analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

ed34b6bea2aff6dcfb67dac2666c7e7c47224ca6b84b9e1b0372ce60ae1e37cd.rar

Full analysis: https://app.any.run/tasks/22184b18-5cc2-465d-8f45-2149f65595c2
Verdict: Malicious activity
Analysis date: September 19, 2019, 01:59:38
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v4, os: Win32
MD5:

9521331F43984DC285394A975A3EA498

SHA1:

E803D75AFA5485281BFD0CCD7AF7C4680EE38E4F

SHA256:

ED34B6BEA2AFF6DCFB67DAC2666C7E7C47224CA6B84B9E1B0372CE60AE1E37CD

SSDEEP:

768:Cuh7eFahwk50KDXiDoLPibphmwGqf8ZP5Tp7rJ6W3TBnwy4ZKyiLe5qN:Cuh7eF+NDi0ebivqf8BVTuy4Z3Oe8N

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Writes to a start menu file

      • wscript.exe (PID: 3132)
      • WScript.exe (PID: 3456)

    • Changes the autorun value in the registry

      • WScript.exe (PID: 3456)
      • wscript.exe (PID: 3132)

  • SUSPICIOUS

    • Creates files in the user directory

      • WScript.exe (PID: 3456)
      • wscript.exe (PID: 3132)

    • Executes scripts

      • WScript.exe (PID: 3456)

    • Application launched itself

      • WScript.exe (PID: 3456)

  • INFO

    • Manual execution by user

      • WScript.exe (PID: 3456)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v-4.x) (58.3)
.rar | RAR compressed archive (gen) (41.6)

EXIF

ZIP

CompressedSize: 30540
UncompressedSize: 88511
OperatingSystem: Win32
ModifyDate: 2019:09:13 09:34:25
PackingMethod: Normal
ArchivedFileName: No. Obligaci?n 7854685.vbs
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs wscript.exe wscript.exe wscript.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3484"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\ed34b6bea2aff6dcfb67dac2666c7e7c47224ca6b84b9e1b0372ce60ae1e37cd.rar"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3456"C:\Windows\System32\WScript.exe" "C:\Users\admin\Desktop\No. Obligación 7854685.vbs" C:\Windows\System32\WScript.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Version:
5.8.7600.16385
3132"C:\Windows\System32\wscript.exe" //B "C:\Users\admin\AppData\Roaming\EoQJlUmqxx.vbs"C:\Windows\System32\wscript.exe
WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Version:
5.8.7600.16385
2668"C:\Windows\System32\wscript.exe" //B "C:\Users\admin\AppData\Roaming\No. Obligación 7854685.vbs"C:\Windows\System32\wscript.exe—WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
1
Version:
5.8.7600.16385
Total events
759
Read events
699
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
0
Text files
8
Unknown types
0

Dropped files

PID
Process
Filename
Type
3484WinRAR.exeC:\Users\admin\Desktop\No. Obligación 7854685.vbstext
MD5:F72894878052C40095C1A683369C5398
SHA256:E49CAA60F2EE452F831F020257014BDF1A7301BC42D46FF78F419F89DA95E9B4
3456WScript.exeC:\Users\admin\AppData\Roaming\EoQJlUmqxx.vbstext
MD5:A7EA78D766268998AC20A9AB5A068FC2
SHA256:D76C9F6E53912B2B10AB9E0D5F7CB530BAF72C43A85E678F583BE43960884D67
3456WScript.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\No. Obligación 7854685.vbstext
MD5:F72894878052C40095C1A683369C5398
SHA256:E49CAA60F2EE452F831F020257014BDF1A7301BC42D46FF78F419F89DA95E9B4
3132wscript.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EoQJlUmqxx.vbstext
MD5:A7EA78D766268998AC20A9AB5A068FC2
SHA256:D76C9F6E53912B2B10AB9E0D5F7CB530BAF72C43A85E678F583BE43960884D67
3456WScript.exeC:\Users\admin\AppData\Roaming\No. Obligación 7854685.vbstext
MD5:F72894878052C40095C1A683369C5398
SHA256:E49CAA60F2EE452F831F020257014BDF1A7301BC42D46FF78F419F89DA95E9B4
3456WScript.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.iniini
MD5:4A3DEB274BB5F0212C2419D3D8D08612
SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38
3456WScript.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.iniini
MD5:4A3DEB274BB5F0212C2419D3D8D08612
SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
8
DNS requests
2
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3456
WScript.exe
181.141.10.49:6660
tocktekerickx32.duckdns.org
EPM Telecomunicaciones S.A. E.S.P.
CO
malicious
—
—
181.141.10.49:6660
tocktekerickx32.duckdns.org
EPM Telecomunicaciones S.A. E.S.P.
CO
malicious
3132
wscript.exe
79.134.225.73:3175
britianica.uk.com
Andreas Fink trading as Fink Telecom Services
CH
malicious

DNS requests

Domain
IP
Reputation
britianica.uk.com
  • 79.134.225.73
unknown
tocktekerickx32.duckdns.org
  • 181.141.10.49
malicious

Threats

PID
Process
Class
Message
—
—
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
ed34b6bea2aff6dcfb67dac2666c7e7c47224ca6b84b9e1b0372ce60ae1e37cd.rar