analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

necroa感染型病毒.rar

Full analysis: https://app.any.run/tasks/705b1670-2d73-4bbe-bed8-829b2b6e40b7
Verdict: Malicious activity
Analysis date: July 18, 2019, 10:37:15
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

37B705C2B628CE6008CAC1D01125D4D8

SHA1:

89243D34A2B32C802431EEA2AD273D8BA3AD1696

SHA256:

EA425F0499137D848FEBC53FB6925BFFC929DC819530E8D3853BA1184A44B464

SSDEEP:

6144:G+cn+FuKzLDDYJOlS2+Cfkj5ME1Jggl6q4hW8BrPob+Xory:G+c+AALDDlSXjK6ggl5SrPob+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • regedit.exe (PID: 2348)

    • Application was dropped or rewritten from another process

      • necroa感染型病毒.exe (PID: 3760)

    • Starts NET.EXE for service management

      • cmd.exe (PID: 2328)

    • Starts NET.EXE to view/add/change user profiles

      • cmd.exe (PID: 2328)

    • Starts NET.EXE to view/change users group

      • cmd.exe (PID: 2328)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3516)
      • cmd.exe (PID: 2328)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 2328)

    • Uses RUNDLL32.EXE to load library

      • cmd.exe (PID: 2328)

    • Modifies the open verb of a shell class

      • regedit.exe (PID: 2348)

    • Uses WMIC.EXE to obtain a system information

      • cmd.exe (PID: 2328)

    • Starts CMD.EXE for commands execution

      • necroa感染型病毒.exe (PID: 3760)

    • Creates files in the Windows directory

      • cmd.exe (PID: 2328)

  • INFO

    • Manual execution by user

      • necroa感染型病毒.exe (PID: 3760)
      • mmc.exe (PID: 3676)
      • mmc.exe (PID: 2280)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
75
Monitored processes
29
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe necroa感染型病毒.exe cmd.exe sc.exe no specs net.exe no specs net1.exe no specs sc.exe no specs net.exe no specs net1.exe no specs sc.exe no specs net.exe no specs net1.exe no specs sc.exe no specs net.exe no specs net1.exe no specs sc.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs rundll32.exe no specs regedit.exe wmic.exe mmc.exe no specs mmc.exe

Process information

PID
CMD
Path
Indicators
Parent process
3516"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Downloads\necroa感染型病毒.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
3760"C:\Users\admin\Desktop\necroa感染型病毒.exe" C:\Users\admin\Desktop\necroa感染型病毒.exe
explorer.exe
User:
admin
Company:
瘟疫公司
Integrity Level:
HIGH
Description:
necroa
Version:
1. 0. 0. 0
2328cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\0PVN636D.bat" "C:\Users\admin\Desktop\necroa?????.exe" "C:\Windows\system32\cmd.exe
necroa感染型病毒.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3008SC config 360rp START= DISABLEDC:\Windows\system32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
1060
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3232net stop 360rpC:\Windows\system32\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3592C:\Windows\system32\net1 stop 360rpC:\Windows\system32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
2
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2436SC config DHCP START= AUTOC:\Windows\system32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2472net start DHCPC:\Windows\system32\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2816C:\Windows\system32\net1 start DHCPC:\Windows\system32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
2
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1688SC config LanmanServer START= AUTOC:\Windows\system32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
1 261
Read events
1 114
Write events
0
Delete events
0

Modification events

No data
Executable files
6
Suspicious files
0
Text files
8
Unknown types
5

Dropped files

PID
Process
Filename
Type
4084rundll32.exeC:\Users\admin\AppData\Local\Temp\TP_5503.tmp —
MD5:—
SHA256:—
2328cmd.exeC:\windows\necroa.exeexecutable
MD5:97ED961D4B91A4215711F15F3C99B609
SHA256:1CD5EDBFD3CCDC7E9269497071E8A09D2385D78C0516D6B57A79030E7194ADC2
2328cmd.exeC:\╬┴╥▀╣½╦╛.exeexecutable
MD5:97ED961D4B91A4215711F15F3C99B609
SHA256:1CD5EDBFD3CCDC7E9269497071E8A09D2385D78C0516D6B57A79030E7194ADC2
3516WinRAR.exeC:\Users\admin\Desktop\necroa感染型病毒.exeexecutable
MD5:97ED961D4B91A4215711F15F3C99B609
SHA256:1CD5EDBFD3CCDC7E9269497071E8A09D2385D78C0516D6B57A79030E7194ADC2
4084rundll32.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Themes\necroa\necroa.themetext
MD5:362BB2CF8E35C80720C52A7B75C13D9E
SHA256:A650F07341FA2A4DBEEF9B73259BC2A8A32F8906850FC93310D333400B4AFAB1
2328cmd.exeC:\windows\necroa.themepackthemepack
MD5:DBA1F6BB24661C57D8E9D6B50DBFAC0A
SHA256:8DAD55C13D96E03E782D5700BB52CB225C9752CAABE717241F80108DB7B4ED2F
3760necroa感染型病毒.exeC:\Users\admin\AppData\Local\qb114EF8.BB\necroa.themepackthemepack
MD5:DBA1F6BB24661C57D8E9D6B50DBFAC0A
SHA256:8DAD55C13D96E03E782D5700BB52CB225C9752CAABE717241F80108DB7B4ED2F
3760necroa感染型病毒.exeC:\Users\admin\AppData\Local\qb114EF8.BB\autorun.infinf
MD5:2A8A0B06E620A06BD8F7D455F4ABC001
SHA256:864C3CBC87519F850860C2DD0B4DF5C981E6E174D679850A172BC6DE3C2B4734
2328cmd.exeC:\necroa.exeexecutable
MD5:97ED961D4B91A4215711F15F3C99B609
SHA256:1CD5EDBFD3CCDC7E9269497071E8A09D2385D78C0516D6B57A79030E7194ADC2
2328cmd.exeC:\windows\autorun.infinf
MD5:2A8A0B06E620A06BD8F7D455F4ABC001
SHA256:864C3CBC87519F850860C2DD0B4DF5C981E6E174D679850A172BC6DE3C2B4734
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
0
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3504
WMIC.exe
GET
404
149.28.76.165:80
http://149.28.76.165/host.xsl
US
xml
345 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3504
WMIC.exe
149.28.76.165:80
—
—
US
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
necroa感染型病毒.rar