download:

/CryptoNickSoft/7z-SFX-Constructor/raw/master/upd/7zSFX%20Constructor.7z

Full analysis: https://app.any.run/tasks/3a95bdeb-c125-4a51-b461-aa70f5114d1f
Verdict: Malicious activity
Analysis date: April 13, 2025, 15:10:09
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
arch-doc
autoit
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

D1D742B063729E155DCBC15822178647

SHA1:

60140553FBF80854E0807569958C742E3F8B6607

SHA256:

1060C7742E6883F4845D0B81D51A6957523C1C91B579A6BD7232F146982F0D5B

SSDEEP:

98304:/o91ukS5l6A0w4wiSjhKxIGeju+J6hvVRFfiDANk7j6HHVPr6CEqVyszmM7lM7O+:EEQAGekj1gVlcri4iiA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 1452)

    • Executing a file with an untrusted certificate

      • 7zSFX_Constructor.exe (PID: 5228)
      • 7zSFX_Constructor.exe (PID: 896)
      • 7zSFX_Constructor.exe (PID: 5968)

  • SUSPICIOUS

    • Drops 7-zip archiver for unpacking

      • 7zSFX_Constructor.exe (PID: 896)
      • xcopy.exe (PID: 6344)
      • 7zSFX_Constructor.exe (PID: 5968)

    • Executable content was dropped or overwritten

      • 7zSFX_Constructor.exe (PID: 896)
      • xcopy.exe (PID: 6344)
      • 7zSFX_Constructor.exe (PID: 5968)
      • ap14.dat (PID: 6700)

    • Starts CMD.EXE for commands execution

      • 7zSFX_Constructor.exe (PID: 896)

    • Starts the AutoIt3 executable file

      • 7zSFX_Constructor.exe (PID: 5968)

    • Reads security settings of Internet Explorer

      • 7zSFX_Constructor.exe (PID: 5968)
      • 7zSFX_Constructor.exe (PID: 896)

    • Starts application with an unusual extension

      • 7zSFX_Constructor.exe (PID: 5968)

  • INFO

    • The sample compiled with polish language support

      • WinRAR.exe (PID: 1452)
      • xcopy.exe (PID: 5228)

    • The sample compiled with russian language support

      • WinRAR.exe (PID: 1452)
      • 7zSFX_Constructor.exe (PID: 896)
      • xcopy.exe (PID: 6344)
      • xcopy.exe (PID: 5228)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1452)

    • Manual execution by a user

      • cmd.exe (PID: 1012)
      • cmd.exe (PID: 5640)
      • 7zSFX_Constructor.exe (PID: 5968)

    • Checks supported languages

      • 7zSFX_Constructor.exe (PID: 5228)
      • 7zSFX_Constructor.exe (PID: 896)
      • ap30.dat (PID: 1280)
      • ap10.dat (PID: 1088)
      • ap30.dat (PID: 5892)
      • 7zSFX_Constructor.exe (PID: 5968)
      • ap14.dat (PID: 6700)

    • Reads the computer name

      • 7zSFX_Constructor.exe (PID: 5228)
      • 7zSFX_Constructor.exe (PID: 896)
      • ap10.dat (PID: 1088)
      • ap30.dat (PID: 5892)
      • ap30.dat (PID: 1280)
      • 7zSFX_Constructor.exe (PID: 5968)

    • The sample compiled with english language support

      • 7zSFX_Constructor.exe (PID: 896)
      • xcopy.exe (PID: 6344)
      • 7zSFX_Constructor.exe (PID: 5968)

    • Create files in a temporary directory

      • 7zSFX_Constructor.exe (PID: 896)

    • The sample compiled with turkish language support

      • 7zSFX_Constructor.exe (PID: 896)
      • xcopy.exe (PID: 6344)

    • Creates files in the program directory

      • xcopy.exe (PID: 6344)
      • cmd.exe (PID: 2288)
      • xcopy.exe (PID: 5228)
      • cmd.exe (PID: 4172)
      • 7zSFX_Constructor.exe (PID: 5968)
      • ap30.dat (PID: 5892)
      • ap10.dat (PID: 1088)
      • ap14.dat (PID: 6700)

    • Creates a new folder

      • cmd.exe (PID: 4172)

    • Creates files or folders in the user directory

      • 7zSFX_Constructor.exe (PID: 896)
      • 7zSFX_Constructor.exe (PID: 5968)

    • Reads mouse settings

      • ap14.dat (PID: 6700)

    • Process checks computer location settings

      • 7zSFX_Constructor.exe (PID: 896)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)

EXIF

ZIP

FileVersion: 7z v0.04
ModifyDate: 2018:12:09 11:50:31+00:00
ArchivedFileName: APPS
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
160
Monitored processes
34
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe no specs cmd.exe no specs conhost.exe no specs 7zsfx_constructor.exe no specs cmd.exe no specs conhost.exe no specs 7zsfx_constructor.exe cmd.exe no specs conhost.exe no specs xcopy.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs xcopy.exe no specs cmd.exe no specs conhost.exe no specs 7zsfx_constructor.exe ap10.dat no specs ap30.dat no specs ap30.dat no specs ap14.dat

Process information

PID
CMD
Path
Indicators
Parent process
732"C:\Windows\System32\cmd.exe" /c if not exist "C:\ProgramData\7zSFX_Constructor\APPS\Settings\Sert.cer.old" (copy /y "C:\ProgramData\7zSFX_Constructor\APPS\Sert\Sert.cer" "C:\ProgramData\7zSFX_Constructor\APPS\Sert\Sert.cer.old")C:\Windows\SysWOW64\cmd.exe—7zSFX_Constructor.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
8967zSFX_Constructor.exe -aiSC:\Users\admin\Desktop\7zSFX_Constructor.exe
cmd.exe
User:
admin
Company:
CryptoNick
Integrity Level:
MEDIUM
Description:
7z SFX Constructor
Exit code:
0
Version:
4.5.0.0
Modules
Images
c:\users\admin\desktop\7zsfx_constructor.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\shell32.dll
c:\windows\syswow64\msvcp_win.dll
1012C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\Desktop\Help.cmd" "C:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
1012"C:\Windows\System32\cmd.exe" /c xcopy "C:\Users\admin\Desktop\APPS" "C:\ProgramData\7zSFX_Constructor\APPS" /c /i /s /e /r /h /yC:\Windows\SysWOW64\cmd.exe—7zSFX_Constructor.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
1088"C:\ProgramData\7zSFX_Constructor\data\dat01\ap10.dat" a "unst.7z" "Uninstall.cmd" -m0=LZMA2:d=64m -ms=on -mx=9 -myx=9C:\ProgramData\7zSFX_Constructor\data\dat01\ap10.dat—7zSFX_Constructor.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
MEDIUM
Description:
7-Zip GUI
Exit code:
0
Version:
15.14
Modules
Images
c:\programdata\7zsfx_constructor\data\dat01\ap10.dat
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
1280\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1280"C:\ProgramData\7zSFX_Constructor\data\dat01\ap30.dat" -addoverwrite "C:\ProgramData\7zSFX_Constructor\stb.sfx", "C:\ProgramData\7zSFX_Constructor\stb.sfx", "Inst.ico", ICONGROUP, 101, 0C:\ProgramData\7zSFX_Constructor\data\dat01\ap30.dat—7zSFX_Constructor.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Resource viewer, decompiler & recompiler.
Exit code:
0
Version:
3.6.0.92
Modules
Images
c:\programdata\7zsfx_constructor\data\dat01\ap30.dat
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1312\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1452"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\3a95bdeb-c125-4a51-b461-aa70f5114d1f.7zC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
2136C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
Total events
3 942
Read events
3 908
Write events
21
Delete events
13

Modification events

(PID) Process:(1452) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(1452) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(1452) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(1452) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\3a95bdeb-c125-4a51-b461-aa70f5114d1f.7z
(PID) Process:(1452) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1452) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1452) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1452) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1452) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:15
Value:
(PID) Process:(1452) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:14
Value:
Executable files
69
Suspicious files
56
Text files
412
Unknown types
4

Dropped files

PID
Process
Filename
Type
1452WinRAR.exeC:\Users\admin\Desktop\APPS\Icon\01.icoimage
MD5:3802F70CAA8594D31EE3010E48ABC252
SHA256:D5CB9C5494A059B37FE7402838001F2F33EE536430ACEF01887D84806A1C9AB2
1452WinRAR.exeC:\Users\admin\Desktop\APPS\Icon\107.icoimage
MD5:9F8B4FB338503FC90874DD561E9D7C4C
SHA256:9108F20BDC4ED66CA0A15F627CCF382CADB99148E9E965F416D3565851EC117C
1452WinRAR.exeC:\Users\admin\Desktop\APPS\Icon\04.icoimage
MD5:7FB4DA969F150C834A3B4DE251E27928
SHA256:47C7D32CE8F8BB3C1751551EC7C62E8A1F851D0853A004653387C92140C54EA6
1452WinRAR.exeC:\Users\admin\Desktop\APPS\Icon\05.icoimage
MD5:7935317E09A754BD1D7AB8E20A8550CE
SHA256:1ECDE30857AC47F3AB1C58D302F435F0E99598AC0140CCBD6CE4C4E1A302424F
1452WinRAR.exeC:\Users\admin\Desktop\APPS\Icon\03.icoimage
MD5:9CCE39CC41B45137E1DF26C80500888B
SHA256:A7857DAFE02CD91699ED67CBDC329623A72BB5D5C5355EFE81C0828DD7538AD1
1452WinRAR.exeC:\Users\admin\Desktop\APPS\Icon\138.icoimage
MD5:F42C6A54594B38EA0C43210D53EA1654
SHA256:8FA77E2DE8774D0DCF247D4DFAF08820D7273C7AFA5979BA45BBF2B19748AB89
1452WinRAR.exeC:\Users\admin\Desktop\APPS\Icon\1.icoimage
MD5:2AD4EC3AFE3B0FD7E8E5DB395EE06DC1
SHA256:C46F08BB646DC3BE5C8FE75DFD926427F35D7F2F2D55E0C58166F21FFE325C5B
1452WinRAR.exeC:\Users\admin\Desktop\APPS\Icon\07.icoimage
MD5:1FF38F61C271CC99B67655CD9B004239
SHA256:B264602D8348EF5538F7D8ACB9ACDF90A88C84A75E13D83E3BBACBE7CDA660F1
1452WinRAR.exeC:\Users\admin\Desktop\APPS\Icon\08.icoimage
MD5:38DFDD10BC80F987BE67A5FB0C553B7D
SHA256:7F48F3E63AE9BE28ED4A8FFBB0217C67B0C32C74C5628B4764719A810DB388D0
1452WinRAR.exeC:\Users\admin\Desktop\APPS\Icon\09.icoimage
MD5:C48D18018157B6C25CF38A78E0C7E742
SHA256:991F627239A110744C30E8BE8A447C7C9B10913D9B96AEE7F50B01ECC5DD4292
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
17
DNS requests
12
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.19.11.105:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4488
SIHClient.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4488
SIHClient.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
2.19.11.105:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.130:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4488
SIHClient.exe
52.149.20.212:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4488
SIHClient.exe
2.16.253.202:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 2.19.11.105
  • 2.19.11.120
whitelisted
google.com
  • 172.217.16.206
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 20.190.160.130
  • 20.190.160.132
  • 20.190.160.3
  • 40.126.32.136
  • 20.190.160.65
  • 20.190.160.2
  • 20.190.160.67
  • 20.190.160.128
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
www.microsoft.com
  • 2.16.253.202
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
/CryptoNickSoft/7z-SFX-Constructor/raw/master/upd/7zSFX%20Constructor.7z