File name:

7.zip

Full analysis: https://app.any.run/tasks/052e6a20-a634-4163-8e0c-dc634a6740cb
Verdict: Malicious activity
Analysis date: April 15, 2019, 08:05:27
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

F7F30099CA5CBE3853090134D56A0BFD

SHA1:

C973C70B86962D27A10045084A0D5B017FB44AFF

SHA256:

EA45459A7C3BE7EB3613661CB42874802B13CA6E035C043DF0DBD526819DCD94

SSDEEP:

1536:p6Ht6noQT8N9YBnP4FIhHow4jcW/7sI30DldIpbmhiF/xxFgXMKIsl8MkMMdVTim:p6HtOoP9onNWjBjsIcdiO8/6pKVTiD7W

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes settings of System certificates

      • B3RAP HQXies.exe (PID: 3924)

  • SUSPICIOUS

    • Adds / modifies Windows certificates

      • B3RAP HQXies.exe (PID: 3924)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2019:04:14 14:21:17
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: B3RAP HQXies v0.1/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
2
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe no specs b3rap hqxies.exe

Process information

PID
CMD
Path
Indicators
Parent process
2980"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\7.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3924"C:\Users\admin\Desktop\B3RAP HQXies v0.1\B3RAP HQXies.exe" C:\Users\admin\Desktop\B3RAP HQXies v0.1\B3RAP HQXies.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
B3RAP HQXies
Exit code:
3221225786
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\b3rap hqxies v0.1\b3rap hqxies.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
476
Read events
443
Write events
33
Delete events
0

Modification events

(PID) Process:(2980) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2980) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2980) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2980) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\7.zip
(PID) Process:(2980) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2980) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2980) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2980) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3924) B3RAP HQXies.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\B3RAP HQXies_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3924) B3RAP HQXies.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\B3RAP HQXies_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
0
Suspicious files
4
Text files
544
Unknown types
0

Dropped files

PID
Process
Filename
Type
2980WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2980.6198\B3RAP HQXies v0.1\B3RAP HQXies.exe —
MD5:—
SHA256:—
2980WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2980.6198\B3RAP HQXies v0.1\config.txt —
MD5:—
SHA256:—
2980WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2980.6198\B3RAP HQXies v0.1\xNet.dll —
MD5:—
SHA256:—
3924B3RAP HQXies.exeC:\Users\admin\AppData\Local\Temp\Cab6C98.tmp —
MD5:—
SHA256:—
3924B3RAP HQXies.exeC:\Users\admin\AppData\Local\Temp\Tar6C99.tmp —
MD5:—
SHA256:—
3924B3RAP HQXies.exeC:\Users\admin\AppData\Local\Temp\Cab6CC9.tmp —
MD5:—
SHA256:—
3924B3RAP HQXies.exeC:\Users\admin\AppData\Local\Temp\Tar6CCA.tmp —
MD5:—
SHA256:—
3924B3RAP HQXies.exeC:\Users\admin\AppData\Local\Temp\Cab6E71.tmp —
MD5:—
SHA256:—
3924B3RAP HQXies.exeC:\Users\admin\AppData\Local\Temp\Tar6E72.tmp —
MD5:—
SHA256:—
3924B3RAP HQXies.exeC:\Users\admin\Desktop\B3RAP HQXies v0.1\Live.txttext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
737
TCP/UDP connections
870
DNS requests
2
Threats
674

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3924
B3RAP HQXies.exe
CONNECT
—
94.159.36.190:8080
http://94.159.36.190:8080steamcommunity.com:443
RU
—
—
unknown
3924
B3RAP HQXies.exe
CONNECT
—
46.99.255.235:8080
http://46.99.255.235:8080steamcommunity.com:443
AL
—
—
unknown
3924
B3RAP HQXies.exe
CONNECT
—
197.216.2.9:8080
http://197.216.2.9:8080steamcommunity.com:443
AO
—
—
unknown
3924
B3RAP HQXies.exe
CONNECT
—
104.248.147.41:8080
http://104.248.147.41:8080steamcommunity.com:443
US
—
—
unknown
3924
B3RAP HQXies.exe
CONNECT
—
124.13.201.112:8080
http://124.13.201.112:8080steamcommunity.com:443
MY
—
—
unknown
3924
B3RAP HQXies.exe
CONNECT
—
188.214.232.2:8080
http://188.214.232.2:8080steamcommunity.com:443
IR
—
—
unknown
3924
B3RAP HQXies.exe
CONNECT
—
179.95.234.146:80
http://179.95.234.146:80steamcommunity.com:443
BR
—
—
unknown
3924
B3RAP HQXies.exe
CONNECT
—
115.127.91.106:8080
http://115.127.91.106:8080steamcommunity.com:443
BD
—
—
unknown
3924
B3RAP HQXies.exe
CONNECT
—
195.46.171.210:8080
http://195.46.171.210:8080steamcommunity.com:443
RU
—
—
unknown
3924
B3RAP HQXies.exe
CONNECT
—
167.99.197.24:8080
http://167.99.197.24:8080steamcommunity.com:443
US
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3924
B3RAP HQXies.exe
104.28.5.69:443
api.proxyscrape.com
Cloudflare Inc
US
shared
3924
B3RAP HQXies.exe
120.28.43.66:8080
—
Globe Telecoms
PH
unknown
3924
B3RAP HQXies.exe
118.174.220.11:60148
—
TOT Public Company Limited
TH
unknown
3924
B3RAP HQXies.exe
109.199.147.163:51506
—
Telnet Limited
BG
unknown
3924
B3RAP HQXies.exe
150.109.40.88:8888
—
—
US
unknown
3924
B3RAP HQXies.exe
62.249.140.198:41555
—
Closed Joint Stock Company TransTeleCom
RU
unknown
3924
B3RAP HQXies.exe
92.52.204.23:55216
—
EszakNet Kft.
HU
unknown
3924
B3RAP HQXies.exe
103.9.188.219:32861
—
EZECOM limited
KH
unknown
3924
B3RAP HQXies.exe
101.109.255.97:50580
—
TOT Public Company Limited
TH
unknown
3924
B3RAP HQXies.exe
195.77.80.154:42402
—
Telefonica De Espana
ES
unknown

DNS requests

Domain
IP
Reputation
api.proxyscrape.com
  • 104.28.5.69
  • 104.28.4.69
suspicious
www.download.windowsupdate.com
  • 93.184.221.240
whitelisted

Threats

PID
Process
Class
Message
3924
B3RAP HQXies.exe
Generic Protocol Command Decode
SURICATA HTTP missing Host header
3924
B3RAP HQXies.exe
Generic Protocol Command Decode
SURICATA HTTP missing Host header
3924
B3RAP HQXies.exe
Generic Protocol Command Decode
SURICATA HTTP missing Host header
3924
B3RAP HQXies.exe
Generic Protocol Command Decode
SURICATA HTTP missing Host header
3924
B3RAP HQXies.exe
Generic Protocol Command Decode
SURICATA HTTP missing Host header
3924
B3RAP HQXies.exe
Generic Protocol Command Decode
SURICATA HTTP missing Host header
3924
B3RAP HQXies.exe
Generic Protocol Command Decode
SURICATA HTTP missing Host header
3924
B3RAP HQXies.exe
Generic Protocol Command Decode
SURICATA HTTP missing Host header
3924
B3RAP HQXies.exe
Generic Protocol Command Decode
SURICATA HTTP missing Host header
3924
B3RAP HQXies.exe
Generic Protocol Command Decode
SURICATA HTTP missing Host header
No debug info