File name:

ARCHICAD 22.zip

Full analysis: https://app.any.run/tasks/7a69fb91-d016-4b78-be90-3eef2b9a890a
Verdict: Malicious activity
Analysis date: December 04, 2020, 19:39:56
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

B46FB7898F28DD0AC533684E96B7346A

SHA1:

645CD5A20B7A4D6760BE6C97736518944D99C759

SHA256:

1313DB78A9EF27E5EF56C4AA96861B4D48594B6913F8893A74DA85696237ABD2

SSDEEP:

98304:3QHFIzl3zcq4O3ElmKGQD7rywQVwvjXXITc/kap9:3+IBzcqL1uFITc/kaz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • AC22_K_Up7_V1.1.exe (PID: 676)
      • AC22_K_Up7_V1.1.exe (PID: 1892)
      • AC22_K_Up7_V1.1.exe (PID: 4044)
      • AC22_K_Up7_V1.1.exe (PID: 2084)

    • Drops executable file immediately after starts

      • AC22_K_Up7_V1.1.exe (PID: 1892)
      • AC22_K_Up7_V1.1.exe (PID: 2084)

  • SUSPICIOUS

    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 2592)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2592)
      • AC22_K_Up7_V1.1.exe (PID: 1892)
      • AC22_K_Up7_V1.1.exe (PID: 2084)

    • Drops a file with too old compile date

      • AC22_K_Up7_V1.1.exe (PID: 1892)
      • AC22_K_Up7_V1.1.exe (PID: 2084)

    • Drops a file that was compiled in debug mode

      • AC22_K_Up7_V1.1.exe (PID: 1892)
      • AC22_K_Up7_V1.1.exe (PID: 2084)

  • INFO

    • Manual execution by user

      • explorer.exe (PID: 3784)
      • AC22_K_Up7_V1.1.exe (PID: 676)
      • AC22_K_Up7_V1.1.exe (PID: 1892)
      • AC22_K_Up7_V1.1.exe (PID: 4044)
      • AC22_K_Up7_V1.1.exe (PID: 2084)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2020:12:04 22:32:28
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: ARCHICAD 22/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
46
Monitored processes
6
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe explorer.exe no specs ac22_k_up7_v1.1.exe no specs ac22_k_up7_v1.1.exe ac22_k_up7_v1.1.exe no specs ac22_k_up7_v1.1.exe

Process information

PID
CMD
Path
Indicators
Parent process
676"C:\Users\admin\Desktop\AC22_K_Up7_V1.1.exe" C:\Users\admin\Desktop\AC22_K_Up7_V1.1.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\ac22_k_up7_v1.1.exe
c:\systemroot\system32\ntdll.dll
1892"C:\Users\admin\Desktop\AC22_K_Up7_V1.1.exe" C:\Users\admin\Desktop\AC22_K_Up7_V1.1.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
4
Modules
Images
c:\users\admin\desktop\ac22_k_up7_v1.1.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\gdi32.dll
2084"C:\Users\admin\Desktop\AC22_K_Up7_V1.1.exe" C:\Users\admin\Desktop\AC22_K_Up7_V1.1.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\ac22_k_up7_v1.1.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\gdi32.dll
2592"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\ARCHICAD 22.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\comdlg32.dll
3784"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
4044"C:\Users\admin\Desktop\AC22_K_Up7_V1.1.exe" C:\Users\admin\Desktop\AC22_K_Up7_V1.1.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\ac22_k_up7_v1.1.exe
c:\systemroot\system32\ntdll.dll
Total events
537
Read events
506
Write events
31
Delete events
0

Modification events

(PID) Process:(2592) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2592) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2592) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2592) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\ARCHICAD 22.zip
(PID) Process:(2592) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2592) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2592) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2592) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1892) AC22_K_Up7_V1.1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication
Operation:writeName:Name
Value:
AC22_K_Up7_V1.1.exe
(PID) Process:(1892) AC22_K_Up7_V1.1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication
Operation:writeName:ID
Value:
1195057676
Executable files
7
Suspicious files
2
Text files
2
Unknown types
3

Dropped files

PID
Process
Filename
Type
2592WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2592.15801\ARCHICAD 22\unins000.exe —
MD5:—
SHA256:—
2592WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2592.15801\ARCHICAD 22\unins000.datdat
MD5:—
SHA256:—
1892AC22_K_Up7_V1.1.exeC:\Users\admin\AppData\Local\Temp\MMBPlayer\MEP-ENERGY.exeexecutable
MD5:B11B70541836FEB508001B8BE468A0D1
SHA256:D62884B252A5AE3ABE0A1EE3A27649CC0E952F388FD5EB343B8EB8C151E46AD5
1892AC22_K_Up7_V1.1.exeC:\Users\admin\AppData\Local\Temp\MMBPlayer\ODBA.INIbinary
MD5:CC9980126690359D99B7176D5AF26F7A
SHA256:9B2105857B6CC6D3EFC75E27C2AE2A14E7DB22B1D7537A221770CD96D2E022CA
1892AC22_K_Up7_V1.1.exeC:\Users\admin\AppData\Local\Temp\MMBPlayer\script.battext
MD5:1C907C10F8920F3B041050D8DAF44CE0
SHA256:48290436C76390B2F87FE90A657B7890B0E30240707179F8D27A6BB3A5F3AE92
2084AC22_K_Up7_V1.1.exeC:\Users\admin\AppData\Local\Temp\MMBPlayer\ODBA.INIbinary
MD5:CC9980126690359D99B7176D5AF26F7A
SHA256:9B2105857B6CC6D3EFC75E27C2AE2A14E7DB22B1D7537A221770CD96D2E022CA
2084AC22_K_Up7_V1.1.exeC:\Users\admin\AppData\Local\Temp\MMBPlayer\MEP-ENERGY.exeexecutable
MD5:B11B70541836FEB508001B8BE468A0D1
SHA256:D62884B252A5AE3ABE0A1EE3A27649CC0E952F388FD5EB343B8EB8C151E46AD5
1892AC22_K_Up7_V1.1.exeC:\Users\admin\AppData\Local\Temp\MMBPlayer\GSLicenseManager.dllexecutable
MD5:C76B13A38515F6A8C90794BA21BDCD71
SHA256:460AEBE2A4F7D6726553B10C273EFDFC2370DCC366821B6B0BFEF6DC1765EA70
2084AC22_K_Up7_V1.1.exeC:\Users\admin\AppData\Local\Temp\MMBPlayer\GSLicenseBase.dllexecutable
MD5:E9D614FFB5ED355F334743E4109AC2D0
SHA256:939812D76ABB4B4E3E1003E105317A0C1EC03408FECDB1490BC65A2CB26ADD63
2084AC22_K_Up7_V1.1.exeC:\Users\admin\AppData\Local\Temp\MMBPlayer\script.battext
MD5:1C907C10F8920F3B041050D8DAF44CE0
SHA256:48290436C76390B2F87FE90A657B7890B0E30240707179F8D27A6BB3A5F3AE92
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ARCHICAD 22.zip