File name:

wz3-zkjilnirrq.7z

Full analysis: https://app.any.run/tasks/abd0c033-2c2d-43ce-a0ea-f7c0c17129e7
Verdict: Malicious activity
Analysis date: August 08, 2022, 19:21:21
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.3
MD5:

ABEE2FCD919C28FE38AE12F81ADA3DFD

SHA1:

72A6805C2AFEAB0FB8CC88B54405BA2B246B10FA

SHA256:

0CAB1919953BAA9375F99A7876634E32E01F4BE76CC43B222EDAB65ADFF0C83B

SSDEEP:

393216:QaL47swyqhqZyqv3MnsmO914Lbtl5AHml+VrHAl5S4oRW8iz:bwyMqxkn9DSrHAl5AWXz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 3460)
      • WARZONE RAT 3.03.exe (PID: 1292)
      • WZ Crack.exe (PID: 2876)
      • WARZONE RAT 3.03.exe (PID: 1340)
      • WARZONE Password Viewer 1.0.exe (PID: 928)
      • WZ Crack.exe (PID: 3592)
      • WARZONE RAT 3.03.exe (PID: 2632)

    • Application was dropped or rewritten from another process

      • WARZONE RAT 3.03.exe (PID: 1292)
      • WZ Crack.exe (PID: 2876)
      • WARZONE RAT 3.03.exe (PID: 1340)
      • WARZONE Password Viewer 1.0.exe (PID: 928)
      • WZ Crack.exe (PID: 3592)
      • WARZONE RAT 3.03.exe (PID: 2632)

    • Drops executable file immediately after starts

      • WinRAR.exe (PID: 3112)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3112)

    • Checks supported languages

      • WinRAR.exe (PID: 3112)
      • WARZONE RAT 3.03.exe (PID: 1292)
      • WZ Crack.exe (PID: 2876)
      • WARZONE RAT 3.03.exe (PID: 1340)
      • WARZONE RAT 3.03.exe (PID: 2632)
      • WARZONE Password Viewer 1.0.exe (PID: 928)
      • WZ Crack.exe (PID: 3592)

    • Reads the computer name

      • WinRAR.exe (PID: 3112)
      • WARZONE RAT 3.03.exe (PID: 1292)
      • WZ Crack.exe (PID: 2876)
      • WARZONE RAT 3.03.exe (PID: 1340)
      • WARZONE Password Viewer 1.0.exe (PID: 928)
      • WZ Crack.exe (PID: 3592)
      • WARZONE RAT 3.03.exe (PID: 2632)

    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 3112)

  • INFO

    • Manual execution by user

      • WARZONE RAT 3.03.exe (PID: 1292)
      • WZ Crack.exe (PID: 2876)
      • WARZONE Password Viewer 1.0.exe (PID: 928)
      • WZ Crack.exe (PID: 3592)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (gen) (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
8
Malicious processes
8
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe searchprotocolhost.exe no specs warzone rat 3.03.exe no specs wz crack.exe warzone rat 3.03.exe no specs warzone password viewer 1.0.exe no specs wz crack.exe warzone rat 3.03.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
928"C:\Users\admin\Desktop\New folder\WARZONE Password Viewer 1.0.exe" C:\Users\admin\Desktop\New folder\WARZONE Password Viewer 1.0.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Description:
WARZONE Password Viewer 1.0
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\new folder\warzone password viewer 1.0.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1292"C:\Users\admin\Desktop\New folder\WARZONE RAT 3.03.exe" C:\Users\admin\Desktop\New folder\WARZONE RAT 3.03.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Description:
WARZONE RAT 3.00
Exit code:
0
Version:
3.0.0.0
Modules
Images
c:\users\admin\desktop\new folder\warzone rat 3.03.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1340"WARZONE RAT 3.03.exe"C:\Users\admin\Desktop\New folder\WARZONE RAT 3.03.exe—WZ Crack.exe
User:
admin
Integrity Level:
MEDIUM
Description:
WARZONE RAT 3.00
Exit code:
0
Version:
3.0.0.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\users\admin\desktop\new folder\warzone rat 3.03.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2632"WARZONE RAT 3.03.exe"C:\Users\admin\Desktop\New folder\WARZONE RAT 3.03.exe—WZ Crack.exe
User:
admin
Integrity Level:
MEDIUM
Description:
WARZONE RAT 3.00
Exit code:
0
Version:
3.0.0.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\desktop\new folder\warzone rat 3.03.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2876"C:\Users\admin\Desktop\New folder\WZ Crack.exe" C:\Users\admin\Desktop\New folder\WZ Crack.exe
Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\desktop\new folder\wz crack.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\psapi.dll
3112"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\wz3-zkjilnirrq.7z"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\winrar\winrar.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3460"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\system32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7601.24542 (win7sp1_ldr_escrow.191209-2211)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3592"C:\Users\admin\Desktop\New folder\WZ Crack.exe" C:\Users\admin\Desktop\New folder\WZ Crack.exe
Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\desktop\new folder\wz crack.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
Total events
2 210
Read events
2 189
Write events
21
Delete events
0

Modification events

(PID) Process:(3112) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3112) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3112) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3112) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3112) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3112) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\wz3-zkjilnirrq.7z
(PID) Process:(3112) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3112) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3112) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3112) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
17
Suspicious files
6
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
3112WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3112.16831\License.dllexecutable
MD5:—
SHA256:—
3112WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3112.16831\Datas\geoip\GeoIP.datbinary
MD5:42368516B6BD3C337AA64A012FBA8C3D
SHA256:57B31E52D36571CF8D52BA6ECAB8D0DC8C6705B5ED94D9F7F98B01F40863E5A0
3112WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3112.16831\rdpwrap.binbinary
MD5:B47764D0EBC50E81DF207DE9B9E3B2F0
SHA256:64E0F8A6EAB97C23258A554EE16764F3BD268483D2126CC35A7B4999756F00EE
3112WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3112.16831\cratclientd.binexecutable
MD5:F6DBE80A1B68A734C92375FBBCF4BE88
SHA256:D364FE03510F34C22E8B5D25784BA80DECAE568BD939DB66E4CD8B90538D60BE
3112WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3112.16831\PETools.dllexecutable
MD5:DB7101A0E92CD476B587AFB9C55586D0
SHA256:B39BBD6D8EE84743834741AAE0A39159F62DB829678E5BB0D915B09EDC27B41E
3112WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3112.16831\Datas\rdpwrap64.dllexecutable
MD5:C4063372AFE486D5E9A11C5B68E0524F
SHA256:FC1F3FC182CEF9BCEF5192E4FA4569697E27852CBFFB7A55EA6118C603DDC420
3112WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3112.16831\MaterialSkin.dllexecutable
MD5:ED99FA9FDDE37B7BACCE5FB11B61DFDD
SHA256:50D82FC44A5EE228FFACC36F5BABC51985ED229B0E0C88DFA806E08A56EC989A
3112WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3112.16831\WARZONE RAT 3.03.exeexecutable
MD5:—
SHA256:—
3112WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3112.16831\Datas\rdpwrap32.dllexecutable
MD5:F5C6A32EE3BD88AE44C0C0DFAE950CF0
SHA256:B9828995474F7E6A6B5C160E5160C5FF49495654A5B89654B6A0F9B8664F82FC
3112WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3112.16831\WZ Crack.exeexecutable
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2
DNS requests
1
Threats
2

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2876
WZ Crack.exe
20.112.52.29:80
microsoft.com
—
US
malicious
3592
WZ Crack.exe
20.112.52.29:80
microsoft.com
—
US
malicious

DNS requests

Domain
IP
Reputation
microsoft.com
  • 20.112.52.29
  • 20.81.111.85
  • 20.84.181.62
  • 20.103.85.33
  • 20.53.203.50
whitelisted

Threats

PID
Process
Class
Message
2876
WZ Crack.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
3592
WZ Crack.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
wz3-zkjilnirrq.7z