File name:

Installer_Regwork.exe.7z

Full analysis: https://app.any.run/tasks/bfefa167-6dde-4c84-9cba-5c599b61556a
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: December 15, 2023, 19:39:25
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

6F3D17F046C3B043C79F678CD58C413B

SHA1:

9237EE7DB9C592E2D98C6975402D59AF78B33127

SHA256:

0123FFB9C0B8FDC947EAFCD79076FEBDE833A80E34D9204218D4F6622D55A3B7

SSDEEP:

98304:L/I152PiGfLhQP61l9tmWKxdW/59yqxvuYVpsVfmKAGceQhLSaNOOKrchydwqybr:ndJI0a

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Installer_Regwork.exe (PID: 3924)
      • BACKUPDUTYLITE_INSTALLER.EXE (PID: 2988)
      • FILESOPENEDINSTALLER.EXE (PID: 3916)
      • cmd.exe (PID: 2968)

    • Changes the autorun value in the registry

      • RegWork.exe (PID: 3668)

  • SUSPICIOUS

    • Malware-specific behavior (creating "System.dll" in Temp)

      • Installer_Regwork.exe (PID: 3924)
      • FILESOPENEDINSTALLER.EXE (PID: 3916)

    • The process creates files with name similar to system file names

      • Installer_Regwork.exe (PID: 3924)
      • BACKUPDUTYLITE_INSTALLER.EXE (PID: 2988)
      • FILESOPENEDINSTALLER.EXE (PID: 3916)

    • Starts CMD.EXE for commands execution

      • Installer_Regwork.exe (PID: 3924)
      • BACKUPDUTYLITE_INSTALLER.EXE (PID: 2988)
      • FILESOPENEDINSTALLER.EXE (PID: 3916)

    • Process drops legitimate windows executable

      • Installer_Regwork.exe (PID: 3924)

    • The process drops C-runtime libraries

      • Installer_Regwork.exe (PID: 3924)

    • Reads the Internet Settings

      • Installer_Regwork.exe (PID: 3924)
      • RegWork.exe (PID: 3668)

    • Process requests binary or script from the Internet

      • Installer_Regwork.exe (PID: 3924)

  • INFO

    • Manual execution by a user

      • Installer_Regwork.exe (PID: 3924)
      • Installer_Regwork.exe (PID: 1352)
      • wmpnscfg.exe (PID: 3156)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 1864)

    • Checks supported languages

      • Installer_Regwork.exe (PID: 3924)
      • BACKUPDUTYLITE_INSTALLER.EXE (PID: 2988)
      • CUSTOM_ZASKCHECKER.EXE (PID: 3112)
      • BackUpDutyLite.exe (PID: 3684)
      • FILESOPENEDINSTALLER.EXE (PID: 3916)
      • wmpnscfg.exe (PID: 3156)
      • RegWork.exe (PID: 3668)

    • Reads the computer name

      • Installer_Regwork.exe (PID: 3924)
      • BACKUPDUTYLITE_INSTALLER.EXE (PID: 2988)
      • BackUpDutyLite.exe (PID: 3684)
      • FILESOPENEDINSTALLER.EXE (PID: 3916)
      • wmpnscfg.exe (PID: 3156)
      • RegWork.exe (PID: 3668)

    • Checks proxy server information

      • Installer_Regwork.exe (PID: 3924)

    • The executable file from the user directory is run by the CMD process

      • CUSTOM_ZASKCHECKER.EXE (PID: 3112)
      • BACKUPDUTYLITE_INSTALLER.EXE (PID: 2988)
      • FILESOPENEDINSTALLER.EXE (PID: 3916)

    • Create files in a temporary directory

      • Installer_Regwork.exe (PID: 3924)
      • BACKUPDUTYLITE_INSTALLER.EXE (PID: 2988)
      • FILESOPENEDINSTALLER.EXE (PID: 3916)

    • Creates files in the program directory

      • Installer_Regwork.exe (PID: 3924)
      • BACKUPDUTYLITE_INSTALLER.EXE (PID: 2988)
      • cmd.exe (PID: 2968)
      • RegWork.exe (PID: 3668)
      • FILESOPENEDINSTALLER.EXE (PID: 3916)

    • Creates files or folders in the user directory

      • BACKUPDUTYLITE_INSTALLER.EXE (PID: 2988)
      • Installer_Regwork.exe (PID: 3924)
      • RegWork.exe (PID: 3668)

    • Reads Environment values

      • FILESOPENEDINSTALLER.EXE (PID: 3916)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
61
Monitored processes
15
Malicious processes
4
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe no specs installer_regwork.exe no specs installer_regwork.exe cmd.exe no specs custom_zaskchecker.exe no specs cmd.exe no specs cmd.exe no specs backupdutylite_installer.exe no specs cmd.exe no specs backupdutylite.exe no specs cmd.exe no specs filesopenedinstaller.exe no specs cmd.exe no specs wmpnscfg.exe no specs regwork.exe

Process information

PID
CMD
Path
Indicators
Parent process
1352"C:\Users\admin\Desktop\Installer_Regwork.exe" C:\Users\admin\Desktop\Installer_Regwork.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\installer_regwork.exe
c:\windows\system32\ntdll.dll
1864"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Installer_Regwork.exe.7z"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1936C:\Windows\system32\cmd.exe /C "C:\Users\admin\Local Settings\Temp\RegWork\custom_zaskchecker.exe"C:\Windows\System32\cmd.exe—Installer_Regwork.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2520C:\Windows\system32\cmd.exe /C "C:\Users\admin\Local Settings\Temp\RegWork\BackUpDutyLite_Installer.exe" /SC:\Windows\System32\cmd.exe—Installer_Regwork.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2968C:\Windows\system32\cmd.exe /C COPY "C:\Program Files\Files Opened\FilesOpened.ex1" /B + "C:\Program Files\Files Opened\FilesOpened.ex2" /B "C:\Program Files\Files Opened\FilesOpened.exe" /BC:\Windows\System32\cmd.exe—FILESOPENEDINSTALLER.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2988"C:\Users\admin\Local Settings\Temp\RegWork\BackUpDutyLite_Installer.exe" /SC:\Users\admin\AppData\Local\Temp\RegWork\BACKUPDUTYLITE_INSTALLER.EXE—cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\regwork\backupdutylite_installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
3092C:\Windows\system32\cmd.exe /C "C:\Users\admin\Local Settings\Temp\RegWork\filesopenedinstaller.exe" /SC:\Windows\System32\cmd.exe—Installer_Regwork.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3112"C:\Users\admin\Local Settings\Temp\RegWork\custom_zaskchecker.exe"C:\Users\admin\AppData\Local\Temp\RegWork\CUSTOM_ZASKCHECKER.EXE—cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\regwork\custom_zaskchecker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3156"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3276C:\Windows\system32\cmd.exe /C "C:\Users\admin\Local Settings\Temp\RegWork\ApnToolbarInstaller.exe" /tbr /sa /hpr toolbar=BCPAC:\Windows\System32\cmd.exe—Installer_Regwork.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
4 215
Read events
4 164
Write events
51
Delete events
0

Modification events

(PID) Process:(1864) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1864) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(1864) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(1864) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(1864) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1864) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1864) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1864) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1864) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
(PID) Process:(1864) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\General
Operation:writeName:LastFolder
Value:
C:\Users\admin\Desktop
Executable files
28
Suspicious files
11
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
1864WinRAR.exeC:\Users\admin\Desktop\Installer_Regwork.exeexecutable
MD5:B440EAC5600B169BE51F5FB8411B2910
SHA256:1E7E67DE997272ADBFE616C040D5C835AF728980A648333CA96A267D84093A0B
3924Installer_Regwork.exeC:\Users\admin\AppData\Local\Temp\nsm4C4B.tmp\ExecCmd.dllexecutable
MD5:B9380B0BEA8854FD9F93CC1FDA0DFEAC
SHA256:1F4BD9C9376FE1B6913BAECA7FB6DF6467126F27C9C2FE038206567232A0E244
3924Installer_Regwork.exeC:\Users\admin\AppData\Local\Temp\nsm4C4B.tmp\System.dllexecutable
MD5:C17103AE9072A06DA581DEC998343FC1
SHA256:DC58D8AD81CACB0C1ED72E33BFF8F23EA40B5252B5BB55D393A0903E6819AE2F
3924Installer_Regwork.exeC:\Users\admin\AppData\Local\Temp\nsm4C4B.tmp\modern-wizard.bmpimage
MD5:CBE40FD2B1EC96DAEDC65DA172D90022
SHA256:3AD2DC318056D0A2024AF1804EA741146CFC18CC404649A44610CBF8B2056CF2
3924Installer_Regwork.exeC:\Users\admin\AppData\Local\Temp\nsm4C4B.tmp\nsDialogs.dllexecutable
MD5:C10E04DD4AD4277D5ADC951BB331C777
SHA256:E31AD6C6E82E603378CB6B80E67D0E0DCD9CF384E1199AC5A65CB4935680021A
3924Installer_Regwork.exeC:\Program Files\RegWork\Microsoft.VC90.CRT.manifestxml
MD5:6BB5D2AAD0AE1B4A82E7DDF7CF58802A
SHA256:9E0220511D4EBDB014CC17ECB8319D57E3B0FEA09681A80D8084AA8647196582
3924Installer_Regwork.exeC:\Program Files\RegWork\msvcr90.dllexecutable
MD5:E7D91D008FE76423962B91C43C88E4EB
SHA256:ED0170D3DE86DA33E02BFA1605EEC8FF6010583481B1C530843867C1939D2185
3924Installer_Regwork.exeC:\Users\admin\AppData\Local\Temp\RegWork\asktoolbar.bmpimage
MD5:008D9425077FEFE91AAFCE057E92F1C3
SHA256:96FB1D9319B7752111E209101CAC05B23A763EE391BEA9D52F7B124F904739D9
3924Installer_Regwork.exeC:\Program Files\RegWork\RegFixer.dllexecutable
MD5:8C8D154F0920BA1AF5C47115851D08EB
SHA256:59940AA51FB05E29411D7DCC4E531A194C079FC0EB8D5571222640C5896B7D38
3924Installer_Regwork.exeC:\Program Files\RegWork\RegWork.exeexecutable
MD5:2780DD304C2701358F92B74AC8EAE51F
SHA256:07DA3A4728F336CB377D5DD8052BE08703AC2416A34FFB67C26A61482AFA7D43
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
5
DNS requests
2
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3924
Installer_Regwork.exe
GET
200
54.231.194.201:80
http://regwork.s3.amazonaws.com/filesopenedinstaller.exe
unknown
executable
151 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3924
Installer_Regwork.exe
54.231.194.201:80
regwork.s3.amazonaws.com
AMAZON-02
US
unknown

DNS requests

Domain
IP
Reputation
apnmedia.ask.com
  • —
unknown
regwork.s3.amazonaws.com
  • 54.231.194.201
  • 52.217.75.60
  • 52.217.163.17
  • 16.182.37.65
  • 54.231.199.33
  • 16.182.74.25
  • 3.5.11.226
  • 3.5.29.227
unknown

Threats

PID
Process
Class
Message
3924
Installer_Regwork.exe
Potentially Bad Traffic
ET POLICY Executable served from Amazon S3
3924
Installer_Regwork.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Installer_Regwork.exe.7z