File name:

system_test_ANYRUN.rar

Full analysis: https://app.any.run/tasks/33801e10-9680-464c-8bdd-b98e5729cbdf
Verdict: Malicious activity
Analysis date: February 24, 2022, 18:35:14
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

90C0ACE31904EBF75FFB3E16CD3F05AF

SHA1:

20D618DC915A4DA64E48A8A15B6D404487886ADB

SHA256:

F56193163AA618781BC08C0CE651BFE1CDF94210370031E08D993ED02DE517A0

SSDEEP:

24576:mhlyP0KGHpHzRo7i3NjeTSF2jInFHzRUWb2OhE:IllKGHplo7ip44FlU0rE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • TakeOwnershipEx-1.2.0.1.exe (PID: 1728)
      • TakeOwnershipEx-1.2.0.1.exe (PID: 1404)
      • TakeOwnershipEx.exe (PID: 2744)
      • TakeOwnershipEx.exe (PID: 3300)
      • hexbroker32.exe (PID: 804)
      • hexbroker32.exe (PID: 3768)

    • Drops executable file immediately after starts

      • TakeOwnershipEx-1.2.0.1.exe (PID: 1404)

    • Loads dropped or rewritten executable

      • TakeOwnershipEx-1.2.0.1.exe (PID: 1404)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1324)
      • TakeOwnershipEx-1.2.0.1.exe (PID: 1404)

    • Reads the computer name

      • WinRAR.exe (PID: 1324)
      • TakeOwnershipEx-1.2.0.1.exe (PID: 1404)
      • TakeOwnershipEx.exe (PID: 3300)

    • Checks supported languages

      • TakeOwnershipEx-1.2.0.1.exe (PID: 1404)
      • TakeOwnershipEx.exe (PID: 3300)
      • hexbroker32.exe (PID: 3768)
      • WinRAR.exe (PID: 1324)
      • cmd.exe (PID: 3060)

    • Drops a file with too old compile date

      • TakeOwnershipEx-1.2.0.1.exe (PID: 1404)
      • WinRAR.exe (PID: 1324)

    • Drops a file that was compiled in debug mode

      • TakeOwnershipEx-1.2.0.1.exe (PID: 1404)

    • Creates files in the program directory

      • TakeOwnershipEx-1.2.0.1.exe (PID: 1404)

    • Creates a software uninstall entry

      • TakeOwnershipEx-1.2.0.1.exe (PID: 1404)

    • Creates a directory in Program Files

      • TakeOwnershipEx-1.2.0.1.exe (PID: 1404)

    • Changes default file association

      • TakeOwnershipEx-1.2.0.1.exe (PID: 1404)

    • Reads Environment values

      • TakeOwnershipEx.exe (PID: 3300)

    • Creates files in the user directory

      • TakeOwnershipEx.exe (PID: 3300)

    • Reads internet explorer settings

      • TakeOwnershipEx.exe (PID: 3300)

    • Reads default file associations for system extensions

      • TakeOwnershipEx.exe (PID: 3300)

    • Starts CMD.EXE for commands execution

      • hexbroker32.exe (PID: 3768)

  • INFO

    • Manual execution by user

      • TakeOwnershipEx-1.2.0.1.exe (PID: 1404)
      • TakeOwnershipEx-1.2.0.1.exe (PID: 1728)
      • TakeOwnershipEx.exe (PID: 2744)
      • hexbroker32.exe (PID: 804)
      • hexbroker32.exe (PID: 3768)
      • explorer.exe (PID: 3220)
      • TakeOwnershipEx.exe (PID: 3300)

    • Checks supported languages

      • explorer.exe (PID: 3220)

    • Reads the computer name

      • explorer.exe (PID: 3220)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
55
Monitored processes
9
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe takeownershipex-1.2.0.1.exe no specs takeownershipex-1.2.0.1.exe takeownershipex.exe no specs takeownershipex.exe hexbroker32.exe no specs hexbroker32.exe cmd.exe no specs explorer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
804"C:\Users\admin\Desktop\hexbroker32.exe" C:\Users\admin\Desktop\hexbroker32.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\hexbroker32.exe
c:\windows\system32\ntdll.dll
1324"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\system_test_ANYRUN.rar"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1404"C:\Users\admin\Desktop\TakeOwnershipEx-1.2.0.1.exe" C:\Users\admin\Desktop\TakeOwnershipEx-1.2.0.1.exe
Explorer.EXE
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\takeownershipex-1.2.0.1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
1728"C:\Users\admin\Desktop\TakeOwnershipEx-1.2.0.1.exe" C:\Users\admin\Desktop\TakeOwnershipEx-1.2.0.1.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\takeownershipex-1.2.0.1.exe
c:\windows\system32\ntdll.dll
2744"C:\Program Files\TakeOwnershipEx\TakeOwnershipEx.exe" C:\Program Files\TakeOwnershipEx\TakeOwnershipEx.exe—Explorer.EXE
User:
admin
Company:
http://winaero.com
Integrity Level:
MEDIUM
Description:
TakeOwnershipEx
Exit code:
3221226540
Version:
1.2.0.1
Modules
Images
c:\program files\takeownershipex\takeownershipex.exe
c:\windows\system32\ntdll.dll
3060"C:\Windows\system32\cmd" /c "C:\Users\admin\AppData\Local\Temp\826D.tmp\826E.tmp\826F.bat C:\Users\admin\Desktop\hexbroker32.exe"C:\Windows\system32\cmd.exe—hexbroker32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
3221225786
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3220"C:\Windows\explorer.exe" C:\Windows\explorer.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3300"C:\Program Files\TakeOwnershipEx\TakeOwnershipEx.exe" C:\Program Files\TakeOwnershipEx\TakeOwnershipEx.exe
Explorer.EXE
User:
admin
Company:
http://winaero.com
Integrity Level:
HIGH
Description:
TakeOwnershipEx
Exit code:
0
Version:
1.2.0.1
Modules
Images
c:\program files\takeownershipex\takeownershipex.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3768"C:\Users\admin\Desktop\hexbroker32.exe" C:\Users\admin\Desktop\hexbroker32.exe
Explorer.EXE
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\hexbroker32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
Total events
2 884
Read events
2 831
Write events
53
Delete events
0

Modification events

(PID) Process:(1324) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1324) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1324) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1324) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(1324) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(1324) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\system_test_ANYRUN.rar
(PID) Process:(1324) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1324) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1324) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1324) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
15
Suspicious files
1
Text files
5
Unknown types
5

Dropped files

PID
Process
Filename
Type
1324WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1324.37785\START32.exeexecutable
MD5:—
SHA256:—
1324WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1324.37785\hexbroker32.exeexecutable
MD5:—
SHA256:—
1324WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1324.37785\hexbroker64.exeexecutable
MD5:—
SHA256:—
1324WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1324.37785\xehrekorb32invis.exeexecutable
MD5:—
SHA256:—
1324WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1324.37785\START64.exeexecutable
MD5:—
SHA256:—
1404TakeOwnershipEx-1.2.0.1.exeC:\Program Files\TakeOwnershipEx\readme.txttext
MD5:—
SHA256:—
1324WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1324.37785\TakeOwnershipEx-1.2.0.1.exeexecutable
MD5:—
SHA256:—
1404TakeOwnershipEx-1.2.0.1.exeC:\Program Files\TakeOwnershipEx\TakeOwnershipEx.exeexecutable
MD5:—
SHA256:—
1404TakeOwnershipEx-1.2.0.1.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\TakeOwnershipEx\TakeOwnershipEx.lnklnk
MD5:—
SHA256:—
1404TakeOwnershipEx-1.2.0.1.exeC:\Program Files\TakeOwnershipEx\ru-RU\TakeOwnershipEx.resources.dllexecutable
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
6
DNS requests
1
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3300
TakeOwnershipEx.exe
GET
301
68.183.112.81:80
http://winaero.com/updates/takeownershipex.txt
US
html
162 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3300
TakeOwnershipEx.exe
68.183.112.81:443
winaero.com
DSL Extreme
US
suspicious
3300
TakeOwnershipEx.exe
68.183.112.81:80
winaero.com
DSL Extreme
US
suspicious

DNS requests

Domain
IP
Reputation
winaero.com
  • 68.183.112.81
whitelisted

Threats

PID
Process
Class
Message
3300
TakeOwnershipEx.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
system_test_ANYRUN.rar