File name:

H1N1 Loader.rar

Full analysis: https://app.any.run/tasks/7b2d0194-4a6d-448f-b1c9-ffd7a8d7dd6e
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Malware Trends Tracker     >>>
Analysis date: October 27, 2019, 17:18:53
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
h1n1
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

1186643A33AEF9A8074C9434EBBD4BA7

SHA1:

1AE4B0285291D35A3A52A59876A659F3B32B6477

SHA256:

EC4690B42E8A4035744842D10052F7FFB52568EAE0F02DF2CBC77C6F7D351FAD

SSDEEP:

24576:bMU5Ljq9BNjwGC/hsAdFKE641O2wuti9+WEp:3Ljq2L/hsAdFD6WO8t8q

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • builder.exe (PID: 2096)
      • build.exe (PID: 1216)
      • bthudtask.exe (PID: 1728)
      • build.exe (PID: 3772)

    • Changes the autorun value in the registry

      • explorer.exe (PID: 2944)

    • Loads dropped or rewritten executable

      • bthudtask.exe (PID: 1728)

    • Uses NET.EXE to stop Windows Defender service

      • cmd.exe (PID: 2580)

    • Starts NET.EXE for service management

      • cmd.exe (PID: 2580)
      • cmd.exe (PID: 2660)
      • cmd.exe (PID: 3152)

    • Uses NET.EXE to stop Windows Security Center service

      • cmd.exe (PID: 2660)

    • H1N1 was detected

      • iexplore.exe (PID: 2980)

    • Stops/Deletes Windows Defender service via SC.exe

      • cmd.exe (PID: 3704)

    • Uses NET.EXE to stop Windows Update service

      • cmd.exe (PID: 3152)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1296)
      • builder.exe (PID: 2096)
      • explorer.exe (PID: 2300)
      • DllHost.exe (PID: 2428)
      • explorer.exe (PID: 2944)

    • Executed via COM

      • DllHost.exe (PID: 2428)

    • Creates files in the Windows directory

      • DllHost.exe (PID: 2428)

    • Removes files from Windows directory

      • explorer.exe (PID: 2944)

    • Creates files in the user directory

      • explorer.exe (PID: 2300)
      • explorer.exe (PID: 2944)

    • Starts Internet Explorer

      • explorer.exe (PID: 2944)

    • Starts CMD.EXE for commands execution

      • explorer.exe (PID: 2944)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 1212)
      • cmd.exe (PID: 3376)

  • INFO

    • Manual execution by user

      • build.exe (PID: 1216)
      • builder.exe (PID: 2096)
      • iexplore.exe (PID: 3836)

    • Creates files in the user directory

      • iexplore.exe (PID: 2980)

    • Changes internet zones settings

      • iexplore.exe (PID: 3836)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3836)

    • Reads internet explorer settings

      • iexplore.exe (PID: 1400)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
79
Monitored processes
26
Malicious processes
8
Suspicious processes
4

Behavior graph

Click at the process to see the details
start winrar.exe builder.exe build.exe no specs explorer.exe Copy/Move/Rename/Delete/Link Object bthudtask.exe build.exe no specs explorer.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs #H1N1 iexplore.exe net.exe no specs sc.exe no specs sc.exe no specs net.exe no specs net.exe no specs sc.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs iexplore.exe iexplore.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
956net stop wuauservC:\Windows\system32\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\net.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\netutils.dll
c:\windows\system32\browcli.dll
1212cmd.exe /c sc config wscsvc start= disabledC:\Windows\system32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1216"C:\Users\admin\Desktop\H1N1 Loader\build.exe" C:\Users\admin\Desktop\H1N1 Loader\build.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\h1n1 loader\build.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1296"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\H1N1 Loader.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1400"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3836 CREDAT:79873C:\Program Files\Internet Explorer\iexplore.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\bthudtask.exe
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msctf.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\conhost.exe
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
1520sc config MpsSvc start= disabledC:\Windows\system32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1728"C:\Windows\System32\setup\bthudtask.exe" C:\Windows\System32\setup\bthudtask.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\windows\system32\setup\bthudtask.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
1896sc config wscsvc start= disabledC:\Windows\system32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1904C:\Windows\system32\net1 stop wuauservC:\Windows\system32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\net1.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dsrole.dll
c:\windows\system32\netutils.dll
2096"C:\Users\admin\Desktop\H1N1 Loader\builder.exe" C:\Users\admin\Desktop\H1N1 Loader\builder.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\h1n1 loader\builder.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
Total events
1 212
Read events
1 130
Write events
80
Delete events
2

Modification events

(PID) Process:(1296) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1296) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1296) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1296) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\H1N1 Loader.rar
(PID) Process:(1296) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1296) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1296) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1296) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1296) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF2B000000B3000000EB030000A8020000
(PID) Process:(1296) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\General
Operation:writeName:LastFolder
Value:
C:\Users\admin\AppData\Local\Temp
Executable files
6
Suspicious files
3
Text files
72
Unknown types
9

Dropped files

PID
Process
Filename
Type
1296WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1296.26406\H1N1 Loader\admin\admin.phptext
MD5:7CFF58F9EB4C30F5186E664AFD3A7DC5
SHA256:D3E0F8F28DF1BE9C837482D01ECC3BDC9F10E5B19C262016F1ECBFB531A5F788
1296WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1296.26406\H1N1 Loader\admin\app\controllers\Logs.phptext
MD5:05925F4DFB1A3B56B775E6CC97D7DFD8
SHA256:8D910633E8058446E54648850F6B0E4243801298A3D43AC238D15AF2D782800A
1296WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1296.26406\H1N1 Loader\admin\app\controllers\Factory.phptext
MD5:4E1128C44E1350822363F7B0D5ECC90C
SHA256:EA6282E1E0A8AC9867A72FDB845296C055EA97FB17DE33968413E87F69A6A863
1296WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1296.26406\H1N1 Loader\admin\app\controllers\Notfound.phptext
MD5:BB38A95820208FD4494BF56B44BAA010
SHA256:719613299FE87FD81FD051644A4703CAE3486D53CD8534F551731854CA33F434
1296WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1296.26406\H1N1 Loader\admin\app\models\Logs.phptext
MD5:1EF36CB61E3089D5854F582AF8CEE247
SHA256:D98600CE5F8CB2B2AB6F1F35F26D4FBD31A4BBCF1F197081E85C911BC408D726
1296WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1296.26406\H1N1 Loader\admin\app\controllers\Stats.phptext
MD5:1D43F759A5890108FC554D5C5F4666BE
SHA256:011C9D6D197774F7FE3776CBD1CF700CCC4973C6AA24DAADB65E4F74C4DBF33D
1296WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1296.26406\H1N1 Loader\admin\app\models\Model.phptext
MD5:3CCC0F0D447061AFB6F937490F557CC3
SHA256:D1D165E0A5B551E91CCD3A4BB67D711081537F422FCC10EA9550BF9C5A738124
1296WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1296.26406\H1N1 Loader\admin\app\controllers\Bots.phptext
MD5:32AA9CF6A01D9946F9259ABE4F6FE7F4
SHA256:0D614E9F60D05606D1FE10B18BA0A6D466637263C75AEDF2C0A82F6BC651A4B5
1296WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1296.26406\H1N1 Loader\admin\app\models\Task.phptext
MD5:0C70862191B581DAB66C952991EC6C47
SHA256:3FD8092A81E828CF35735DBDB205C64DEA9F19C480E01833228489367A3D4824
1296WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1296.26406\H1N1 Loader\admin\app\models\TaskLogs.phptext
MD5:5DD21A5E7DA79ABED036E09012EC7C15
SHA256:C814D539E5D08DF310FEAED5799656C69A17C71585E500809E1F3B2FF5F228BE
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
2
DNS requests
2
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2980
iexplore.exe
GET
200
193.104.215.66:80
http://get.adobe.com/flashplayer/download/?dualoffer=false&installer=00007030
unknown
—
—
whitelisted
2980
iexplore.exe
GET
200
193.104.215.66:80
http://get.adobe.com/flashplayer/download/?dualoffer=false&installer=000033D6
unknown
—
—
whitelisted
2980
iexplore.exe
GET
200
193.104.215.66:80
http://get.adobe.com/flashplayer/download/?dualoffer=false&installer=000058E3
unknown
—
—
whitelisted
3836
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3836
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
2980
iexplore.exe
193.104.215.66:80
get.adobe.com
Level 3 Communications, Inc.
—
malicious

DNS requests

Domain
IP
Reputation
get.adobe.com
  • 193.104.215.66
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted

Threats

Found threats are available for the paid subscriptions
3 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
H1N1 Loader.rar