File name:

Downloads.zip

Full analysis: https://app.any.run/tasks/ec60b581-2549-4e0e-86cc-8f50e35b17a9
Verdict: Malicious activity
Analysis date: December 05, 2022, 18:31:13
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

6A22D970C6342E7E098468BB1418711A

SHA1:

0BF5AB1BF0E15E339752C15BC3B9200FF24911BF

SHA256:

0EA7DBE8C6AC76D1C1F30EFC1E569B10F836FE90608AB3093154F45C6D89CD88

SSDEEP:

24576:TdDnmG6ZvlbtECViqE7yigF7lnIjCHlK/hHKcwzqc:TpnmG6jtHvUyl71qslK/9kzqc

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • utorrent_installer.exe (PID: 2460)
      • utorrent_installer.exe (PID: 2556)

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Application was dropped or rewritten from another process

      • utorrent_installer.tmp (PID: 3376)
      • utorrent_installer.tmp (PID: 1220)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 1580)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1580)

    • Loads dropped or rewritten executable

      • utorrent_installer.tmp (PID: 1220)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
55
Monitored processes
14
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start winrar.exe utorrent_installer.exe no specs utorrent_installer.tmp no specs utorrent_installer.exe utorrent_installer.tmp taskmgr.exe no specs control.exe no specs taskmgr.exe no specs compmgmtlauncher.exe no specs compmgmtlauncher.exe mmc.exe rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1580"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Downloads.zip"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
2460"C:\Users\admin\Desktop\utorrent_installer.exe" C:\Users\admin\Desktop\utorrent_installer.exe—Explorer.EXE
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
µTorrent® Classic
Version:
3.6
Modules
Images
c:\users\admin\desktop\utorrent_installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
3376"C:\Users\admin\AppData\Local\Temp\is-VT19G.tmp\utorrent_installer.tmp" /SL5="$900F2,874637,815104,C:\Users\admin\Desktop\utorrent_installer.exe" C:\Users\admin\AppData\Local\Temp\is-VT19G.tmp\utorrent_installer.tmp—utorrent_installer.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-vt19g.tmp\utorrent_installer.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\mpr.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2556"C:\Users\admin\Desktop\utorrent_installer.exe" /SPAWNWND=$50146 /NOTIFYWND=$900F2 C:\Users\admin\Desktop\utorrent_installer.exe
utorrent_installer.tmp
User:
admin
Company:
Integrity Level:
HIGH
Description:
µTorrent® Classic
Version:
3.6
Modules
Images
c:\users\admin\desktop\utorrent_installer.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\usp10.dll
1220"C:\Users\admin\AppData\Local\Temp\is-091B3.tmp\utorrent_installer.tmp" /SL5="$801B0,874637,815104,C:\Users\admin\Desktop\utorrent_installer.exe" /SPAWNWND=$50146 /NOTIFYWND=$900F2 C:\Users\admin\AppData\Local\Temp\is-091B3.tmp\utorrent_installer.tmp
utorrent_installer.exe
User:
admin
Company:
Integrity Level:
HIGH
Description:
Setup/Uninstall
Version:
51.1052.0.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\temp\is-091b3.tmp\utorrent_installer.tmp
c:\windows\system32\kernel32.dll
c:\windows\system32\mpr.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2916"C:\Windows\system32\taskmgr.exe" /4C:\Windows\system32\taskmgr.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Task Manager
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
860"C:\Windows\System32\control.exe" SYSTEMC:\Windows\System32\control.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Control Panel
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\control.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2456"C:\Windows\system32\taskmgr.exe" /4C:\Windows\system32\taskmgr.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Task Manager
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3092"C:\Windows\system32\CompMgmtLauncher.exe" C:\Windows\system32\CompMgmtLauncher.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Computer Management Snapin Launcher
Exit code:
3221226540
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\compmgmtlauncher.exe
c:\windows\system32\ntdll.dll
3384"C:\Windows\system32\CompMgmtLauncher.exe" C:\Windows\system32\CompMgmtLauncher.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Computer Management Snapin Launcher
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\compmgmtlauncher.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
Total events
6 435
Read events
6 158
Write events
276
Delete events
1

Modification events

(PID) Process:(1580) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1580) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1580) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1580) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(1580) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(1580) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Downloads.zip
(PID) Process:(1580) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1580) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1580) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1580) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
6
Suspicious files
0
Text files
5
Unknown types
1

Dropped files

PID
Process
Filename
Type
1220utorrent_installer.tmpC:\Users\admin\AppData\Local\Temp\is-V11P0.tmp\is-BG4KK.tmpexecutable
MD5:4B4149C544EA79ACCC7CB55015FCC0FA
SHA256:761BE1C00F156CAA8D04DB5BD0E2F7B3F12FD0B4B9F29BD4E0AF13125F2E4646
1220utorrent_installer.tmpC:\Users\admin\AppData\Local\Temp\is-V11P0.tmp\uTorrent.pngimage
MD5:CD3F5B72F3ECC90E946A38E3822B1D99
SHA256:F3ECA5D467E45C741E9A072AFF31BBA4DB5E91713631DBC4B735A6032FEF43E7
2460utorrent_installer.exeC:\Users\admin\AppData\Local\Temp\is-VT19G.tmp\utorrent_installer.tmpexecutable
MD5:9A777CDC480689793142D6F078D8F0B5
SHA256:C06E4C58F103D4F57495AECFA67C43380031C77C83FA4A040C72C51700376DF2
1580WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1580.7066\virtualbox-6_1_0-build-135406-extension-pack-repack-portable-by-dakov.torrenttorrent
MD5:0D8160BC540B3B5E3C02742848104BC9
SHA256:142659E0F6B903C8FA0672F65AC1F9E9DA8F2A332CD41BDCB5D54C78E077F0B5
1220utorrent_installer.tmpC:\Users\admin\AppData\Local\Temp\is-V11P0.tmp\license.rtftext
MD5:D88780E16B98ABD0E73EE15D2AC5FE46
SHA256:89FE20D3C918FB515E63E632E325ED93618DAB8C00D39074594D466C978B9868
1220utorrent_installer.tmpC:\Users\admin\AppData\Local\Temp\is-V11P0.tmp\Logo.pngimage
MD5:5424804C80DB74E1304535141A5392C6
SHA256:9B7E2EA77E518B50E5DD78E0FAEC509E791949A7C7F360A967C9EE204A8F1412
1220utorrent_installer.tmpC:\Users\admin\AppData\Local\Temp\is-V11P0.tmp\AVAST.pngimage
MD5:E58EF284DA2EFE6AB6211C3D8FAFEB79
SHA256:4F2CB1BF59F233D027DA5FF5B48B485EB29A656B8EE9D607C6C3450E96AB4DB1
1220utorrent_installer.tmpC:\Users\admin\AppData\Local\Temp\is-V11P0.tmp\botva2.dllexecutable
MD5:67965A5957A61867D661F05AE1F4773E
SHA256:450B9B0BA25BF068AFBC2B23D252585A19E282939BF38326384EA9112DFD0105
2556utorrent_installer.exeC:\Users\admin\AppData\Local\Temp\is-091B3.tmp\utorrent_installer.tmpexecutable
MD5:9A777CDC480689793142D6F078D8F0B5
SHA256:C06E4C58F103D4F57495AECFA67C43380031C77C83FA4A040C72C51700376DF2
1220utorrent_installer.tmpC:\Users\admin\AppData\Local\Temp\is-V11P0.tmp\is-TGE2S.tmpimage
MD5:E58EF284DA2EFE6AB6211C3D8FAFEB79
SHA256:4F2CB1BF59F233D027DA5FF5B48B485EB29A656B8EE9D607C6C3450E96AB4DB1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
9
DNS requests
5
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1220
utorrent_installer.tmp
HEAD
200
82.221.103.243:80
http://download-new.utorrent.com/endpoint/utorrent/os/riserollout/track/stable
IS
—
—
whitelisted
1220
utorrent_installer.tmp
GET
200
82.221.103.243:80
http://download-new.utorrent.com/endpoint/utorrent/os/riserollout/track/stable
IS
executable
16.0 Mb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1220
utorrent_installer.tmp
13.226.156.16:443
d4w1kp01cnm54.cloudfront.net
AMAZON-02
US
unknown
1220
utorrent_installer.tmp
82.221.103.243:80
download-new.utorrent.com
Advania Island ehf
IS
suspicious
1220
utorrent_installer.tmp
143.204.214.227:443
d3cfdnjelz8u20.cloudfront.net
AMAZON-02
US
unknown
1220
utorrent_installer.tmp
65.9.58.107:443
d4w1kp01cnm54.cloudfront.net
AMAZON-02
US
malicious
1220
utorrent_installer.tmp
13.32.23.42:443
d4bohzj3dmv4j.cloudfront.net
AMAZON-02
US
unknown

DNS requests

Domain
IP
Reputation
d4w1kp01cnm54.cloudfront.net
  • 13.226.156.16
  • 13.226.156.99
  • 13.226.156.153
  • 13.226.156.55
  • 65.9.58.107
  • 65.9.58.42
  • 65.9.58.195
  • 65.9.58.164
whitelisted
d3cfdnjelz8u20.cloudfront.net
  • 143.204.214.227
  • 143.204.214.40
  • 143.204.214.100
  • 143.204.214.178
whitelisted
d4bohzj3dmv4j.cloudfront.net
  • 13.32.23.42
  • 13.32.23.76
  • 13.32.23.197
  • 13.32.23.77
whitelisted
download-new.utorrent.com
  • 82.221.103.243
  • 82.221.103.242
whitelisted

Threats

No threats detected
Process
Message
mmc.exe
ViewerConfigPath = 'C:\ProgramData\Microsoft\Event Viewer': Microsoft.Windows.ManagementUI.CombinedControls.EventsNode
mmc.exe
ViewerViewsFolderPath = 'C:\ProgramData\Microsoft\Event Viewer\Views': Microsoft.Windows.ManagementUI.CombinedControls.EventsNode
mmc.exe
ViewerAdminViewsPath = 'C:\ProgramData\Microsoft\Event Viewer\Views\ApplicationViewsRootNode': Microsoft.Windows.ManagementUI.CombinedControls.EventsNode
mmc.exe
ViewerExternalLogsPath = 'C:\ProgramData\Microsoft\Event Viewer\ExternalLogs': Microsoft.Windows.ManagementUI.CombinedControls.EventsNode
mmc.exe
AddIcons: Microsoft.TaskScheduler.SnapIn.TaskSchedulerExtension
Interactive malware hunting service ANY.RUN
© 2017-2023 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Downloads.zip