analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Unhide Files.bat

Full analysis: https://app.any.run/tasks/423105c4-a392-4375-a8b5-a96769b07987
Verdict: Malicious activity
Analysis date: November 16, 2019, 20:46:40
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/octet-stream
File info: data
MD5:

ED321251DC3B4F175E68BE78E694474D

SHA1:

9E72DA35F476589E57754A6768E9914D7717F2E0

SHA256:

F335F7098DE9B44F3849B8ADA84FCCA1AC09ED00F8936D60CB3CF8D085EEA2E5

SSDEEP:

12288:wnVHDWx5jouKbs3wPDdI3N4Pgq9vJvSuuqngHAJ:wnc/YsgrgN45

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • rf.exe (PID: 3892)
      • eng.exe (PID: 4064)
      • cmd.exe (PID: 2644)
      • cmd.exe (PID: 2148)
      • cmd.exe (PID: 1796)
      • cmd.exe (PID: 3364)
      • cmd.exe (PID: 236)
      • cmd.exe (PID: 3388)
      • cmd.exe (PID: 640)
      • cmd.exe (PID: 184)
      • cmd.exe (PID: 3600)
      • cmd.exe (PID: 2844)
      • cmd.exe (PID: 3160)
      • cmd.exe (PID: 1012)
      • cmd.exe (PID: 1732)
      • cmd.exe (PID: 1912)
      • cmd.exe (PID: 3372)
      • cmd.exe (PID: 2744)
      • cmd.exe (PID: 1916)
      • cmd.exe (PID: 1792)
      • cmd.exe (PID: 3112)
      • cmd.exe (PID: 2784)
      • svcnost.exe (PID: 4016)
      • cmd.exe (PID: 1728)
      • svcnosts.exe (PID: 3980)

    • Runs PING.EXE for delay simulation

      • cmd.exe (PID: 2148)

    • Changes the autorun value in the registry

      • rf.exe (PID: 3892)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • cmd.exe (PID: 2148)
      • eng.exe (PID: 4064)
      • rf.exe (PID: 3892)

    • Uses ATTRIB.EXE to modify file attributes

      • cmd.exe (PID: 2148)
      • cmd.exe (PID: 1732)
      • cmd.exe (PID: 1012)
      • cmd.exe (PID: 2844)
      • cmd.exe (PID: 2744)
      • cmd.exe (PID: 3600)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 2148)
      • rf.exe (PID: 3892)

    • Application launched itself

      • cmd.exe (PID: 2148)

    • Uses REG.EXE to modify Windows registry

      • cmd.exe (PID: 236)
      • cmd.exe (PID: 2148)

    • Writes to a desktop.ini file (may be used to cloak folders)

      • rf.exe (PID: 3892)

    • Modifies the open verb of a shell class

      • rf.exe (PID: 3892)

    • Creates executable files which already exist in Windows

      • rf.exe (PID: 3892)

    • Starts itself from another location

      • svcnosts.exe (PID: 3980)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.bib/bibtex/txt | BibTeX references (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
107
Monitored processes
51
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start cmd.exe eng.exe attrib.exe no specs attrib.exe no specs attrib.exe no specs cmd.exe no specs reg.exe no specs ping.exe no specs rf.exe cmd.exe no specs cacls.exe no specs ping.exe no specs cmd.exe no specs cacls.exe no specs cmd.exe no specs cacls.exe no specs cmd.exe no specs cacls.exe no specs cmd.exe no specs cacls.exe no specs cmd.exe no specs cacls.exe no specs cmd.exe no specs cacls.exe no specs cmd.exe no specs cacls.exe no specs cmd.exe no specs attrib.exe no specs cmd.exe no specs attrib.exe no specs cmd.exe no specs attrib.exe no specs cmd.exe no specs reg.exe no specs attrib.exe no specs cmd.exe no specs attrib.exe no specs cmd.exe no specs cacls.exe no specs cmd.exe no specs cacls.exe no specs cmd.exe no specs cacls.exe no specs cmd.exe no specs cacls.exe no specs cmd.exe no specs cacls.exe no specs cmd.exe no specs cacls.exe no specs svcnosts.exe no specs svcnost.exe

Process information

PID
CMD
Path
Indicators
Parent process
2148cmd /c ""C:\Users\admin\AppData\Local\Temp\Unhide Files.bat" "C:\Windows\system32\cmd.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
4064"C:\Users\admin\AppData\Local\Temp\rlgms24838\eng.exe" "C:\Users\admin\AppData\Local\Temp\rlgms24838\sk.js"C:\Users\admin\AppData\Local\Temp\rlgms24838\eng.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
2884attrib * -s /d C:\Windows\system32\attrib.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Attribute Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2368attrib * -h /d C:\Windows\system32\attrib.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Attribute Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3036attrib * -h -s /d C:\Windows\system32\attrib.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Attribute Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
236C:\Windows\system32\cmd.exe /c REG QUERY HKCU\SOFTWARE\btC:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3180REG QUERY HKCU\SOFTWARE\btC:\Windows\system32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2280ping 127.0.0.1 -n 2 C:\Windows\system32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3892"C:\Users\admin\AppData\Local\Temp\rlgms24838\rf.exe" rlcC:\Users\admin\AppData\Local\Temp\rlgms24838\rf.exe
eng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
1.0.0.0
2644"C:\Windows\system32\cmd.exe" /c cacls n:\sefera\Jnt\null\..\.. /g everyone:f /e /tC:\Windows\system32\cmd.exe—rf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
3
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Total events
658
Read events
624
Write events
34
Delete events
0

Modification events

(PID) Process:(4064) eng.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(4064) eng.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3892) rf.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3892) rf.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3892) rf.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Microsoft
Operation:writeName:STR
Value:
C|sovoyyboq|uibewyio|svcnost|svcnosts
(PID) Process:(3892) rf.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Explorers
Value:
C:\Windows\explorer.exe /root c:\windows\system32\rundll32.exe ..\windows\system32\user32.dll.ShellExecute(%s), C:\System_VoIume_lnformation\Jnt\uibewyio\bmz\explorer.exe, 0xff3leca
(PID) Process:(3892) rf.exeKey:HKEY_CLASSES_ROOT\.exe
Operation:writeName:
Value:
exefiles
(PID) Process:(3892) rf.exeKey:HKEY_CLASSES_ROOT\exefiles\shell\open\command
Operation:writeName:
Value:
"C:\System_VoIume_lnformation\Jnt\uibewyio\explorers.exe" rts "%1"
(PID) Process:—Key:HKEY_CURRENT_USER\Software\bt
Operation:writeName:gp
Value:
20:4
(PID) Process:(3892) rf.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Microsoft
Operation:writeName:SLK
Value:
0
Executable files
6
Suspicious files
2
Text files
3
Unknown types
1

Dropped files

PID
Process
Filename
Type
4064eng.exeC:\Users\admin\AppData\Local\Temp\rlgms24838\rf.exeexecutable
MD5:43935A2B61416385736FDF2D0D4BDFCC
SHA256:C5F21CBEAA15988A6E0887A1FD3B652DA9E8FFECC60D207E9513930CFF2CD965
3892rf.exeC:\System_VoIume_lnformation\Jnt\uibewyio\explorers.exeexecutable
MD5:C94D686FB13A835355299C992EE8E594
SHA256:BEEF68C9C19D5E0A2A7EBEB97C10373EEAA88F87741573B9D1027F523C98076E
3892rf.exeC:\sefera\Jnt\sovoyyboq\svcnosts.exeexecutable
MD5:C94D686FB13A835355299C992EE8E594
SHA256:BEEF68C9C19D5E0A2A7EBEB97C10373EEAA88F87741573B9D1027F523C98076E
3892rf.exeC:\sefera\Jnt\sovoyyboq\gotera.bmpbinary
MD5:CAC17D4A6C7489D29F523FB4D9A7EA25
SHA256:AC1D3CDA8A70C5FFDAA00C5B770BDA2660569B3B270F9775337C8E8C9B3BFE5B
2148cmd.exeC:\Users\admin\AppData\Local\Temp\rlgms24838\unrf.dllbib
MD5:ED321251DC3B4F175E68BE78E694474D
SHA256:F335F7098DE9B44F3849B8ADA84FCCA1AC09ED00F8936D60CB3CF8D085EEA2E5
3892rf.exeC:\sefera\Jnt\sovoyyboq\svcnost.exeexecutable
MD5:C94D686FB13A835355299C992EE8E594
SHA256:BEEF68C9C19D5E0A2A7EBEB97C10373EEAA88F87741573B9D1027F523C98076E
3892rf.exeC:\System_VoIume_lnformation\Jnt\uibewyio\gotera.bmpbinary
MD5:CAC17D4A6C7489D29F523FB4D9A7EA25
SHA256:AC1D3CDA8A70C5FFDAA00C5B770BDA2660569B3B270F9775337C8E8C9B3BFE5B
3892rf.exeC:\System_VoIume_lnformation\Jnt\uibewyio\bmz\explorer.exeexecutable
MD5:AD7B9C14083B52BC532FBA5948342B98
SHA256:17F746D82695FA9B35493B41859D39D786D32B23A9D2E00F4011DEC7A02402AE
3892rf.exeC:\sefera\desktop.iniini
MD5:ADC4B5D4444D26293DC782B6238CA6F0
SHA256:ABE8A5933FF450A89B8E9A736F08874B43B7355D17FFE6540C4A6EAD0F0995D3
2148cmd.exeC:\Users\admin\AppData\Local\Temp\rlgms24838\sk.jstext
MD5:3ABAFFE780DACFD3C83A6D79D3456CD1
SHA256:1D16BCFDCC3ACBD37D4E39E07DF2FA6F496FB4B9998D6F1D83C5E076860AFC6B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4016
svcnost.exe
151.101.1.195:443
clear-march.firebaseapp.com
Fastly
US
malicious

DNS requests

Domain
IP
Reputation
clear-march.firebaseapp.com
  • 151.101.1.195
  • 151.101.65.195
malicious

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Unhide Files.bat