| File name: | ATR Tools 2021.rar |
| Full analysis: | https://app.any.run/tasks/f842a4b2-bccf-463a-aa3c-b95ecc552cdd |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | December 27, 2021, 22:16:30 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-rar |
| File info: | RAR archive data, v5 |
| MD5: | EFF53C11A3F7FFB1F7A89A2314679A65 |
| SHA1: | 7D5E9CFA7C02BD13064C36EFED33D64D2962649B |
| SHA256: | FF7050564C298EC3694AF440A65E642A4C38B77B4A9C415415E444A9A8BB0817 |
| SSDEEP: | 49152:NkrWFw3ex7ql16ERWUqU7ffq+u/R4O8Qqba/G+RNy8PilCMY5LENXuKTQqUrVA:u38MhFLqN54OS+/jRw4PRENXQvO |
| .rar | | | RAR compressed archive (v5.0) (61.5) |
|---|---|---|
| .rar | | | RAR compressed archive (gen) (38.4) |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1780 | chcp 65001 | C:\Windows\system32\chcp.com | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Change CodePage Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2196 | "C:\Users\admin\AppData\Local\Temp\Uergrk.exe" | C:\Users\admin\AppData\Local\Temp\Uergrk.exe | — | ATR Tool 2.0.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Teams Exit code: 0 Version: 1.10.71.0 Modules
| |||||||||||||||
| 2436 | "C:\Users\admin\AppData\Local\Temp\Ugpnjvbftwtm.exe" | C:\Users\admin\AppData\Local\Temp\Ugpnjvbftwtm.exe | ATR Tool 2.0.exe | ||||||||||||
User: admin Company: MasterVox Integrity Level: MEDIUM Description: CompanySecurity Exit code: 0 Version: 4.13.61.28 Modules
| |||||||||||||||
| 2756 | "C:\Users\admin\AppData\Local\Temp\Ppbwsfqzrk.exe" | C:\Users\admin\AppData\Local\Temp\Ppbwsfqzrk.exe | Ugpnjvbftwtm.exe | ||||||||||||
User: admin Company: CompanySecurity Integrity Level: MEDIUM Description: CompanySecurity Exit code: 0 Version: 1.3.0.0 Modules
| |||||||||||||||
| 2808 | netsh wlan show networks mode=bssid | C:\Windows\system32\netsh.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Network Command Shell Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2912 | "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid | C:\Windows\system32\cmd.exe | — | Ppbwsfqzrk.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2936 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa3052.5187\ATR Tool 2.0.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa3052.5187\ATR Tool 2.0.exe | WinRAR.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 3000 | "C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\Temp\Rar$DIa3052.7548\READ ME.txt | C:\Windows\system32\NOTEPAD.EXE | — | WinRAR.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Notepad Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3052 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\ATR Tools 2021.rar" | C:\Program Files\WinRAR\WinRAR.exe | Explorer.EXE | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
| 3276 | findstr All | C:\Windows\system32\findstr.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Find String (QGREP) Utility Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| (PID) Process: | (3052) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (3052) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (3052) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (3052) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip | |||
| (PID) Process: | (3052) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\Win7-KB3191566-x86.zip | |||
| (PID) Process: | (3052) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\ATR Tools 2021.rar | |||
| (PID) Process: | (3052) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (3052) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (3052) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (3052) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3052 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DIa3052.7548\READ ME.txt | text | |
MD5:— | SHA256:— | |||
| 2756 | Ppbwsfqzrk.exe | C:\Users\admin\AppData\Local\6bb74d52e92773202ff7d47584992b3d\admin@USER-PC_en-US\Grabber\DRIVE-C\Users\admin\Pictures\practiceensure.jpg | image | |
MD5:— | SHA256:— | |||
| 2756 | Ppbwsfqzrk.exe | C:\Users\admin\AppData\Local\Temp\Flow-Latest.log | text | |
MD5:— | SHA256:— | |||
| 2756 | Ppbwsfqzrk.exe | C:\Users\admin\AppData\Local\6bb74d52e92773202ff7d47584992b3d\admin@USER-PC_en-US\Grabber\DRIVE-C\Users\admin\Pictures\losstory.png | image | |
MD5:— | SHA256:— | |||
| 2756 | Ppbwsfqzrk.exe | C:\Users\admin\AppData\Local\6bb74d52e92773202ff7d47584992b3d\admin@USER-PC_en-US\Grabber\DRIVE-C\Users\admin\Pictures\manyjune.png | image | |
MD5:— | SHA256:— | |||
| 2756 | Ppbwsfqzrk.exe | C:\Users\admin\AppData\Local\6bb74d52e92773202ff7d47584992b3d\admin@USER-PC_en-US\Grabber\DRIVE-C\Users\admin\Desktop\bestalternative.png | image | |
MD5:— | SHA256:— | |||
| 3052 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3052.7037\ATR Tool 2.0.exe | executable | |
MD5:8BE31E9BBA7DE582C4854C683B5AA4BE | SHA256:239A024ACF03FF8106556FFD3784B9142C6D51611634A035505DA705C725987B | |||
| 2756 | Ppbwsfqzrk.exe | C:\Users\admin\AppData\Local\Temp\tmpC23D.tmp.dat | — | |
MD5:— | SHA256:— | |||
| 3052 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa3052.5187\READ ME.txt | text | |
MD5:— | SHA256:— | |||
| 2436 | Ugpnjvbftwtm.exe | C:\Users\admin\AppData\Local\Temp\Itycyosirn.exe | executable | |
MD5:DDF79E9C69388E228E42D9F93E179CD6 | SHA256:33598C2CE7BA425EE7C95120313821562B20CE4016A3ECD5F312E7A4EE6576AD | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2756 | Ppbwsfqzrk.exe | GET | 200 | 104.18.114.97:80 | http://icanhazip.com/ | US | text | 13 b | shared |
2756 | Ppbwsfqzrk.exe | GET | 200 | 92.249.44.34:80 | http://api.getforpc.net/packages/DotNetZip.1.13.8/lib/net40/DotNetZip.dll | unknown | executable | 448 Kb | malicious |
2756 | Ppbwsfqzrk.exe | GET | 200 | 92.249.44.34:80 | http://api.getforpc.net/packages/AnonFileApi.1.14.6/lib/net40/AnonFileApi.dll | unknown | executable | 136 Kb | malicious |
— | — | GET | 200 | 13.107.4.50:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?1d1fd13dcd0d3888 | US | compressed | 59.9 Kb | whitelisted |
2756 | Ppbwsfqzrk.exe | GET | 200 | 208.95.112.1:80 | http://ip-api.com/line/?fields=hosting | unknown | text | 6 b | malicious |
2756 | Ppbwsfqzrk.exe | GET | 200 | 208.95.112.1:80 | http://ip-api.com/line/?fields=hosting | unknown | text | 6 b | malicious |
2756 | Ppbwsfqzrk.exe | GET | 200 | 104.18.114.97:80 | http://icanhazip.com/ | US | text | 13 b | shared |
2756 | Ppbwsfqzrk.exe | GET | 200 | 208.95.112.1:80 | http://ip-api.com/line/?fields=hosting | unknown | text | 6 b | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2756 | Ppbwsfqzrk.exe | 92.249.44.34:80 | api.getforpc.net | — | — | malicious |
2756 | Ppbwsfqzrk.exe | 104.18.114.97:80 | icanhazip.com | Cloudflare Inc | US | malicious |
2756 | Ppbwsfqzrk.exe | 149.154.167.220:443 | api.telegram.org | Telegram Messenger LLP | GB | malicious |
2756 | Ppbwsfqzrk.exe | 208.95.112.1:80 | ip-api.com | IBURST | — | malicious |
— | — | 45.154.253.154:443 | api.anonfiles.com | — | — | malicious |
— | — | 13.107.4.50:80 | ctldl.windowsupdate.com | Microsoft Corporation | US | whitelisted |
Domain | IP | Reputation |
|---|---|---|
ip-api.com |
| malicious |
api.getforpc.net |
| malicious |
api.telegram.org |
| shared |
icanhazip.com |
| shared |
api.anonfiles.com |
| unknown |
ctldl.windowsupdate.com |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
2756 | Ppbwsfqzrk.exe | Potential Corporate Privacy Violation | ET POLICY External IP Lookup ip-api.com |
2756 | Ppbwsfqzrk.exe | Potential Corporate Privacy Violation | AV POLICY Internal Host Retrieving External IP Address (ip-api. com) |
2756 | Ppbwsfqzrk.exe | Potential Corporate Privacy Violation | AV POLICY HTTP request for .dll file with no User-Agent |
2756 | Ppbwsfqzrk.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
2756 | Ppbwsfqzrk.exe | A Network Trojan was detected | ET TROJAN Possible Windows executable sent when remote host claims to send a Text File |
2756 | Ppbwsfqzrk.exe | Potentially Bad Traffic | ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download |
2756 | Ppbwsfqzrk.exe | Potential Corporate Privacy Violation | AV POLICY HTTP request for .dll file with no User-Agent |
2756 | Ppbwsfqzrk.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
2756 | Ppbwsfqzrk.exe | A Network Trojan was detected | ET TROJAN Possible Windows executable sent when remote host claims to send a Text File |
2756 | Ppbwsfqzrk.exe | Potentially Bad Traffic | ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download |