File name:

Installer_Regwork.exe.7z

Full analysis: https://app.any.run/tasks/bfefa167-6dde-4c84-9cba-5c599b61556a
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: December 15, 2023, 19:39:25
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

6F3D17F046C3B043C79F678CD58C413B

SHA1:

9237EE7DB9C592E2D98C6975402D59AF78B33127

SHA256:

0123FFB9C0B8FDC947EAFCD79076FEBDE833A80E34D9204218D4F6622D55A3B7

SSDEEP:

98304:L/I152PiGfLhQP61l9tmWKxdW/59yqxvuYVpsVfmKAGceQhLSaNOOKrchydwqybr:ndJI0a

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Installer_Regwork.exe (PID: 3924)
      • cmd.exe (PID: 2968)
      • BACKUPDUTYLITE_INSTALLER.EXE (PID: 2988)
      • FILESOPENEDINSTALLER.EXE (PID: 3916)

    • Changes the autorun value in the registry

      • RegWork.exe (PID: 3668)

  • SUSPICIOUS

    • Malware-specific behavior (creating "System.dll" in Temp)

      • Installer_Regwork.exe (PID: 3924)
      • FILESOPENEDINSTALLER.EXE (PID: 3916)

    • The process creates files with name similar to system file names

      • Installer_Regwork.exe (PID: 3924)
      • BACKUPDUTYLITE_INSTALLER.EXE (PID: 2988)
      • FILESOPENEDINSTALLER.EXE (PID: 3916)

    • Process drops legitimate windows executable

      • Installer_Regwork.exe (PID: 3924)

    • The process drops C-runtime libraries

      • Installer_Regwork.exe (PID: 3924)

    • Starts CMD.EXE for commands execution

      • Installer_Regwork.exe (PID: 3924)
      • BACKUPDUTYLITE_INSTALLER.EXE (PID: 2988)
      • FILESOPENEDINSTALLER.EXE (PID: 3916)

    • Process requests binary or script from the Internet

      • Installer_Regwork.exe (PID: 3924)

    • Reads the Internet Settings

      • RegWork.exe (PID: 3668)
      • Installer_Regwork.exe (PID: 3924)

  • INFO

    • Manual execution by a user

      • Installer_Regwork.exe (PID: 3924)
      • Installer_Regwork.exe (PID: 1352)
      • wmpnscfg.exe (PID: 3156)

    • Checks supported languages

      • CUSTOM_ZASKCHECKER.EXE (PID: 3112)
      • Installer_Regwork.exe (PID: 3924)
      • BACKUPDUTYLITE_INSTALLER.EXE (PID: 2988)
      • BackUpDutyLite.exe (PID: 3684)
      • FILESOPENEDINSTALLER.EXE (PID: 3916)
      • wmpnscfg.exe (PID: 3156)
      • RegWork.exe (PID: 3668)

    • Reads the computer name

      • Installer_Regwork.exe (PID: 3924)
      • BACKUPDUTYLITE_INSTALLER.EXE (PID: 2988)
      • BackUpDutyLite.exe (PID: 3684)
      • FILESOPENEDINSTALLER.EXE (PID: 3916)
      • RegWork.exe (PID: 3668)
      • wmpnscfg.exe (PID: 3156)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 1864)

    • Create files in a temporary directory

      • Installer_Regwork.exe (PID: 3924)
      • BACKUPDUTYLITE_INSTALLER.EXE (PID: 2988)
      • FILESOPENEDINSTALLER.EXE (PID: 3916)

    • Checks proxy server information

      • Installer_Regwork.exe (PID: 3924)

    • Creates files in the program directory

      • Installer_Regwork.exe (PID: 3924)
      • FILESOPENEDINSTALLER.EXE (PID: 3916)
      • cmd.exe (PID: 2968)
      • RegWork.exe (PID: 3668)
      • BACKUPDUTYLITE_INSTALLER.EXE (PID: 2988)

    • The executable file from the user directory is run by the CMD process

      • BACKUPDUTYLITE_INSTALLER.EXE (PID: 2988)
      • FILESOPENEDINSTALLER.EXE (PID: 3916)
      • CUSTOM_ZASKCHECKER.EXE (PID: 3112)

    • Creates files or folders in the user directory

      • BACKUPDUTYLITE_INSTALLER.EXE (PID: 2988)
      • Installer_Regwork.exe (PID: 3924)
      • RegWork.exe (PID: 3668)

    • Reads Environment values

      • FILESOPENEDINSTALLER.EXE (PID: 3916)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
61
Monitored processes
15
Malicious processes
4
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe no specs installer_regwork.exe no specs installer_regwork.exe cmd.exe no specs custom_zaskchecker.exe no specs cmd.exe no specs cmd.exe no specs backupdutylite_installer.exe no specs cmd.exe no specs backupdutylite.exe no specs cmd.exe no specs filesopenedinstaller.exe no specs cmd.exe no specs wmpnscfg.exe no specs regwork.exe

Process information

PID
CMD
Path
Indicators
Parent process
1352"C:\Users\admin\Desktop\Installer_Regwork.exe" C:\Users\admin\Desktop\Installer_Regwork.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\installer_regwork.exe
c:\windows\system32\ntdll.dll
1864"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Installer_Regwork.exe.7z"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1936C:\Windows\system32\cmd.exe /C "C:\Users\admin\Local Settings\Temp\RegWork\custom_zaskchecker.exe"C:\Windows\System32\cmd.exe—Installer_Regwork.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2520C:\Windows\system32\cmd.exe /C "C:\Users\admin\Local Settings\Temp\RegWork\BackUpDutyLite_Installer.exe" /SC:\Windows\System32\cmd.exe—Installer_Regwork.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2968C:\Windows\system32\cmd.exe /C COPY "C:\Program Files\Files Opened\FilesOpened.ex1" /B + "C:\Program Files\Files Opened\FilesOpened.ex2" /B "C:\Program Files\Files Opened\FilesOpened.exe" /BC:\Windows\System32\cmd.exe—FILESOPENEDINSTALLER.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2988"C:\Users\admin\Local Settings\Temp\RegWork\BackUpDutyLite_Installer.exe" /SC:\Users\admin\AppData\Local\Temp\RegWork\BACKUPDUTYLITE_INSTALLER.EXE—cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\regwork\backupdutylite_installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
3092C:\Windows\system32\cmd.exe /C "C:\Users\admin\Local Settings\Temp\RegWork\filesopenedinstaller.exe" /SC:\Windows\System32\cmd.exe—Installer_Regwork.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3112"C:\Users\admin\Local Settings\Temp\RegWork\custom_zaskchecker.exe"C:\Users\admin\AppData\Local\Temp\RegWork\CUSTOM_ZASKCHECKER.EXE—cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\regwork\custom_zaskchecker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3156"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3276C:\Windows\system32\cmd.exe /C "C:\Users\admin\Local Settings\Temp\RegWork\ApnToolbarInstaller.exe" /tbr /sa /hpr toolbar=BCPAC:\Windows\System32\cmd.exe—Installer_Regwork.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
4 215
Read events
4 164
Write events
51
Delete events
0

Modification events

(PID) Process:(1864) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1864) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(1864) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(1864) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(1864) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1864) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1864) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1864) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1864) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
(PID) Process:(1864) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\General
Operation:writeName:LastFolder
Value:
C:\Users\admin\Desktop
Executable files
28
Suspicious files
11
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
3924Installer_Regwork.exeC:\Program Files\RegWork\msvcr90.dllexecutable
MD5:E7D91D008FE76423962B91C43C88E4EB
SHA256:ED0170D3DE86DA33E02BFA1605EEC8FF6010583481B1C530843867C1939D2185
3924Installer_Regwork.exeC:\Users\admin\AppData\Local\Temp\nsm4C4B.tmp\modern-wizard.bmpimage
MD5:CBE40FD2B1EC96DAEDC65DA172D90022
SHA256:3AD2DC318056D0A2024AF1804EA741146CFC18CC404649A44610CBF8B2056CF2
3924Installer_Regwork.exeC:\Program Files\RegWork\Microsoft.VC90.CRT.manifestxml
MD5:6BB5D2AAD0AE1B4A82E7DDF7CF58802A
SHA256:9E0220511D4EBDB014CC17ECB8319D57E3B0FEA09681A80D8084AA8647196582
3924Installer_Regwork.exeC:\Users\admin\AppData\Local\Temp\nsm4C4B.tmp\System.dllexecutable
MD5:C17103AE9072A06DA581DEC998343FC1
SHA256:DC58D8AD81CACB0C1ED72E33BFF8F23EA40B5252B5BB55D393A0903E6819AE2F
3924Installer_Regwork.exeC:\Program Files\RegWork\mfcm90u.dllexecutable
MD5:371226B8346F29011137C7AA9E93F2F6
SHA256:5B08FE55E4BBF2FBFD405E2477E023137CFCEB4D115650A5668269C03300A8F8
3924Installer_Regwork.exeC:\Program Files\RegWork\mfc90u.dllexecutable
MD5:B9030D821E099C79DE1C9125B790E2DA
SHA256:E30AABB518361FBEAF8068FFC786845EE84ABBF1F71AE7D2733A11286531595A
3924Installer_Regwork.exeC:\Users\admin\AppData\Local\Temp\nsm4C4B.tmp\NSISdl.dllexecutable
MD5:A5F8399A743AB7F9C88C645C35B1EBB5
SHA256:DACC88A12D3BA438FDAE3535DC7A5A1D389BCE13ADC993706424874A782E51C9
3924Installer_Regwork.exeC:\Users\admin\AppData\Local\Temp\RegWork\asktoolbar.bmpimage
MD5:008D9425077FEFE91AAFCE057E92F1C3
SHA256:96FB1D9319B7752111E209101CAC05B23A763EE391BEA9D52F7B124F904739D9
3924Installer_Regwork.exeC:\Program Files\RegWork\Microsoft.VC90.MFC.manifestxml
MD5:CE3AB3BD3FF80FCE88DCB0EA3D48A0C9
SHA256:F7205C5C0A629D0CC60E30E288E339F08616BE67B55757D4A403A2B54E23922B
3924Installer_Regwork.exeC:\Program Files\RegWork\msvcm90.dllexecutable
MD5:4A8BC195ABDC93F0DB5DAB7F5093C52F
SHA256:B371AF3CE6CB5D0B411919A188D5274DF74D5EE49F6DD7B1CCB5A31466121A18
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
5
DNS requests
2
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3924
Installer_Regwork.exe
GET
200
54.231.194.201:80
http://regwork.s3.amazonaws.com/filesopenedinstaller.exe
unknown
executable
151 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3924
Installer_Regwork.exe
54.231.194.201:80
regwork.s3.amazonaws.com
AMAZON-02
US
unknown

DNS requests

Domain
IP
Reputation
apnmedia.ask.com
  • —
unknown
regwork.s3.amazonaws.com
  • 54.231.194.201
  • 52.217.75.60
  • 52.217.163.17
  • 16.182.37.65
  • 54.231.199.33
  • 16.182.74.25
  • 3.5.11.226
  • 3.5.29.227
unknown

Threats

PID
Process
Class
Message
3924
Installer_Regwork.exe
Potentially Bad Traffic
ET POLICY Executable served from Amazon S3
3924
Installer_Regwork.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Installer_Regwork.exe.7z