Find similar analyses in TI Lookup

Analysis date (UTC): 4 May 2020, 03:12Analysis environment: Windows 7 Pro, build 7601, x86

666.rar

MD5:B6BDA7D16BBA279B474F7A22DA313ED9

SHA1:BDF1AA26068EAA34A92F4B5DD07280255FCD61D0

SHA256:FA3131E269C2C1F8330015543CFFE0F3DC241DC2DB4D75DA4FE1D68ADAC79CAC

Analysis result

Threat level:Malicious activity

Full analysis:Analysis 666.rar (MD5: B6BDA7D16BBA279B474F7A22DA313ED9) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Application was dropped or rewritten from another process

supermariobros2.exe destructive.exe (PID: 1000)
mbr.exe (PID: 4056)
mbr.exe (PID: 3100)
supermariobros2.exe (PID: 4076)

Low-level write access rights to disk partition

mbr.exe (PID: 3100)

Loads dropped or rewritten executable

supermariobros2.exe (PID: 4076)

SUSPICIOUS

Executes scripts

cmd.exe (PID: 2280)
cmd.exe (PID: 2688)

Starts CMD.EXE for commands execution

supermariobros2.exe destructive.exe (PID: 1000)

Application launched itself

mbr.exe (PID: 4056)

Executable content was dropped or overwritten

WinRAR.exe (PID: 2348)
supermariobros2.exe (PID: 4076)

Low-level read access rights to disk partition

mbr.exe (PID: 3100)

INFO

Manual execution by user

cmd.exe (PID: 2280)
supermariobros2.exe destructive.exe (PID: 1000)
taskmgr.exe (PID: 2612)

Threats

No threats detected