File name:

InformaalFrog_Adventures_v0.1.3_1150494631583289475.zip

Full analysis: https://app.any.run/tasks/10d2af22-6486-4a66-b7c4-1d1f940e48ef
Verdict: Malicious activity
Analysis date: December 25, 2024, 19:28:06
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-doc
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=store
MD5:

F2D916EC8E5ADFCAB7D7A6C871AD71C0

SHA1:

E4C677D1958DDE76E0027B896285AD9EB48456E0

SHA256:

0047FB3093FC06FB424CF032217575CA1CFB36C59A0043B60751D6B9A78D8A36

SSDEEP:

98304:aQJEonX2XQFAeXyryNUkQqkr84MR/bP7hURTb6HZsYDOcVOxNo7xfUroCex8x4kK:ZDA2toUc3fE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Antivirus name has been found in the command line (generic signature)

      • MpCmdRun.exe (PID: 6156)
      • MpCmdRun.exe (PID: 6332)
      • MpCmdRun.exe (PID: 6468)

  • SUSPICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 4504)

    • Starts CMD.EXE for commands execution

      • WinRAR.exe (PID: 4504)

    • Executing commands from a ".bat" file

      • WinRAR.exe (PID: 4504)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 4504)

  • INFO

    • Manual execution by a user

      • notepad.exe (PID: 5592)
      • notepad.exe (PID: 5888)
      • notepad.exe (PID: 3952)
      • notepad.exe (PID: 5236)
      • notepad.exe (PID: 4528)
      • rundll32.exe (PID: 644)
      • rundll32.exe (PID: 3076)
      • rundll32.exe (PID: 1144)
      • rundll32.exe (PID: 5208)
      • rundll32.exe (PID: 5720)

    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 5592)
      • notepad.exe (PID: 4528)
      • notepad.exe (PID: 5236)
      • notepad.exe (PID: 3952)
      • notepad.exe (PID: 5888)

    • The process uses the downloaded file

      • WinRAR.exe (PID: 4504)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 4504)

    • Create files in a temporary directory

      • MpCmdRun.exe (PID: 6156)

    • Checks supported languages

      • MpCmdRun.exe (PID: 6156)
      • MpCmdRun.exe (PID: 6332)
      • MpCmdRun.exe (PID: 6468)

    • Reads the computer name

      • MpCmdRun.exe (PID: 6156)
      • MpCmdRun.exe (PID: 6332)
      • MpCmdRun.exe (PID: 6468)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 4504)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0800
ZipCompression: None
ZipModifyDate: 2024:12:25 18:50:18
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: InformaalFrog Adventures v0.1.3/Images/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
139
Monitored processes
20
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe notepad.exe no specs notepad.exe no specs notepad.exe no specs notepad.exe no specs notepad.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs cmd.exe no specs conhost.exe no specs mpcmdrun.exe no specs cmd.exe no specs conhost.exe no specs mpcmdrun.exe no specs cmd.exe no specs conhost.exe no specs mpcmdrun.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
644"C:\WINDOWS\System32\rundll32.exe" "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\admin\Desktop\mapMask.pngC:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
1144"C:\WINDOWS\System32\rundll32.exe" "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\admin\Desktop\upgrade1.pngC:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
3076"C:\WINDOWS\System32\rundll32.exe" "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\admin\Desktop\circleTEST1.pngC:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
3952"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\uiFORMAT.txtC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
4504"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\InformaalFrog_Adventures_v0.1.3_1150494631583289475.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4528"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\WebhookSettings.txtC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
5208"C:\WINDOWS\System32\rundll32.exe" "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\admin\Desktop\circleTEST3.pngC:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
5236"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\temp.txtC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
5592"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\PlanetSettings.txtC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
5720"C:\WINDOWS\System32\rundll32.exe" "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\admin\Desktop\upgrade8.pngC:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
Total events
5 068
Read events
5 057
Write events
11
Delete events
0

Modification events

(PID) Process:(4504) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(4504) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(4504) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(4504) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\InformaalFrog_Adventures_v0.1.3_1150494631583289475.zip
(PID) Process:(4504) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(4504) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(4504) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(4504) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(4504) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\VirusScan
Operation:writeName:DefScanner
Value:
Windows Defender
Executable files
3
Suspicious files
0
Text files
139
Unknown types
0

Dropped files

PID
Process
Filename
Type
4504WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR4504.22296\InformaalFrog_Adventures_v0.1.3_1150494631583289475.zip\InformaalFrog Adventures v0.1.3\Images\Other\Other\discord_logo.pngimage
MD5:BDC2EAA07994774A82F1E918888FB669
SHA256:BE87DF302AD14EC5FF99AE03752B626D2729C8D3DA5282651F953C4B3C089D15
4504WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR4504.22296\InformaalFrog_Adventures_v0.1.3_1150494631583289475.zip\InformaalFrog Adventures v0.1.3\Images\Other\Upgrades\upgrade10.pngimage
MD5:1602EA7DCF8CCD83D967D9252AB71152
SHA256:74D52E5DE0C4041D4084147BD3193A5283844D3C02863C9746A75416AD7D5F2D
4504WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR4504.22296\InformaalFrog_Adventures_v0.1.3_1150494631583289475.zip\InformaalFrog Adventures v0.1.3\Images\Other\Upgrades\upgrade12.pngimage
MD5:FD96AB9B349A79AC868B01363205C243
SHA256:DC0D94CA4B013F7227AFE45530CF34DF30626AB7F0D9927E10CE90DC686879E2
4504WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR4504.22296\InformaalFrog_Adventures_v0.1.3_1150494631583289475.zip\InformaalFrog Adventures v0.1.3\Images\Other\Reconnect\Reconnect.pngimage
MD5:77720798DB5559669AF1671ADC431E7D
SHA256:7439D4CD020F3BC871A429280369BACFECCB2D87938FD193E9DA963A9AF2C4F8
4504WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR4504.22296\InformaalFrog_Adventures_v0.1.3_1150494631583289475.zip\InformaalFrog Adventures v0.1.3\Images\Other\Upgrades\upgrade0.pngimage
MD5:3EC69D1E6C059A42F253B51EDB448E8A
SHA256:862BCF5612144D0B4741B74A6C1CC7F79F60C1CECCF31DF7DD44EF3F36894B1E
4504WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR4504.22296\InformaalFrog_Adventures_v0.1.3_1150494631583289475.zip\InformaalFrog Adventures v0.1.3\Images\Other\Upgrades\upgrade6.pngimage
MD5:4660F642B70CEC589D61E9A651F691D4
SHA256:5BA2D8740E44DAD99DA00AEFACABDC130FD25D7FB669BE4C6E67FF7AEB1D266E
4504WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR4504.22296\InformaalFrog_Adventures_v0.1.3_1150494631583289475.zip\InformaalFrog Adventures v0.1.3\Images\Other\Upgrades\upgrade3.pngimage
MD5:366BB9F37981F145C717B0A670FCDA13
SHA256:6BA3CDD2130BE78E42B4790A1E721507EA3EE4540F0D3AB28E724D716CB25954
4504WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR4504.22296\InformaalFrog_Adventures_v0.1.3_1150494631583289475.zip\InformaalFrog Adventures v0.1.3\Images\Other\Upgrades\upgrade14.pngimage
MD5:78242B02FC8B5A1AFA2385DFCA67CBDC
SHA256:C68684781B044AD96AFF05D79BD88D644810DC9B36B4E8E9FEB64828360CBE7E
4504WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR4504.22296\InformaalFrog_Adventures_v0.1.3_1150494631583289475.zip\InformaalFrog Adventures v0.1.3\Images\Other\Upgrades\upgrade2.pngimage
MD5:57F5B122BDAD2B3A544F08278C28062D
SHA256:9F139214CBC9199CC1E970D598FBD2FBE1D023CDB7A41B9755554730EB52EC20
4504WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR4504.22296\InformaalFrog_Adventures_v0.1.3_1150494631583289475.zip\InformaalFrog Adventures v0.1.3\Images\Other\Upgrades\upgrade13.pngimage
MD5:4115F668D566396A395A827A9DE1F61C
SHA256:92C623D8B7DE245CD34C20D850FEE672DF5222A133E3294E2106373E628B6D1B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
22
DNS requests
7
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1856
RUXIMICS.exe
GET
200
23.48.23.177:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
244
svchost.exe
GET
200
23.48.23.177:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
244
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1856
RUXIMICS.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
244
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1856
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
92.123.104.59:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
192.168.100.255:138
—
—
—
whitelisted
244
svchost.exe
23.48.23.177:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1856
RUXIMICS.exe
23.48.23.177:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
244
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4712
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 92.123.104.59
  • 92.123.104.31
  • 92.123.104.40
  • 92.123.104.63
  • 92.123.104.34
  • 92.123.104.47
whitelisted
google.com
  • 142.250.185.78
whitelisted
crl.microsoft.com
  • 23.48.23.177
  • 23.48.23.173
  • 23.48.23.143
  • 23.48.23.167
  • 23.48.23.145
  • 23.48.23.147
  • 23.48.23.156
  • 23.48.23.166
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
whitelisted
self.events.data.microsoft.com
  • 20.42.65.88
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
InformaalFrog_Adventures_v0.1.3_1150494631583289475.zip