File name:

HxDSetup.zip

Full analysis: https://app.any.run/tasks/71abe795-bd3a-43f2-af80-1d8a790b36c9
Verdict: Malicious activity
Analysis date: July 13, 2020, 16:45:25
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

2656E38DB1789CDA0B7E2F1BB7E0E74A

SHA1:

6CB75B65C52178B77B65D6A690A5CFF27BCAB8F2

SHA256:

06860E17FA2DC943A2F8E1D2B6CA0AB534CD4C456418E804610DB7E866CF717D

SSDEEP:

49152:HTZzVnvuILaW0OxuLbqrbodOiVC7DnV04yLfE9tplC+DuKyNEffpVJ5j15mdFSXX:zLvD0O1FD2/Q13iKUUXmFSXB5x9O1Q

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • HxDSetup.exe (PID: 784)
      • HxDSetup.exe (PID: 1556)
      • HxD.exe (PID: 2916)
      • HxD.exe (PID: 2064)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • HxDSetup.exe (PID: 1556)
      • HxDSetup.exe (PID: 784)
      • HxDSetup.tmp (PID: 2208)

    • Reads Windows owner or organization settings

      • HxDSetup.tmp (PID: 2208)

    • Reads the Windows organization settings

      • HxDSetup.tmp (PID: 2208)

    • Application launched itself

      • HxD.exe (PID: 2916)

    • Searches for installed software

      • HxD.exe (PID: 2916)
      • HxD.exe (PID: 2064)

    • Creates files in the user directory

      • HxD.exe (PID: 2916)
      • HxD.exe (PID: 2064)

  • INFO

    • Manual execution by user

      • HxDSetup.exe (PID: 1556)

    • Application was dropped or rewritten from another process

      • HxDSetup.tmp (PID: 2488)
      • HxDSetup.tmp (PID: 2208)

    • Creates files in the program directory

      • HxDSetup.tmp (PID: 2208)

    • Creates a software uninstall entry

      • HxDSetup.tmp (PID: 2208)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2020:02:28 12:32:16
ZipCRC: 0x5ee75cc1
ZipCompressedSize: 3271836
ZipUncompressedSize: 3369785
ZipFileName: HxDSetup.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
8
Malicious processes
2
Suspicious processes
3

Behavior graph

Click at the process to see the details
start drop and start drop and start winrar.exe no specs hxdsetup.exe hxdsetup.tmp no specs hxdsetup.exe hxdsetup.tmp notepad.exe no specs hxd.exe no specs hxd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
784"C:\Users\admin\Desktop\HxDSetup.exe" /SPAWNWND=$20174 /NOTIFYWND=$30186 C:\Users\admin\Desktop\HxDSetup.exe
HxDSetup.tmp
User:
admin
Company:
Maël Hörz
Integrity Level:
HIGH
Description:
HxD Hex Editor Setup
Exit code:
0
Version:
2.4
Modules
Images
c:\users\admin\desktop\hxdsetup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1556"C:\Users\admin\Desktop\HxDSetup.exe" C:\Users\admin\Desktop\HxDSetup.exe
explorer.exe
User:
admin
Company:
Maël Hörz
Integrity Level:
MEDIUM
Description:
HxD Hex Editor Setup
Exit code:
0
Version:
2.4
Modules
Images
c:\users\admin\desktop\hxdsetup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2064"C:\Program Files\HxD\HxD.exe" /chooselangC:\Program Files\HxD\HxD.exe—HxD.exe
User:
admin
Company:
Maël Hörz
Integrity Level:
MEDIUM
Description:
HxD Hex Editor
Exit code:
0
Version:
2.4.0.0
Modules
Images
c:\program files\hxd\hxd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2092"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\HxD\readme.txtC:\Windows\system32\NOTEPAD.EXE—HxDSetup.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2208"C:\Users\admin\AppData\Local\Temp\is-P11OA.tmp\HxDSetup.tmp" /SL5="$30172,2902046,121344,C:\Users\admin\Desktop\HxDSetup.exe" /SPAWNWND=$20174 /NOTIFYWND=$30186 C:\Users\admin\AppData\Local\Temp\is-P11OA.tmp\HxDSetup.tmp
HxDSetup.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-p11oa.tmp\hxdsetup.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2312"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\HxDSetup.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2488"C:\Users\admin\AppData\Local\Temp\is-DVITI.tmp\HxDSetup.tmp" /SL5="$30186,2902046,121344,C:\Users\admin\Desktop\HxDSetup.exe" C:\Users\admin\AppData\Local\Temp\is-DVITI.tmp\HxDSetup.tmp—HxDSetup.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-dviti.tmp\hxdsetup.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2916"C:\Program Files\HxD\HxD.exe"C:\Program Files\HxD\HxD.exe—HxDSetup.tmp
User:
admin
Company:
Maël Hörz
Integrity Level:
MEDIUM
Description:
HxD Hex Editor
Exit code:
0
Version:
2.4.0.0
Modules
Images
c:\program files\hxd\hxd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
Total events
732
Read events
670
Write events
56
Delete events
6

Modification events

(PID) Process:(2312) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2312) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2312) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2312) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12F\52C64B7E
Operation:writeName:@C:\Windows\system32\NetworkExplorer.dll,-1
Value:
Network
(PID) Process:(2312) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\HxDSetup.zip
(PID) Process:(2312) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2312) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2312) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2312) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2208) HxDSetup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
A0080000640AC1143559D601
Executable files
4
Suspicious files
0
Text files
7
Unknown types
6

Dropped files

PID
Process
Filename
Type
2312WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2312.7830\HxDSetup.exe —
MD5:—
SHA256:—
2208HxDSetup.tmpC:\Program Files\HxD\is-AS68R.tmp —
MD5:—
SHA256:—
2208HxDSetup.tmpC:\Program Files\HxD\is-PP7LT.tmp —
MD5:—
SHA256:—
2208HxDSetup.tmpC:\Program Files\HxD\is-0TC6G.tmp —
MD5:—
SHA256:—
2208HxDSetup.tmpC:\Program Files\HxD\is-K7U5O.tmp —
MD5:—
SHA256:—
2208HxDSetup.tmpC:\Program Files\HxD\is-EU8V6.tmp —
MD5:—
SHA256:—
2208HxDSetup.tmpC:\Program Files\HxD\changelog.txttext
MD5:1794823E1776CC247C9513A95887D630
SHA256:DA9F46D18A981EFED61BDA777499EF1FB6377AEC1161DB01E6EE49AD1CD63843
2208HxDSetup.tmpC:\Program Files\HxD\readme.txttext
MD5:2D2824A9BE812CEAFDD62C3ECC0F4475
SHA256:A80A093D2BD8495F4AFEF3B5E2C34D1124B0818AD1C6FCC63C596F05398F6E30
2208HxDSetup.tmpC:\Program Files\HxD\HxD.exeexecutable
MD5:B06A42F7B3B35B5B2506F4542386A548
SHA256:0A1D3446E92098D0722C8CDDCE206A97557116006BFDEC6CCD0F66EFE98B449B
2208HxDSetup.tmpC:\Program Files\HxD\unins000.exeexecutable
MD5:E0EEC9E8C014B73920ABB1458A16044C
SHA256:7366FEDDC96E7A08E5CCA7416B1B6026FF9ED3E825FFB0FC392B81530F0B48A2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
HxDSetup.zip