ABAF90392DD6F4AA5E344922ABF11E572707287D467F2930
2328WinRAR.exeC:\Users\admin\Desktop\Asshurt\MetroFramework.Design.dllexecutable
MD5:AB4C3529694FC8D2427434825F71B2B8
SHA256:0A4A96082E25767E4697033649B16C76A652E120757A2CECAB8092AD0D716B65
2328WinRAR.exeC:\Users\admin\Desktop\Asshurt\Gravity_Switch.exeexecutable
MD5:A6CEAF8E4B44B37A7487A9152B9514C3
SHA256:3C9DD88809C6BFD1FB9439DBB4C5859DCA2A50918695443A85D3E118705ADB47
2328WinRAR.exeC:\Users\admin\Desktop\Asshurt\Monaco\classfunc.txttext
MD5:BF32E93D11011EB780619B3E17FB824A
SHA256:519DA000DE235C331F10660509FAB51A1815ACE566B8AE5B511B75813922DCB1
2328WinRAR.exeC:\Users\admin\Desktop\Asshurt\MetroFramework.Fonts.dllexecutable
MD5:65EF4B23060128743CEF937A43B82AA3
SHA256:C843869AACA5135C2D47296985F35C71CA8AF4431288D04D481C4E46CC93EE26
2328WinRAR.exeC:\Users\admin\Desktop\Asshurt\FastColoredTextBox.dllexecutable
MD5:8610F4D3CDC6CC50022FEDDCED9FDAEB
SHA256:AC926C92CCFC3789A5AE571CC4415EB1897D500A79604D8495241C19ACDF01B9
2328WinRAR.exeC:\Users\admin\Desktop\Asshurt\Monaco\base.txttext
MD5:0D834904A252E1AB786F9637BEF6819F
SHA256:DBE440C5DEE6367EBCA919886FFE593246E1E52618E4713373000C9FC77C87CC
2328WinRAR.exeC:\Users\admin\Desktop\Asshurt\Monaco\vs\basic-languages\coffee\coffee.jstext
MD5:9D0C4AC1691EED0A480C3E9246490D29
SHA256:E706C9F8E5C5A0CB01B2F4E4879EC34A050D6EB2A8840284EB7BADD9D78099F9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
[Snipcola] Asshurt.rar