analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

FortniteCheck.rar

Full analysis: https://app.any.run/tasks/eed9557d-4b63-4f22-9371-a8d115a7c288
Verdict: Malicious activity
Analysis date: January 23, 2019, 09:22:21
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, flags: EncryptedBlockHeader
MD5:

2CC460A280E67798FC6F756E7CF8B552

SHA1:

346B1E904FBF816616FB6CEA02DF363C3B6CD648

SHA256:

FB99A78855FE244C66C25C814ED280D41FC4FF0FF7ED43D4E283CE82A78E310E

SSDEEP:

24576:hXj8S+kilFFG1hXEqYc87acQTu9+K8rEJvcrdJG+i0ejjpJl:iJkZ1HYvQTTK8r46bGX7vpJl

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 968)

    • Application was dropped or rewritten from another process

      • FortniteProject.exe (PID: 3564)
      • FortniteProject.exe (PID: 2816)
      • FortniteProject.exe (PID: 3108)
      • FortniteProject.exe (PID: 3580)
      • FortniteProject.exe (PID: 4088)
      • FortniteProject.exe (PID: 1488)
      • FortniteProject.exe (PID: 864)
      • FortniteProject.exe (PID: 3652)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2980)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v-4.x) (58.3)
.rar | RAR compressed archive (gen) (41.6)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
10
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start drop and start start winrar.exe fortniteproject.exe no specs fortniteproject.exe no specs searchprotocolhost.exe no specs fortniteproject.exe no specs fortniteproject.exe no specs fortniteproject.exe no specs fortniteproject.exe no specs fortniteproject.exe no specs fortniteproject.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2980"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\FortniteCheck.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
1488"C:\Users\admin\AppData\Local\Temp\Rar$EXb2980.38883\FortniteProject.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb2980.38883\FortniteProject.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
2
3564"C:\Users\admin\AppData\Local\Temp\Rar$EXb2980.39531\FortniteProject.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb2980.39531\FortniteProject.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
2
968"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe6_ Global\UsGthrCtrlFltPipeMssGthrPipe6 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
3580"C:\Users\admin\Desktop\FortniteProject.exe" C:\Users\admin\Desktop\FortniteProject.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
2
3652"C:\Users\admin\Desktop\FortniteProject.exe" C:\Users\admin\Desktop\FortniteProject.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
2
2816"C:\Users\admin\Desktop\FortniteProject.exe" C:\Users\admin\Desktop\FortniteProject.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
2
4088"C:\Users\admin\Desktop\FortniteProject.exe" C:\Users\admin\Desktop\FortniteProject.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
2
3108"C:\Users\admin\Desktop\FortniteProject.exe" C:\Users\admin\Desktop\FortniteProject.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
2
864"C:\Users\admin\Desktop\FortniteProject.exe" C:\Users\admin\Desktop\FortniteProject.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
2
Total events
1 222
Read events
1 209
Write events
0
Delete events
0

Modification events

No data
Executable files
17
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2980WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2980.40809\Agukas.dll —
MD5:—
SHA256:—
2980WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2980.38883\FortniteProject.exeexecutable
MD5:2DB537D271CBEABC3B87DC59B5E59D8B
SHA256:037C0D5F03A50B62724A32B6751B76ADD686ED6A90B571801F48FEBB40FFDC39
2980WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2980.38883\PackHTMLAgilla.dllexecutable
MD5:45223650CFF5E89E56C1BDD4CB7FB786
SHA256:8019602AF8F267C4E09489B3D80B514B2498A495D0FA3D7D74C2EB86B1E25781
2980WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2980.40809\FortniteProject.exeexecutable
MD5:2DB537D271CBEABC3B87DC59B5E59D8B
SHA256:037C0D5F03A50B62724A32B6751B76ADD686ED6A90B571801F48FEBB40FFDC39
2980WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2980.39531\PackHTMLAgilla.dllexecutable
MD5:45223650CFF5E89E56C1BDD4CB7FB786
SHA256:8019602AF8F267C4E09489B3D80B514B2498A495D0FA3D7D74C2EB86B1E25781
2980WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2980.39531\FortniteProject.exeexecutable
MD5:2DB537D271CBEABC3B87DC59B5E59D8B
SHA256:037C0D5F03A50B62724A32B6751B76ADD686ED6A90B571801F48FEBB40FFDC39
2980WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2980.40809\PackHTMLAgilla.dllexecutable
MD5:45223650CFF5E89E56C1BDD4CB7FB786
SHA256:8019602AF8F267C4E09489B3D80B514B2498A495D0FA3D7D74C2EB86B1E25781
2980WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2980.38883\KitMail.dllexecutable
MD5:BE99F9896236C6106887959541D22F05
SHA256:786E2126D22AFABCB42D57CF07760690C18C21007C93ABAED0CB4C7FE2044EB6
2980WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2980.40809\KitMail.dllexecutable
MD5:BE99F9896236C6106887959541D22F05
SHA256:786E2126D22AFABCB42D57CF07760690C18C21007C93ABAED0CB4C7FE2044EB6
2980WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2980.38883\JinosSoft.Json.dllexecutable
MD5:5AFDA7C7D4F7085E744C2E7599279DB3
SHA256:F58C374FFCAAE4E36D740D90FBF7FE70D0ABB7328CD9AF3A0A7B70803E994BA4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
FortniteCheck.rar