File name:

hidemy.name_vpn_1.60_portable.zip

Full analysis: https://app.any.run/tasks/4ef448c5-7f80-4b9b-8a6f-2336375132ee
Verdict: Malicious activity
Analysis date: September 25, 2021, 11:38:30
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

F59F60C2119A6C17D3CE9AA3CC25F3E8

SHA1:

814BF90D5DEB8E2E3C35A7F93C4E889FA7ACEE98

SHA256:

0C8653C783F51834542CEF427CBD3374D8E6D26048906F9A142F5A836EC3892B

SSDEEP:

196608:WSiqJneJuvKqA3xuKzdD65w70VpHislS25NV:LzJneJsBkxukdD6+cpHiNUX

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Start.exe (PID: 2868)
      • Start.exe (PID: 2484)
      • pkzip25.exe (PID: 3816)
      • pkzip25.exe (PID: 920)
      • pkzip25.exe (PID: 3788)
      • pkzip25.exe (PID: 2804)
      • pkzip25.exe (PID: 3336)
      • pkzip25.exe (PID: 968)

    • Loads dropped or rewritten executable

      • Start.exe (PID: 2484)
      • SearchProtocolHost.exe (PID: 2472)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2564)

    • Checks supported languages

      • WinRAR.exe (PID: 2564)
      • Start.exe (PID: 2484)
      • pkzip25.exe (PID: 3816)
      • pkzip25.exe (PID: 920)
      • pkzip25.exe (PID: 3788)
      • pkzip25.exe (PID: 2804)
      • pkzip25.exe (PID: 3336)
      • pkzip25.exe (PID: 968)

    • Reads the computer name

      • WinRAR.exe (PID: 2564)
      • Start.exe (PID: 2484)

    • Drops a file that was compiled in debug mode

      • WinRAR.exe (PID: 2564)

    • Reads default file associations for system extensions

      • SearchProtocolHost.exe (PID: 2472)

    • Drops a file with too old compile date

      • WinRAR.exe (PID: 2564)

  • INFO

    • Manual execution by user

      • Start.exe (PID: 2868)
      • Start.exe (PID: 2484)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: VPN/countries.ini
ZipUncompressedSize: 4148
ZipCompressedSize: 2296
ZipCRC: 0xa55875af
ZipModifyDate: 2020:11:03 23:54:22
ZipCompression: Deflated
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
52
Monitored processes
10
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe start.exe no specs start.exe searchprotocolhost.exe no specs pkzip25.exe no specs pkzip25.exe no specs pkzip25.exe no specs pkzip25.exe no specs pkzip25.exe no specs pkzip25.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
920 -silent -overwrite -extract "C:\Users\admin\AppData\Local\Temp\tmp_gui\conf.zip" "C:\Users\admin\AppData\Local\Temp\tmp_gui"C:\Users\admin\Desktop\VPN\utils\pkzip25.exe—Start.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\vpn\utils\pkzip25.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
968 -silent -overwrite -extract "C:\Users\admin\AppData\Local\Temp\tmp_gui\conf.zip" "C:\Users\admin\AppData\Local\Temp\tmp_gui"C:\Users\admin\Desktop\VPN\utils\pkzip25.exe—Start.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\vpn\utils\pkzip25.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2472"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\system32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7601.24542 (win7sp1_ldr_escrow.191209-2211)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2484"C:\Users\admin\Desktop\VPN\Start.exe" C:\Users\admin\Desktop\VPN\Start.exe
Explorer.EXE
User:
admin
Company:
inCloak Network Ltd.
Integrity Level:
HIGH
Exit code:
0
Version:
1.6
Modules
Images
c:\users\admin\desktop\vpn\start.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
2564"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\hidemy.name_vpn_1.60_portable.zip"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2804 -silent -overwrite -extract "C:\Users\admin\Desktop\VPN\configs\HIDEME_52530359486117.ZIP" "C:\Users\admin\Desktop\VPN\configs"C:\Users\admin\Desktop\VPN\utils\pkzip25.exe—Start.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\vpn\utils\pkzip25.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
2868"C:\Users\admin\Desktop\VPN\Start.exe" C:\Users\admin\Desktop\VPN\Start.exe—Explorer.EXE
User:
admin
Company:
inCloak Network Ltd.
Integrity Level:
MEDIUM
Exit code:
3221226540
Version:
1.6
Modules
Images
c:\users\admin\desktop\vpn\start.exe
c:\windows\system32\ntdll.dll
3336 -silent -overwrite -extract "C:\Users\admin\AppData\Local\Temp\tmp_gui\conf.zip" "C:\Users\admin\AppData\Local\Temp\tmp_gui"C:\Users\admin\Desktop\VPN\utils\pkzip25.exe—Start.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\vpn\utils\pkzip25.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3788 -silent -overwrite -extract "C:\Users\admin\Desktop\VPN\ike2\cert\HIDEME_52530359486117_IPSEC.ZIP" "C:\Users\admin\Desktop\VPN\ike2\cert"C:\Users\admin\Desktop\VPN\utils\pkzip25.exe—Start.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\vpn\utils\pkzip25.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3816 -silent -overwrite -extract "C:\Users\admin\Desktop\VPN\HIDEME_52530359486117.ZIP" "C:\Users\admin\Desktop\VPN"C:\Users\admin\Desktop\VPN\utils\pkzip25.exe—Start.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\vpn\utils\pkzip25.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
4 500
Read events
4 478
Write events
22
Delete events
0

Modification events

(PID) Process:(2564) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2564) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2564) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2564) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2564) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\hidemy.name_vpn_1.60_portable.zip
(PID) Process:(2564) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2564) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2564) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2564) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2472) SearchProtocolHost.exeKey:HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
25
Suspicious files
18
Text files
451
Unknown types
4

Dropped files

PID
Process
Filename
Type
2564WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2564.8915\VPN\driver\x64\OemWin2k.infbinary
MD5:B6AADA0CBED06889053A05B66F146979
SHA256:A6E72B88E42D2B478615C5A16BBEDB3FD02B0DD3DEF3A79840FC6A5DF8312707
2564WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2564.8915\VPN\countries.initext
MD5:49F53C48C7AC1BF851529522AD58C681
SHA256:5465E8D706C887C2D174E5E7995B071FB0007693949F5AA98D5C0907DBC5459F
2564WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2564.8915\VPN\driver\x64\tap0901.catcat
MD5:0365C95D5BE2B3D314DCC019380C0E11
SHA256:6F997D53ABFC991E23F08256FBDE3EB21A1680AF2E504B7ACCFEF0F1D8909503
2564WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2564.8915\VPN\driver\tap99update.exeexecutable
MD5:AC9B2624EF366742C9AD32B86225A251
SHA256:02E1013EE8D548EDC3FBAFAB672977EA8C677CF1F0B57018652FCF2A2411CBFB
2564WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2564.8915\VPN\flags\AD.icoimage
MD5:A8358B485820DE16F70EAE9BEF692FD2
SHA256:0212D5066B17BD3988153D5F73EE039D278E4B0CFE0DF4571DA1DBE4C8590380
2564WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2564.8915\VPN\flags\AQ.icoimage
MD5:266E92E76C30FB5AFFB94060597F4DEE
SHA256:D47344E92C00606221F17A86FD58FC5911A246DEF977FE519959596B3B736B2F
2564WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2564.8915\VPN\flags\AO.icoimage
MD5:279F417780A05D08ACDB1A5923C17114
SHA256:4C77A9104AADC484C4A0960224977621EB939275935CE623CA89722907E897AD
2564WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2564.8915\VPN\flags\AF.icoimage
MD5:D1A4BFD1D95B1B3ADE5CA79534055F9E
SHA256:E924BCC8F490ADDFED20ADDF97A227AA8CDEC23BB97F6F9E7C7251D3F711664E
2564WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2564.8915\VPN\flags\AI.icoimage
MD5:575BF6B1F2D0A3A8DE5C1AA14349D1B9
SHA256:FCA6C66E8C9276D16B903F193222F554EEC984CD3735E14EA2FC48066827CFFF
2564WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2564.8915\VPN\flags\AM.icoimage
MD5:18D41EA5091671D1E1B27431AEC211D3
SHA256:212DC3AF80B87E6A530B7B872FADF7889A8B674B89DDC4247C249C06060AD2B2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
11
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2484
Start.exe
104.26.9.174:443
justapi.info
Cloudflare Inc
US
unknown

DNS requests

Domain
IP
Reputation
justapi.info
  • 104.26.9.174
  • 172.67.71.120
  • 104.26.8.174
suspicious

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
hidemy.name_vpn_1.60_portable.zip