File name:

Masaüstü.zip

Full analysis: https://app.any.run/tasks/f3fcd788-6a52-43ba-bfbd-d0783e4909a5
Verdict: Malicious activity
Analysis date: October 05, 2022, 06:59:19
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

958FDD16B1E9C8AFF868BA8FF1F263B8

SHA1:

20EDD3A8831818954B1280A2A8BABDA7BBC42C18

SHA256:

0A5C2C19DC97377D811DFF9E8397DE7FE1CB3967103823A89CC928E0D4207B0D

SSDEEP:

98304:8MUGU7xNNiJdXz8o3X/kJMbSmFFOtOLplRPNnxg+:8MIXGdz8onoMbhFOKp/NR

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • setup.exe (PID: 1236)
      • setup.exe (PID: 3804)
      • USBGuard.exe (PID: 500)
      • USBGuardUpdate.exe (PID: 2548)
      • USBGuardUpdate.exe (PID: 2256)
      • usb_disk_security.ts3 (PID: 4068)
      • USBGuardUpdate.exe (PID: 3848)

    • Changes the autorun value in the registry

      • setup.tmp (PID: 2364)

    • Saves itself using an automatic execution at the hidden registry location

      • setup.tmp (PID: 2364)

    • Loads dropped or rewritten executable

      • USBGuard.exe (PID: 500)

  • SUSPICIOUS

    • Reads the machine GUID from the registry

      • WinRAR.exe (PID: 1188)
      • USBGuardUpdate.exe (PID: 2256)
      • USBGuardUpdate.exe (PID: 3848)

    • Reads Internet Settings

      • WinRAR.exe (PID: 1188)
      • USBGuard.exe (PID: 500)
      • USBGuardUpdate.exe (PID: 2256)
      • USBGuardUpdate.exe (PID: 3848)

    • Reads the Windows owner or organization settings

      • setup.tmp (PID: 2364)
      • USBGuardUpdate.exe (PID: 2256)
      • USBGuardUpdate.exe (PID: 3848)

    • Creates a directory in Program Files

      • setup.tmp (PID: 2364)

    • Executed via COM

      • DllHost.exe (PID: 3616)

    • Starts application with an unusual extension

      • USBGuardUpdate.exe (PID: 2256)

    • Starts itself from another location

      • usb_disk_security.ts3 (PID: 4068)

  • INFO

    • Checks supported languages

      • WinRAR.exe (PID: 1188)
      • setup.exe (PID: 1236)
      • setup.tmp (PID: 3400)
      • setup.exe (PID: 3804)
      • setup.tmp (PID: 2364)
      • USBGuard.exe (PID: 500)
      • USBGuardUpdate.exe (PID: 2256)
      • usb_disk_security.ts3 (PID: 4068)
      • USBGuardUpdate.exe (PID: 3848)

    • Process checks LSA protection

      • WinRAR.exe (PID: 1188)
      • setup.tmp (PID: 3400)
      • setup.tmp (PID: 2364)
      • USBGuard.exe (PID: 500)
      • USBGuardUpdate.exe (PID: 2256)
      • USBGuardUpdate.exe (PID: 3848)

    • Reads the computer name

      • WinRAR.exe (PID: 1188)
      • setup.tmp (PID: 3400)
      • setup.tmp (PID: 2364)
      • USBGuard.exe (PID: 500)
      • USBGuardUpdate.exe (PID: 2256)
      • USBGuardUpdate.exe (PID: 3848)

    • Creates files in the user directory

      • WinRAR.exe (PID: 1188)
      • USBGuard.exe (PID: 500)
      • USBGuardUpdate.exe (PID: 2256)
      • USBGuardUpdate.exe (PID: 3848)

    • Creates a file in a temporary directory

      • setup.exe (PID: 1236)
      • WinRAR.exe (PID: 1188)
      • setup.exe (PID: 3804)
      • setup.tmp (PID: 2364)
      • USBGuardUpdate.exe (PID: 2256)
      • USBGuardUpdate.exe (PID: 3848)

    • Application was dropped or rewritten from another process

      • setup.tmp (PID: 3400)
      • setup.tmp (PID: 2364)

    • Loads dropped or rewritten executable

      • setup.tmp (PID: 2364)

    • Creates files in the program directory

      • setup.tmp (PID: 2364)
      • USBGuardUpdate.exe (PID: 2256)
      • usb_disk_security.ts3 (PID: 4068)

    • Reads the machine GUID from the registry

      • DllHost.exe (PID: 3616)

    • Creates a software uninstall entry

      • setup.tmp (PID: 2364)

    • Manual execution by user

      • USBGuard.exe (PID: 500)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
55
Monitored processes
11
Malicious processes
7
Suspicious processes
2

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start winrar.exe no specs setup.exe no specs setup.tmp no specs setup.exe setup.tmp Copy/Move/Rename/Delete/Link Object no specs usbguard.exe no specs usbguardupdate.exe no specs usbguardupdate.exe usb_disk_security.ts3 no specs usbguardupdate.exe

Process information

PID
CMD
Path
Indicators
Parent process
500"C:\Program Files\USB Disk Security\USBGuard.exe" C:\Program Files\USB Disk Security\USBGuard.exe—Explorer.EXE
User:
admin
Company:
Zbshareware Lab
Integrity Level:
MEDIUM
Description:
USB Disk Security
Exit code:
0
Version:
6.0.0.126
Modules
Images
c:\program files\usb disk security\usbguard.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\usb disk security\mfc80u.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1188"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Masaüstü.zip"C:\Program Files\WinRAR\WinRAR.exe—Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1236"C:\Users\admin\AppData\Local\Temp\Rar$EXa1188.33439\setup.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa1188.33439\setup.exe—WinRAR.exe
User:
admin
Company:
Zbshareware Lab
Integrity Level:
MEDIUM
Description:
USB Disk Security Setup
Exit code:
0
Version:
6.0.0.126
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa1188.33439\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2256"C:\Program Files\USB Disk Security\USBGuardUpdate.exe" C:\Program Files\USB Disk Security\USBGuardUpdate.exe
USBGuard.exe
User:
admin
Company:
Indigo Rose Corporation
Integrity Level:
HIGH
Description:
TrueUpdate Client
Exit code:
12
Version:
3.5.4.1
Modules
Images
c:\program files\usb disk security\usbguardupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
2364"C:\Users\admin\AppData\Local\Temp\is-HH2MQ.tmp\setup.tmp" /SL5="$50164,4058717,147456,C:\Users\admin\AppData\Local\Temp\Rar$EXa1188.33439\setup.exe" /SPAWNWND=$40168 /NOTIFYWND=$40184 C:\Users\admin\AppData\Local\Temp\is-HH2MQ.tmp\setup.tmp
setup.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-hh2mq.tmp\setup.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\user32.dll
c:\windows\system32\advapi32.dll
2548"C:\Program Files\USB Disk Security\USBGuardUpdate.exe" C:\Program Files\USB Disk Security\USBGuardUpdate.exe—USBGuard.exe
User:
admin
Company:
Indigo Rose Corporation
Integrity Level:
MEDIUM
Description:
TrueUpdate Client
Exit code:
3221226540
Version:
3.5.4.1
Modules
Images
c:\program files\usb disk security\usbguardupdate.exe
c:\windows\system32\ntdll.dll
3400"C:\Users\admin\AppData\Local\Temp\is-V4BIA.tmp\setup.tmp" /SL5="$40184,4058717,147456,C:\Users\admin\AppData\Local\Temp\Rar$EXa1188.33439\setup.exe" C:\Users\admin\AppData\Local\Temp\is-V4BIA.tmp\setup.tmp—setup.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-v4bia.tmp\setup.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
3616C:\Windows\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}C:\Windows\system32\DllHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3804"C:\Users\admin\AppData\Local\Temp\Rar$EXa1188.33439\setup.exe" /SPAWNWND=$40168 /NOTIFYWND=$40184 C:\Users\admin\AppData\Local\Temp\Rar$EXa1188.33439\setup.exe
setup.tmp
User:
admin
Company:
Zbshareware Lab
Integrity Level:
HIGH
Description:
USB Disk Security Setup
Exit code:
0
Version:
6.0.0.126
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa1188.33439\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\rpcrt4.dll
3848"C:\Program Files\USB Disk Security\USBGuardUpdate.exe" "/TUDEL:usb_disk_security.ts3" "/TUCPS:USBGUARDUPDATE.EXE" "/DATFILE:C:\PROGRAM FILES\USB DISK SECURITY\USBGUARDUPDATE.DAT" /TURCC:\Program Files\USB Disk Security\USBGuardUpdate.exe
usb_disk_security.ts3
User:
admin
Company:
Indigo Rose Corporation
Integrity Level:
HIGH
Description:
TrueUpdate Client
Exit code:
5
Version:
3.5.4.1
Modules
Images
c:\program files\usb disk security\usbguardupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
3 685
Read events
3 558
Write events
126
Delete events
1

Modification events

(PID) Process:(1188) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1188) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1188) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1188) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(1188) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(1188) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Masaüstü.zip
(PID) Process:(1188) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1188) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1188) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1188) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
23
Suspicious files
10
Text files
6
Unknown types
7

Dropped files

PID
Process
Filename
Type
1188WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1188.33142\cr\USBGuard.exeexecutable
MD5:—
SHA256:—
1236setup.exeC:\Users\admin\AppData\Local\Temp\is-V4BIA.tmp\setup.tmpexecutable
MD5:417D7F059F4C679865C76370F713D5B4
SHA256:FB406BFFD287CD20159902B1C6710F75FB60AD887AAF7C363564255B72A282DF
1188WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1188.33439\cr\USBGuard.exeexecutable
MD5:—
SHA256:—
2364setup.tmpC:\Program Files\USB Disk Security\is-3A5ER.tmpxml
MD5:541423A06EFDCD4E4554C719061F82CF
SHA256:17AD1A64BA1C382ABF89341B40950F9B31F95015C6B0D3E25925BFEBC1B53EB5
2364setup.tmpC:\Program Files\USB Disk Security\is-B5KU5.tmpexecutable
MD5:0941314C042769C1B05038D7D2ACCBEC
SHA256:36C84E6BD6EEC2DC5231B81EA7688F1CE0D30FF8B1703AC938B5417455FC170B
2364setup.tmpC:\Program Files\USB Disk Security\is-9VD8E.tmpchm
MD5:A50C9F161DCC4337E83B5AB36A7E2306
SHA256:80EF472FA6E86512B3DFB1F29F3DAAF62ACE441A3D9A75AA730BC6322F24FA54
2364setup.tmpC:\Program Files\USB Disk Security\mfc80u.dllexecutable
MD5:CCC2E312486AE6B80970211DA472268B
SHA256:18BE5D3C656236B7E3CD6D619D62496FE3E7F66BF2859E460F8AC3D1A6BDAA9A
2364setup.tmpC:\Program Files\USB Disk Security\USBGuard.chmchm
MD5:A50C9F161DCC4337E83B5AB36A7E2306
SHA256:80EF472FA6E86512B3DFB1F29F3DAAF62ACE441A3D9A75AA730BC6322F24FA54
2364setup.tmpC:\Program Files\USB Disk Security\unins000.exeexecutable
MD5:0941314C042769C1B05038D7D2ACCBEC
SHA256:36C84E6BD6EEC2DC5231B81EA7688F1CE0D30FF8B1703AC938B5417455FC170B
2364setup.tmpC:\Program Files\USB Disk Security\USBGuard.exeexecutable
MD5:B0323264705099F7F2A433B45E9D0F8F
SHA256:AE48F4CD1BC78DB899A4F69C694F0FAC52EED91372DB165B46C141E6A3DF7C6B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
2
DNS requests
2
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2256
USBGuardUpdate.exe
GET
200
50.116.10.192:80
http://www.zbshareware.net/updatenew/update6/single/usb_disk_security.ts2
US
compressed
67.5 Kb
suspicious
3848
USBGuardUpdate.exe
GET
200
50.116.10.192:80
http://www.zbshareware.com/updatenew/update6/single/usb_disk_security.ts1
US
binary
6.41 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2256
USBGuardUpdate.exe
50.116.10.192:80
www.zbshareware.net
Linode, LLC
US
suspicious
3848
USBGuardUpdate.exe
50.116.10.192:80
www.zbshareware.net
Linode, LLC
US
suspicious

DNS requests

Domain
IP
Reputation
www.zbshareware.net
  • 50.116.10.192
suspicious
www.zbshareware.com
  • 50.116.10.192
malicious

Threats

PID
Process
Class
Message
2256
USBGuardUpdate.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Masaüstü.zip