File name:

for testing.zip

Full analysis: https://app.any.run/tasks/742cd0b5-4948-4dcd-becb-0ff412a6cc9c
Verdict: Malicious activity
Analysis date: May 28, 2025, 01:07:14
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
arch-exec
monoxide
Indicators:
MIME: application/zip
File info: Zip archive data, at least v4.5 to extract, compression method=deflate
MD5:

69D8A7E28E7308AF7D06DDE0108E2ADA

SHA1:

2F5D7C685C691E343F1778595936E23329E5810F

SHA256:

13EF4942B63EAF5D333AB89DF95BEE2C826B648E4F0765E1A0BB16045935CB82

SSDEEP:

98304:oM/xLURvNr5K9Tpy3gp/j0qAYuqTVrhjXUcR6JsVoP3cDbtcUvCXv1ASMNGQzUcw:rzrTLizTlF2fWV

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 2168)

    • Disables task manager

      • 一一一一一一一一一一一一一一一一.exe (PID: 988)

    • Monoxide mutex has been found

      • 仁侲壬輢嘱櫻瞝焲彳賠歏逨垿窀跘仆.exe (PID: 2384)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 2168)

    • Starts itself from another location

      • quantizer.exe (PID: 2432)
      • Monoxidex86.exe (PID: 3876)

    • Executable content was dropped or overwritten

      • quantizer.exe (PID: 2432)
      • Monoxidex86.exe (PID: 3876)

    • There is functionality for taking screenshot (YARA)

      • Phsyletric.exe (PID: 2740)
      • 仁侲壬輢嘱櫻瞝焲彳賠歏逨垿窀跘仆.exe (PID: 2384)
      • 一一一一一一一一一一一一一一一一.exe (PID: 988)
      • neptunium.exe (PID: 1560)

    • Creates file in the systems drive root

      • 仁侲壬輢嘱櫻瞝焲彳賠歏逨垿窀跘仆.exe (PID: 2384)

    • Reads security settings of Internet Explorer

      • 仁侲壬輢嘱櫻瞝焲彳賠歏逨垿窀跘仆.exe (PID: 2384)

    • Reads the Internet Settings

      • 仁侲壬輢嘱櫻瞝焲彳賠歏逨垿窀跘仆.exe (PID: 2384)

  • INFO

    • The sample compiled with english language support

      • WinRAR.exe (PID: 2168)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2168)

    • Manual execution by a user

      • Monoxidex86.exe (PID: 2948)
      • Monoxidex86.exe (PID: 3876)
      • Phsyletric.exe (PID: 2532)
      • Sulfoxide.exe (PID: 1028)
      • quantizer.exe (PID: 2432)
      • Sulfoxide.exe (PID: 1268)
      • neptunium.exe (PID: 1560)
      • Phsyletric.exe (PID: 2740)
      • quantizer.exe (PID: 3160)

    • Checks supported languages

      • Monoxidex86.exe (PID: 3876)
      • Phsyletric.exe (PID: 2740)
      • quantizer.exe (PID: 2432)
      • 一一一一一一一一一一一一一一一一.exe (PID: 988)
      • neptunium.exe (PID: 1560)
      • 仁侲壬輢嘱櫻瞝焲彳賠歏逨垿窀跘仆.exe (PID: 2384)

    • Create files in a temporary directory

      • quantizer.exe (PID: 2432)
      • Monoxidex86.exe (PID: 3876)

    • Reads the computer name

      • 一一一一一一一一一一一一一一一一.exe (PID: 988)
      • neptunium.exe (PID: 1560)
      • 仁侲壬輢嘱櫻瞝焲彳賠歏逨垿窀跘仆.exe (PID: 2384)
      • Phsyletric.exe (PID: 2740)

    • Application launched itself

      • msedge.exe (PID: 2996)
      • msedge.exe (PID: 3036)
      • msedge.exe (PID: 1168)
      • msedge.exe (PID: 3956)
      • msedge.exe (PID: 2900)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 45
ZipBitFlag: 0x0800
ZipCompression: Deflated
ZipModifyDate: 2025:05:28 01:03:30
ZipCRC: 0x00000000
ZipCompressedSize: 2
ZipUncompressedSize: -
ZipFileName: for testing/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
70
Monitored processes
29
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe monoxidex86.exe no specs monoxidex86.exe phsyletric.exe no specs 仁侲壬輢嘱櫻瞝焲彳賠歏逨垿窀跘仆.exe no specs phsyletric.exe quantizer.exe no specs quantizer.exe sulfoxide.exe no specs 一一一一一一一一一一一一一一一一.exe no specs sulfoxide.exe no specs neptunium.exe no specs msiexec.exe no specs msedge.exe no specs msedge.exe no specs winrar.exe no specs winrar.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msiexec.exe no specs msiexec.exe no specs msedge.exe no specs msedge.exe no specs msiexec.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
988"C:\Users\admin\AppData\Local\Temp\一一一一一一一一一一一一一一一一.exe"C:\Users\admin\AppData\Local\Temp\一一一一一一一一一一一一一一一一.exe—quantizer.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\一一一一一一一一一一一一一一一一.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msimg32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1020"C:\Windows\System32\msiexec.exe" /i "C:\MSOCache\All Users\{90140000-0018-0419-0000-0000000FF1CE}-C\PowerPointMUI.msi" C:\Windows\System32\msiexec.exe—仁侲壬輢嘱櫻瞝焲彳賠歏逨垿窀跘仆.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1028"C:\Users\admin\Desktop\Sulfoxide.exe" C:\Users\admin\Desktop\Sulfoxide.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3222601730
Modules
Images
c:\users\admin\desktop\sulfoxide.exe
c:\windows\system32\ntdll.dll
1168"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --single-argument C:\MSOCache\All Users\{90140000-0018-0410-0000-0000000FF1CE}-C\PowerPointMUI.xmlC:\Program Files\Microsoft\Edge\Application\msedge.exe—仁侲壬輢嘱櫻瞝焲彳賠歏逨垿窀跘仆.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1268"C:\Users\admin\Desktop\Sulfoxide.exe" C:\Users\admin\Desktop\Sulfoxide.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3222601730
Modules
Images
c:\users\admin\desktop\sulfoxide.exe
c:\windows\system32\ntdll.dll
1560"C:\Users\admin\Desktop\neptunium.exe" C:\Users\admin\Desktop\neptunium.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\neptunium.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2168"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\for testing.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2384"C:\Users\admin\AppData\Local\Temp\仁侲壬輢嘱櫻瞝焲彳賠歏逨垿窀跘仆.exe"C:\Users\admin\AppData\Local\Temp\仁侲壬輢嘱櫻瞝焲彳賠歏逨垿窀跘仆.exe—Monoxidex86.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\仁侲壬輢嘱櫻瞝焲彳賠歏逨垿窀跘仆.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2432"C:\Users\admin\Desktop\quantizer.exe" C:\Users\admin\Desktop\quantizer.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\quantizer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msimg32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2532"C:\Users\admin\Desktop\Phsyletric.exe" C:\Users\admin\Desktop\Phsyletric.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\phsyletric.exe
c:\windows\system32\ntdll.dll
Total events
5 555
Read events
5 486
Write events
69
Delete events
0

Modification events

(PID) Process:(2168) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2168) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(2168) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(2168) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\for testing.zip
(PID) Process:(2168) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2168) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2168) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2168) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2168) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2168) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
29
Suspicious files
8
Text files
21
Unknown types
0

Dropped files

PID
Process
Filename
Type
2168WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2168.25826\for testing\neptunium.exeexecutable
MD5:94259B5AD79024A5B6F5388F18EC061F
SHA256:100B97224063DBAEA25B4D53672B7E3FC81443AEEF10151C47096FFB3C849334
2168WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2168.25826\for testing\Sulfoxide.exeexecutable
MD5:EBB8E4550DA773A639557E3BF7D1B29E
SHA256:84C052915829E69E49D0482F1C0EDDE678B3ECE6AC74CA8D1FE3F0DBE1C05EB0
2168WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2168.25826\for testing\Monoxidex86.exeexecutable
MD5:5C378B11848AC59704C2000B4E711C30
SHA256:BD764FE2F9734D5AC56933CE68DF0A175BFA98DC0266AE3CD3A5C963267EA77E
2168WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2168.25826\for testing\vcredist_x86.EXEexecutable
MD5:4F1611F2D0AE799507F60C10FF8654C5
SHA256:8648C5FC29C44B9112FE52F9A33F80E7FC42D10F3B5B42B2121542A13E44ADFD
2168WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2168.25826\for testing\Phsyletric.exeexecutable
MD5:4DB23CF50F64A83759DB9DF6AD222D65
SHA256:465F8BF12FE8FC53C9EF45E498B5F9D95B783C61096147BBC09182F6D19DD129
2168WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2168.25826\for testing\Sulfoxide_fixes.exeexecutable
MD5:1C93ABA8D33DE352B56173F2DBF218B8
SHA256:39DA041A23FDAB1324E58DDF546D05E211D0C2B568813A95A76550499CA36CA9
2168WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2168.25826\for testing\AutoClickerv3.3.0\System.Numerics.Vectors.xmlxml
MD5:95DD29CA17B63843AD787D3BC9C8C933
SHA256:AE2C3DE9AD57D7091D9F44DCDEE3F88ECCF2BA7CB43ADC9BB24769154A532DC7
2168WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2168.25826\for testing\AutoClickerv3.3.0\CommonServiceLocator.dllexecutable
MD5:E5F3B59AB9FD9157857D69B3D9611D0B
SHA256:8951F1B70412949C6AC5F5A73441E689D954522EE199F17F56C97D3C90908AFD
2168WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2168.25826\for testing\AutoClickerv3.3.0\Serilog.Sinks.File.xmlxml
MD5:1B86E4F3A8CE3CE70F61BD09D57789D5
SHA256:5B3BC686380813DE6D899368F3E4B04607FDB5DC8E0C01DE343762D300A03AA9
2168WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2168.25826\for testing\AutoClickerv3.3.0\System.ValueTuple.xmlxml
MD5:B6E60687AE5DB6D011E21E6993620745
SHA256:C37E163FA76629C196460C7B4D54E95B1A46A4C66AB7B6F3311959C8137DC5F1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
6
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.78
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
for testing.zip