File name:

ARCHICAD 22.zip

Full analysis: https://app.any.run/tasks/bce85ab8-c4d7-41f3-92ec-0919ba9ce7ce
Verdict: Malicious activity
Analysis date: December 04, 2020, 19:45:57
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

B46FB7898F28DD0AC533684E96B7346A

SHA1:

645CD5A20B7A4D6760BE6C97736518944D99C759

SHA256:

1313DB78A9EF27E5EF56C4AA96861B4D48594B6913F8893A74DA85696237ABD2

SSDEEP:

98304:3QHFIzl3zcq4O3ElmKGQD7rywQVwvjXXITc/kap9:3+IBzcqL1uFITc/kaz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • MEP-ENERGY.exe (PID: 2052)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • AC22_K_Up7_V1.1.exe (PID: 2620)
      • AC22_K_Up7_V1.1.exe (PID: 3576)
      • AC22_K_Up7_V1.1.exe (PID: 2192)

    • Drops a file with too old compile date

      • AC22_K_Up7_V1.1.exe (PID: 2620)
      • AC22_K_Up7_V1.1.exe (PID: 3576)
      • AC22_K_Up7_V1.1.exe (PID: 2192)

    • Drops a file that was compiled in debug mode

      • AC22_K_Up7_V1.1.exe (PID: 2620)
      • AC22_K_Up7_V1.1.exe (PID: 3576)
      • AC22_K_Up7_V1.1.exe (PID: 2192)

  • INFO

    • Manual execution by user

      • AC22_K_Up7_V1.1.exe (PID: 2620)
      • AC22_K_Up7_V1.1.exe (PID: 3576)
      • AC22_K_Up7_V1.1.exe (PID: 1200)
      • AC22_K_Up7_V1.1.exe (PID: 2192)
      • AC22_K_Up7_V1.1.exe (PID: 2260)
      • AC22_K_Up7_V1.1.exe (PID: 3280)
      • NOTEPAD.EXE (PID: 3704)
      • MEP-ENERGY.exe (PID: 2052)
      • NOTEPAD.EXE (PID: 3116)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2020:12:04 22:32:28
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: ARCHICAD 22/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
58
Monitored processes
10
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs ac22_k_up7_v1.1.exe no specs ac22_k_up7_v1.1.exe ac22_k_up7_v1.1.exe no specs ac22_k_up7_v1.1.exe ac22_k_up7_v1.1.exe no specs ac22_k_up7_v1.1.exe notepad.exe no specs mep-energy.exe no specs notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1200"C:\Users\admin\Desktop\ARCHICAD 22\AC22_K_Up7_V1.1.exe" C:\Users\admin\Desktop\ARCHICAD 22\AC22_K_Up7_V1.1.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\archicad 22\ac22_k_up7_v1.1.exe
c:\systemroot\system32\ntdll.dll
2052"C:\Users\admin\AppData\Local\Temp\MMBPlayer\MEP-ENERGY.exe" C:\Users\admin\AppData\Local\Temp\MMBPlayer\MEP-ENERGY.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\mmbplayer\mep-energy.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
2192"C:\Users\admin\Desktop\ARCHICAD 22\AC22_K_Up7_V1.1.exe" C:\Users\admin\Desktop\ARCHICAD 22\AC22_K_Up7_V1.1.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\archicad 22\ac22_k_up7_v1.1.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\gdi32.dll
2260"C:\Users\admin\Desktop\ARCHICAD 22\AC22_K_Up7_V1.1.exe" C:\Users\admin\Desktop\ARCHICAD 22\AC22_K_Up7_V1.1.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\archicad 22\ac22_k_up7_v1.1.exe
c:\systemroot\system32\ntdll.dll
2620"C:\Users\admin\Desktop\ARCHICAD 22\AC22_K_Up7_V1.1.exe" C:\Users\admin\Desktop\ARCHICAD 22\AC22_K_Up7_V1.1.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\archicad 22\ac22_k_up7_v1.1.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
2656"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\ARCHICAD 22.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3116"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\Temp\MMBPlayer\ODBA.INIC:\Windows\system32\NOTEPAD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3280"C:\Users\admin\Desktop\ARCHICAD 22\AC22_K_Up7_V1.1.exe" C:\Users\admin\Desktop\ARCHICAD 22\AC22_K_Up7_V1.1.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\archicad 22\ac22_k_up7_v1.1.exe
c:\systemroot\system32\ntdll.dll
3576"C:\Users\admin\Desktop\ARCHICAD 22\AC22_K_Up7_V1.1.exe" C:\Users\admin\Desktop\ARCHICAD 22\AC22_K_Up7_V1.1.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\archicad 22\ac22_k_up7_v1.1.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\gdi32.dll
3704"C:\Windows\System32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\Temp\MMBPlayer\script.batC:\Windows\System32\NOTEPAD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
535
Read events
509
Write events
26
Delete events
0

Modification events

(PID) Process:(2656) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2656) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2656) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2656) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\ARCHICAD 22.zip
(PID) Process:(2656) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2656) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2656) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2656) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2620) AC22_K_Up7_V1.1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication
Operation:writeName:Name
Value:
AC22_K_Up7_V1.1.exe
(PID) Process:(2620) AC22_K_Up7_V1.1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication
Operation:writeName:ID
Value:
1195057676
Executable files
9
Suspicious files
3
Text files
3
Unknown types
3

Dropped files

PID
Process
Filename
Type
2656WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2656.1441\ARCHICAD 22\AC22_K_Up7_V1.1.exe —
MD5:—
SHA256:—
2656WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2656.1441\ARCHICAD 22\unins000.dat —
MD5:—
SHA256:—
2656WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2656.1441\ARCHICAD 22\unins000.exe —
MD5:—
SHA256:—
2620AC22_K_Up7_V1.1.exeC:\Users\admin\AppData\Local\Temp\MMBPlayer\script.battext
MD5:1C907C10F8920F3B041050D8DAF44CE0
SHA256:48290436C76390B2F87FE90A657B7890B0E30240707179F8D27A6BB3A5F3AE92
3576AC22_K_Up7_V1.1.exeC:\Users\admin\AppData\Local\Temp\MMBPlayer\MEP-ENERGY.exeexecutable
MD5:B11B70541836FEB508001B8BE468A0D1
SHA256:D62884B252A5AE3ABE0A1EE3A27649CC0E952F388FD5EB343B8EB8C151E46AD5
3576AC22_K_Up7_V1.1.exeC:\Users\admin\AppData\Local\Temp\MMBPlayer\ODBA.INIbinary
MD5:CC9980126690359D99B7176D5AF26F7A
SHA256:9B2105857B6CC6D3EFC75E27C2AE2A14E7DB22B1D7537A221770CD96D2E022CA
3576AC22_K_Up7_V1.1.exeC:\Users\admin\AppData\Local\Temp\MMBPlayer\_mct_xm_Hello Sid-Riders!.tmpxm
MD5:B7CAA9846606025B99D5ADD789E0855D
SHA256:83CFB29A6209DC760E7ABE14FAC1DE41DD5F70F0745890E0658CE08A58E74E14
2620AC22_K_Up7_V1.1.exeC:\Users\admin\AppData\Local\Temp\MMBPlayer\ODBA.INIbinary
MD5:CC9980126690359D99B7176D5AF26F7A
SHA256:9B2105857B6CC6D3EFC75E27C2AE2A14E7DB22B1D7537A221770CD96D2E022CA
3576AC22_K_Up7_V1.1.exeC:\Users\admin\AppData\Local\Temp\MMBPlayer\script.battext
MD5:1C907C10F8920F3B041050D8DAF44CE0
SHA256:48290436C76390B2F87FE90A657B7890B0E30240707179F8D27A6BB3A5F3AE92
3576AC22_K_Up7_V1.1.exeC:\Users\admin\AppData\Local\Temp\MMBPlayer\GSLicenseManager.dllexecutable
MD5:C76B13A38515F6A8C90794BA21BDCD71
SHA256:460AEBE2A4F7D6726553B10C273EFDFC2370DCC366821B6B0BFEF6DC1765EA70
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ARCHICAD 22.zip