File name:

ps2classics_GUI_2.2.3Small.rar

Full analysis: https://app.any.run/tasks/a93bad0a-ed59-439c-bd8d-488143149925
Verdict: Malicious activity
Analysis date: April 14, 2022, 15:13:25
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

9C14F5D1BA60F717BDA8F14F0EBC47C5

SHA1:

685CCC54492603E99F8101B938CA7156A66169DB

SHA256:

F0CC726C0D0B18AB21F0C8DBB9263C7C9F9BA0A8B32FB38056E7B1F7A8F6BBE4

SSDEEP:

98304:ZMJtAU4PhcXtIGm0f2Xl55pmm9njAUfQrnu64fl+J5GdBpyJRn+5IqwEOMK3n:Cz4POmGfuXl55xnjAUfyu6ew+dQR+5Ip

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • WinRAR.exe (PID: 2992)
      • Explorer.EXE (PID: 1464)

    • Detects Cygwin installation

      • WinRAR.exe (PID: 2992)

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 2284)
      • PS2Classics_GUI.exe (PID: 3588)
      • PARAM_SFO_Editor.exe (PID: 1204)
      • Explorer.EXE (PID: 1464)
      • ps2classic.exe (PID: 2404)
      • rap2rifkey.exe (PID: 920)
      • ps2classic.exe (PID: 3984)
      • PARAM_SFO_Editor.exe (PID: 184)
      • ps3xploit_rifgen_edatresign.exe (PID: 3112)
      • PS2Classics_GUI.exe (PID: 2620)

    • Application was dropped or rewritten from another process

      • PS2Classics_GUI.exe (PID: 3588)
      • PARAM_SFO_Editor.exe (PID: 1204)
      • psn_package_npdrm.exe (PID: 4000)
      • ps2classic.exe (PID: 2404)
      • ps2classic.exe (PID: 3984)
      • PARAM_SFO_Editor.exe (PID: 184)
      • ps3xploit_rifgen_edatresign.exe (PID: 3112)
      • psn_package_npdrm.exe (PID: 2656)
      • PkgView.exe (PID: 1928)
      • rap2rifkey.exe (PID: 920)
      • PS2Classics_GUI.exe (PID: 2620)
      • PkgView.exe (PID: 2788)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2992)

    • Checks supported languages

      • WinRAR.exe (PID: 2992)
      • PS2Classics_GUI.exe (PID: 3588)
      • PkgView.exe (PID: 2788)
      • PARAM_SFO_Editor.exe (PID: 1204)
      • psn_package_npdrm.exe (PID: 4000)
      • ps2classic.exe (PID: 2404)
      • rap2rifkey.exe (PID: 920)
      • ps2classic.exe (PID: 3984)
      • ps3xploit_rifgen_edatresign.exe (PID: 3112)
      • PARAM_SFO_Editor.exe (PID: 184)
      • psn_package_npdrm.exe (PID: 2656)
      • PkgView.exe (PID: 1928)
      • PS2Classics_GUI.exe (PID: 2620)

    • Reads the computer name

      • WinRAR.exe (PID: 2992)
      • PS2Classics_GUI.exe (PID: 3588)
      • PARAM_SFO_Editor.exe (PID: 1204)
      • ps3xploit_rifgen_edatresign.exe (PID: 3112)
      • PARAM_SFO_Editor.exe (PID: 184)
      • PkgView.exe (PID: 1928)
      • PS2Classics_GUI.exe (PID: 2620)
      • PkgView.exe (PID: 2788)

    • Reads default file associations for system extensions

      • WinRAR.exe (PID: 2992)
      • SearchProtocolHost.exe (PID: 2284)
      • Explorer.EXE (PID: 1464)

    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 2992)
      • Explorer.EXE (PID: 1464)

  • INFO

    • Manual execution by user

      • PS2Classics_GUI.exe (PID: 3588)
      • PkgView.exe (PID: 2788)
      • PARAM_SFO_Editor.exe (PID: 1204)
      • ps2classic.exe (PID: 2404)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
56
Monitored processes
15
Malicious processes
13
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start winrar.exe searchprotocolhost.exe no specs ps2classics_gui.exe no specs ps2classic.exe no specs pkgview.exe no specs param_sfo_editor.exe no specs explorer.exe no specs psn_package_npdrm.exe no specs psn_package_npdrm.exe no specs pkgview.exe no specs rap2rifkey.exe no specs ps2classic.exe no specs param_sfo_editor.exe no specs ps3xploit_rifgen_edatresign.exe no specs ps2classics_gui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
184"C:\Users\admin\Desktop\Virus\PARAM_SFO_Editor.exe" C:\Users\admin\Desktop\Virus\PARAM_SFO_Editor.exe—Explorer.EXE
User:
admin
Company:
aldostools.org
Integrity Level:
MEDIUM
Description:
PARAM.SFO Editor
Exit code:
0
Version:
3.00
Modules
Images
c:\users\admin\desktop\virus\param_sfo_editor.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\desktop\virus\msvbvm50.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
920"C:\Users\admin\Desktop\Virus\scetool\rap2rifkey.exe" C:\Users\admin\Desktop\Virus\scetool\rap2rifkey.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\desktop\virus\scetool\rap2rifkey.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\users\admin\desktop\virus\scetool\cygwin1.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
1204"C:\Users\admin\Desktop\Virus\PARAM_SFO_Editor.exe" C:\Users\admin\Desktop\Virus\PARAM_SFO_Editor.exe—Explorer.EXE
User:
admin
Company:
aldostools.org
Integrity Level:
MEDIUM
Description:
PARAM.SFO Editor
Exit code:
0
Version:
3.00
Modules
Images
c:\users\admin\desktop\virus\param_sfo_editor.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\users\admin\desktop\virus\msvbvm50.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
1464C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE——
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1928"C:\Users\admin\Desktop\Virus\PkgView.exe" C:\Users\admin\Desktop\Virus\PkgView.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Description:
PkgView
Exit code:
0
Version:
1.3.0.0
Modules
Images
c:\users\admin\desktop\virus\pkgview.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2284"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\system32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7601.24542 (win7sp1_ldr_escrow.191209-2211)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2404"C:\Users\admin\Desktop\Virus\ps2classic.exe" C:\Users\admin\Desktop\Virus\ps2classic.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\virus\ps2classic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\desktop\virus\cygwin1.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2620"C:\Users\admin\Desktop\Virus\PS2Classics_GUI.exe" C:\Users\admin\Desktop\Virus\PS2Classics_GUI.exe—Explorer.EXE
User:
admin
Company:
Aldo Vargas - http://www.aldostools.org
Integrity Level:
MEDIUM
Description:
PS3Classics GUI
Exit code:
0
Version:
2.02.0003
Modules
Images
c:\users\admin\desktop\virus\ps2classics_gui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24542_none_5c0717c7a00ddc6d\gdiplus.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2656"C:\Users\admin\Desktop\Virus\psn_package_npdrm.exe" C:\Users\admin\Desktop\Virus\psn_package_npdrm.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
4294967294
Modules
Images
c:\users\admin\desktop\virus\psn_package_npdrm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
2788"C:\Users\admin\Desktop\Virus\PkgView.exe" C:\Users\admin\Desktop\Virus\PkgView.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Description:
PkgView
Exit code:
0
Version:
1.3.0.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\desktop\virus\pkgview.exe
c:\windows\system32\mscoree.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
c:\windows\system32\msvcrt.dll
Total events
12 684
Read events
12 012
Write events
670
Delete events
2

Modification events

(PID) Process:(2992) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2992) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2992) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2992) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2992) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2992) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\ps2classics_GUI_2.2.3Small.rar
(PID) Process:(2992) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2992) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2992) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2992) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
25
Suspicious files
10
Text files
33
Unknown types
1

Dropped files

PID
Process
Filename
Type
2992WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2992.38208\rifgen_for_ps3xploit\source\src\aes_omac.cpptext
MD5:02A6A3DBB945B14CCD5B84CFCC5EAA53
SHA256:20CF4D132309274C793F4F8E8E39F90298FD0A0F255A0518FAAC7CC4E200D4A5
2992WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2992.38208\rifgen_for_ps3xploit\source\src\aes.ctext
MD5:3EF189AFA1637AD848986D8B8AC7A70F
SHA256:476328A2FDDE5462C06E108550022B923A5A36981E7CFA42834D6594F873AF4D
2992WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2992.38208\rifgen_for_ps3xploit\README.mdhtml
MD5:FCBEEE920905A6FBEE315E5288AF35B8
SHA256:D9A1C5CAC7B18E60D98D24B5D89A36478D97A5599BB4E7AA38E8F6326F7FC6F0
2992WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2992.38208\rifgen_for_ps3xploit\source\src\aes.htext
MD5:BEA09EE1D7E58CE0FE46A7274B3A63BF
SHA256:5FF359BC4950070FE1C8AAF33FC24034C205B0759F849F43AAC5CF43B4FBDE2D
2992WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2992.38208\rifgen_for_ps3xploit\source\src\main.cpptext
MD5:AD287B98A830308866911897FB5C431F
SHA256:A15A573E06BB825CD810F920ED6F9D760B4ED8FA5939CE74F72621937DE6CC9F
2992WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2992.38208\rifgen_for_ps3xploit\resign_windows.battext
MD5:7BB672EDC0D80F69F089EA5414BB33AB
SHA256:B26CA1FA2E27A24C15D31AEE818DB003DE64D2C6259C1931C65C6C48A6698094
2992WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2992.38208\rifgen_for_ps3xploit\source\src\pkg2zip_aes_x86.ctext
MD5:3DCAF48ABCD0CA569C96998AECF11902
SHA256:ED5300E7C9E27AD2F7EBAF7B1DF8D706142EA00316C9FE719E65ED793820A931
2992WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2992.38208\rifgen_for_ps3xploit\source\src\pkg2zip_aes.htext
MD5:9DAEAEE3056AFEAB5A9952FD81008F31
SHA256:70160253DA9E907D90A36373BD6166C1D7EEA99E71665A503FAB45D57F495B7D
2992WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2992.38208\rifgen_for_ps3xploit\source\src\pkg2zip_aes_x86.htext
MD5:D77C17EEBCE3421606D0399A02D81CBD
SHA256:D7D6E939886CC1539E1529A31D6AC79F5EB7E4CC9A1FE0B2A4C1F159CB53343D
2992WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2992.38208\rifgen_for_ps3xploit\source\src\pkg2zip_utils.htext
MD5:81D43D1774A0EB7E6973FE77F428705F
SHA256:38ECC9852B13A9A2961BBC3A0F7E81BCA673AC915F85CEFA3ADE8117C3A27AD1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ps2classics_GUI_2.2.3Small.rar