File name:

Office.2013-2019.C2R.Install+Lite.v7.0.7.b12-Ratiborus.rar

Full analysis: https://app.any.run/tasks/902fc722-2450-47f5-a6f4-22c947215655
Verdict: Malicious activity
Analysis date: February 06, 2021, 14:21:55
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v4, os: Win32
MD5:

E10279E2D3D3A285231FCB5619115CA0

SHA1:

26E68EDE7E32890707447EA674787EDABC959DE8

SHA256:

EB620601F791ECD902DC97EC51BA700A78624F8C3C0429AC74559CF05C03FB7F

SSDEEP:

393216:i2lYBwoEhK3PzVWzzM115HHkKlBnEVh6mUbBweBx+bkoEjaiVpRt0at20:ioYBzEhK3Pz4ABHkKrG0NzqkosvNt3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • OInstall.exe (PID: 2772)
      • OInstall.exe (PID: 832)
      • OfficeClickToRun.exe (PID: 972)
      • OfficeClickToRun.exe (PID: 3964)

    • Drops executable file immediately after starts

      • OInstall.exe (PID: 2772)
      • OfficeClickToRun.exe (PID: 3964)

    • Loads dropped or rewritten executable

      • OfficeClickToRun.exe (PID: 972)
      • OfficeClickToRun.exe (PID: 3964)

    • Changes settings of System certificates

      • OfficeClickToRun.exe (PID: 972)
      • OfficeClickToRun.exe (PID: 3964)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2364)
      • OInstall.exe (PID: 2772)
      • expand.exe (PID: 272)
      • OfficeClickToRun.exe (PID: 3964)

    • Drops a file that was compiled in debug mode

      • WinRAR.exe (PID: 2364)
      • OInstall.exe (PID: 2772)
      • expand.exe (PID: 272)
      • OfficeClickToRun.exe (PID: 3964)

    • Uses REG.EXE to modify Windows registry

      • OInstall.exe (PID: 2772)

    • Creates files in the user directory

      • powershell.exe (PID: 604)
      • powershell.exe (PID: 2204)
      • powershell.exe (PID: 1772)
      • powershell.exe (PID: 3688)

    • Executes PowerShell scripts

      • OInstall.exe (PID: 2772)

    • Creates files in the Windows directory

      • expand.exe (PID: 3648)
      • OfficeClickToRun.exe (PID: 3964)

    • Creates files in the program directory

      • expand.exe (PID: 272)
      • expand.exe (PID: 3460)
      • OfficeClickToRun.exe (PID: 3964)

    • Creates a directory in Program Files

      • OInstall.exe (PID: 2772)
      • expand.exe (PID: 272)
      • expand.exe (PID: 3460)
      • OfficeClickToRun.exe (PID: 3964)

    • Drops a file with a compile date too recent

      • expand.exe (PID: 272)
      • OfficeClickToRun.exe (PID: 3964)

    • Drops a file with too old compile date

      • expand.exe (PID: 272)

    • Executed as Windows Service

      • OfficeClickToRun.exe (PID: 3964)

    • Adds / modifies Windows certificates

      • OfficeClickToRun.exe (PID: 972)
      • OfficeClickToRun.exe (PID: 3964)

    • Removes files from Windows directory

      • OfficeClickToRun.exe (PID: 3964)

  • INFO

    • Manual execution by user

      • OInstall.exe (PID: 832)
      • OInstall.exe (PID: 2772)

    • Reads Microsoft Office registry keys

      • OfficeClickToRun.exe (PID: 972)
      • OfficeClickToRun.exe (PID: 3964)

    • Reads settings of System Certificates

      • OfficeClickToRun.exe (PID: 972)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v-4.x) (58.3)
.rar | RAR compressed archive (gen) (41.6)

EXIF

ZIP

CompressedSize: 413
UncompressedSize: 882
OperatingSystem: Win32
ModifyDate: 2020:10:13 13:30:00
PackingMethod: Normal
ArchivedFileName: Office.2013-2019.C2R.Install+Lite.v7.0.7.b12-Ratiborus\files\Configure.xml
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
60
Monitored processes
13
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe oinstall.exe no specs oinstall.exe reg.exe no specs powershell.exe expand.exe no specs powershell.exe no specs powershell.exe expand.exe powershell.exe expand.exe no specs officeclicktorun.exe officeclicktorun.exe

Process information

PID
CMD
Path
Indicators
Parent process
272"expand" i320.cab -F:* "C:\Program Files\Common Files\microsoft Shared\ClickToRun"C:\Windows\system32\expand.exe
OInstall.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
LZ Expansion Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\expand.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\cabinet.dll
604"powershell" -command "& { (New-Object Net.WebClient).DownloadFile('http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32.cab', 'C:\Users\admin\AppData\Local\Temp\over762219\v32.cab') }"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
OInstall.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
832"C:\Users\admin\Desktop\o\OInstall.exe" C:\Users\admin\Desktop\o\OInstall.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Office 2013-2019 C2R Install
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\office.2013-2019.c2r.install+lite.v7.0.7.b12-ratiborus\oinstall.exe
c:\systemroot\system32\ntdll.dll
972"C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe" deliverymechanism=492350f6-3a01-4f97-b9c0-c7c6ddf67d60 platform=x86 productreleaseid=none culture=de-de defaultplatform=False lcid=1031 b= storeid= forceupgrade=True piniconstotaskbar=False pidkeys=6NWWJ-YQWMR-QKGCB-6TMB3-9D9HK forceappshutdown=True autoactivate=1 productstoadd=Standard2019Volume.16_de-de_x-none scenario=unknown updatesenabled.16=True acceptalleulas.16=True cdnbaseurl.16=http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60 version.16=16.0.13628.20274 mediatype.16=CDN baseurl.16=http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60 sourcetype.16=CDN displaylevel=True uninstallpreviousversion=True Standard2019Volume.excludedapps.16=publisher,groove,onedrive,teamsC:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
OInstall.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Office Click-to-Run (SxS)
Exit code:
0
Version:
16.0.13628.20258
Modules
Images
c:\program files\common files\microsoft shared\clicktorun\officeclicktorun.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1772"powershell" -command "& { (New-Object Net.WebClient).DownloadFile('http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/16.0.13628.20274/i320.cab', 'C:\Users\admin\AppData\Local\Temp\over762219\i320.cab') }"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
OInstall.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2160"C:\Windows\System32\reg.exe" add HKLM\Software\Policies\Microsoft\Office\16.0\Common\OfficeUpdate /v UpdateBranch /d Current /fC:\Windows\System32\reg.exe—OInstall.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2204"powershell" -command "& { Get-Content C:\Users\admin\AppData\Local\Temp\over762219\VersionDescriptor.xml | Set-Content -Encoding ASCII v32.txt }C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—OInstall.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2364"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Office.2013-2019.C2R.Install+Lite.v7.0.7.b12-Ratiborus.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2772"C:\Users\admin\Desktop\o\OInstall.exe" C:\Users\admin\Desktop\o\OInstall.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
Office 2013-2019 C2R Install
Exit code:
0
Modules
Images
c:\users\admin\desktop\office.2013-2019.c2r.install+lite.v7.0.7.b12-ratiborus\oinstall.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\gdi32.dll
3460"expand" i321031.cab -F:* "C:\Program Files\Common Files\microsoft Shared\ClickToRun"C:\Windows\system32\expand.exe—OInstall.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
LZ Expansion Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\expand.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\cabinet.dll
Total events
1 962
Read events
1 539
Write events
423
Delete events
0

Modification events

(PID) Process:(2364) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2364) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2364) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2364) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Office.2013-2019.C2R.Install+Lite.v7.0.7.b12-Ratiborus.rar
(PID) Process:(2364) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2364) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2364) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2364) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2364) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
(PID) Process:(2364) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\General
Operation:writeName:LastFolder
Value:
C:\Users\admin\AppData\Local\Temp
Executable files
112
Suspicious files
11
Text files
23
Unknown types
2

Dropped files

PID
Process
Filename
Type
604powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\DQ8MQ194SFG35PLVSO9V.temp —
MD5:—
SHA256:—
3648expand.exeC:\Users\admin\AppData\Local\Temp\over762219\$dpx$.tmp\458e11e9463cd44b9617a6a74de521cc.tmp —
MD5:—
SHA256:—
3648expand.exeC:\Windows\Logs\DPX\setuperr.log —
MD5:—
SHA256:—
2204powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\GSO1B4RUYTS2H5RTCEQC.temp —
MD5:—
SHA256:—
2364WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2364.19036\Office.2013-2019.C2R.Install+Lite.v7.0.7.b12-Ratiborus\OInstall.exeexecutable
MD5:—
SHA256:—
604powershell.exeC:\Users\admin\AppData\Local\Temp\over762219\v32.cabcompressed
MD5:—
SHA256:—
1772powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\7PQG2BIJK3PW5K4QLTR9.temp —
MD5:—
SHA256:—
2364WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2364.19036\Office.2013-2019.C2R.Install+Lite.v7.0.7.b12-Ratiborus\Install.nfotext
MD5:—
SHA256:—
604powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFdd0be.TMPbinary
MD5:—
SHA256:—
1772powershell.exeC:\Users\admin\AppData\Local\Temp\over762219\i320.cab —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
10
DNS requests
7
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
604
powershell.exe
GET
301
104.76.200.56:80
http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32.cab
NL
—
—
whitelisted
1772
powershell.exe
GET
301
104.76.200.56:80
http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/16.0.13628.20274/i320.cab
NL
—
—
whitelisted
3688
powershell.exe
GET
200
2.16.106.224:80
http://officecdn.microsoft.com.edgesuite.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/16.0.13628.20274/i321031.cab
unknown
compressed
8.69 Kb
whitelisted
1772
powershell.exe
GET
200
2.16.106.224:80
http://officecdn.microsoft.com.edgesuite.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/16.0.13628.20274/i320.cab
unknown
compressed
24.0 Mb
whitelisted
3964
OfficeClickToRun.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D
US
der
471 b
whitelisted
3688
powershell.exe
GET
301
104.76.200.56:80
http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/16.0.13628.20274/i321031.cab
NL
—
—
whitelisted
604
powershell.exe
GET
200
2.16.106.224:80
http://officecdn.microsoft.com.edgesuite.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32.cab
unknown
compressed
9.68 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
604
powershell.exe
2.16.106.224:80
officecdn.microsoft.com.edgesuite.net
Akamai International B.V.
—
whitelisted
604
powershell.exe
104.76.200.56:80
officecdn.microsoft.com
Telia Company AB
NL
unknown
1772
powershell.exe
2.16.106.224:80
officecdn.microsoft.com.edgesuite.net
Akamai International B.V.
—
whitelisted
1772
powershell.exe
104.76.200.56:80
officecdn.microsoft.com
Telia Company AB
NL
unknown
—
—
2.16.106.224:80
officecdn.microsoft.com.edgesuite.net
Akamai International B.V.
—
whitelisted
972
OfficeClickToRun.exe
52.113.194.132:443
ecs.office.com
Microsoft Corporation
US
suspicious
3964
OfficeClickToRun.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3964
OfficeClickToRun.exe
52.113.194.132:443
ecs.office.com
Microsoft Corporation
US
suspicious
—
—
104.76.200.56:80
officecdn.microsoft.com
Telia Company AB
NL
unknown
3964
OfficeClickToRun.exe
52.114.88.20:443
self.events.data.microsoft.com
Microsoft Corporation
GB
whitelisted

DNS requests

Domain
IP
Reputation
officecdn.microsoft.com
  • 104.76.200.56
whitelisted
officecdn.microsoft.com.edgesuite.net
  • 2.16.106.224
  • 2.16.106.194
whitelisted
ecs.office.com
  • 52.113.194.132
whitelisted
self.events.data.microsoft.com
  • 52.114.88.20
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Office.2013-2019.C2R.Install+Lite.v7.0.7.b12-Ratiborus.rar