File name:

[Snipcola] Asshurt.rar

Full analysis: https://app.any.run/tasks/d061b1c5-19b5-451a-a233-cab82c62f71d
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: December 29, 2019, 21:00:59
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ransomware
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

A7C000EA7C4EE80888EC8C9A3C5F8BEF

SHA1:

073BAFD906161B35D39777B122D7874288EDF895

SHA256:

E852C2FEB1CDED5D8CF161BF3530E1DED83661841BACB85ABF7011ECDC8F3FB8

SSDEEP:

393216:Vth8C7sZoTrefEP+GfvKiNi1Gm9GmxDpIm4NoyNHBHF4nCIto:f6o7+iKiNixDpt4NFNHBHSnCIm

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Asshurt.exe (PID: 2832)
      • Gravity_Switch.exe (PID: 3764)
      • Multiple_ROBLOX.exe (PID: 2284)

    • Dropped file may contain instructions of ransomware

      • WinRAR.exe (PID: 2328)

    • Loads dropped or rewritten executable

      • Asshurt.exe (PID: 2832)
      • SearchProtocolHost.exe (PID: 3464)

  • SUSPICIOUS

    • Changes IE settings (feature browser emulation)

      • Asshurt.exe (PID: 2832)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2328)

    • Reads internet explorer settings

      • Asshurt.exe (PID: 2832)

    • Reads Internet Cache Settings

      • Asshurt.exe (PID: 2832)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • WinRAR.exe (PID: 2328)

    • Manual execution by user

      • Asshurt.exe (PID: 2832)
      • Gravity_Switch.exe (PID: 3764)
      • Multiple_ROBLOX.exe (PID: 2284)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
5
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe asshurt.exe no specs searchprotocolhost.exe no specs multiple_roblox.exe no specs gravity_switch.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2284"C:\Users\admin\Desktop\Asshurt\Multiple_ROBLOX.exe" C:\Users\admin\Desktop\Asshurt\Multiple_ROBLOX.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Multiple ROBLOX
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\asshurt\multiple_roblox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2328"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\[Snipcola] Asshurt.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2832"C:\Users\admin\Desktop\Asshurt\Asshurt.exe" C:\Users\admin\Desktop\Asshurt\Asshurt.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
AssHurt
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\asshurt\asshurt.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3464"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3764"C:\Users\admin\Desktop\Asshurt\Gravity_Switch.exe" C:\Users\admin\Desktop\Asshurt\Gravity_Switch.exe—explorer.exe
User:
admin
Company:
WeAreDevs
Integrity Level:
MEDIUM
Description:
Infinite Jump
Exit code:
3221225547
Version:
1.0.3.0
Modules
Images
c:\users\admin\desktop\asshurt\gravity_switch.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
940
Read events
905
Write events
34
Delete events
1

Modification events

(PID) Process:(2328) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2328) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2328) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2328) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\[Snipcola] Asshurt.rar
(PID) Process:(2328) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2328) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2328) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2328) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2328) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\DialogEditHistory\ExtrPath
Operation:writeName:0
Value:
C:\Users\admin\Desktop
(PID) Process:(2328) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
Executable files
12
Suspicious files
2
Text files
1 193
Unknown types
1

Dropped files

PID
Process
Filename
Type
2328WinRAR.exeC:\Users\admin\Desktop\Asshurt\Monaco\classfunc.txttext
MD5:BF32E93D11011EB780619B3E17FB824A
SHA256:519DA000DE235C331F10660509FAB51A1815ACE566B8AE5B511B75813922DCB1
2328WinRAR.exeC:\Users\admin\Desktop\Asshurt\Gravity_Switch.exeexecutable
MD5:A6CEAF8E4B44B37A7487A9152B9514C3
SHA256:3C9DD88809C6BFD1FB9439DBB4C5859DCA2A50918695443A85D3E118705ADB47
2328WinRAR.exeC:\Users\admin\Desktop\Asshurt\Bunifu_UI_v1.5.3.dllexecutable
MD5:E0EF2817EE5A7C8CD1EB837195768BD2
SHA256:76E1D3EC95FDEF74ABAF90392DD6F4AA5E344922ABF11E572707287D467F2930
2328WinRAR.exeC:\Users\admin\Desktop\Asshurt\Monaco\globalv.txttext
MD5:5CF9F238D4E62C8BCDE351651C3A2A45
SHA256:EEB98F2C9911AE8DDD25F1B3BE3732000F16788BDA60AA962E9F8452012B1062
2328WinRAR.exeC:\Users\admin\Desktop\Asshurt\Monaco\base.txttext
MD5:0D834904A252E1AB786F9637BEF6819F
SHA256:DBE440C5DEE6367EBCA919886FFE593246E1E52618E4713373000C9FC77C87CC
2328WinRAR.exeC:\Users\admin\Desktop\Asshurt\Monaco\Monaco.htmlhtml
MD5:999896134BD43CEFA865F37E514BA62F
SHA256:1ECDD9529EF5487F92736894D94FF680F6C32EE821615D29C0FC814F3A310B4A
2328WinRAR.exeC:\Users\admin\Desktop\Asshurt\Monaco\globalns.txttext
MD5:BA56C14634B7AE6FB585BE396ACF5F03
SHA256:5CB987E7C87F2F04CDD45F3A474FB2380BBF846534E38F2B485EAFC562B7B482
2328WinRAR.exeC:\Users\admin\Desktop\Asshurt\Monaco\vs\basic-languages\cpp\cpp.jstext
MD5:0A16509E6CD0155FB622E785CFE976C7
SHA256:A7C2BEA7CA3D9E203A3A286735945FE010C8F4F8D46620386EE8BEFC6A78B32B
2328WinRAR.exeC:\Users\admin\Desktop\Asshurt\Monaco\vs\base\worker\workerMain.jstext
MD5:27EAD90C7702154755785E0E53398755
SHA256:BDF9433692A08851E13DD58504EEF19F51BD2EC7241923A68EDF5772E0E53AF5
2328WinRAR.exeC:\Users\admin\Desktop\Asshurt\Monaco\vs\basic-languages\bat\bat.jstext
MD5:4CB475399C4490EEA41982DCD6D9653E
SHA256:9BCA42394FE8922FEC24B768EEB8CE04692DE6FAD82F9052D5B7E70F5C6B0F40
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
[Snipcola] Asshurt.rar