File name:

ZNNXKNCHOA004_2024-07-31_07_37_07.336.zip

Full analysis: https://app.any.run/tasks/3f79c686-5f7f-4598-974c-44e76db90b4b
Verdict: Malicious activity
Analysis date: July 31, 2024, 07:40:10
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v4.5 to extract, compression method=deflate
MD5:

2D81A21D8828C73B43744E65204AF16A

SHA1:

E08B7B49598450BBE371EE763D5FDAE1C7A44424

SHA256:

17FDE81E157AFDB459AA36572099F4560E39CAEF00785AEAF6179FF47DBC3DE5

SSDEEP:

98304:KwvL2yDhfigAgpK6Bo2bG76qO9CSniq1edOvwyPtDFNPWNeFrlj4U1YohSNGpYJ0:bf/p5MPsKyCDJ+ce

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • HighEditConverter.exe (PID: 5860)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 6420)

    • Executable content was dropped or overwritten

      • HighEditConverter.exe (PID: 5860)

    • Sets XML DOM element text (SCRIPT)

      • splwow64.exe (PID: 7024)

  • INFO

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 6420)

    • Reads security settings of Internet Explorer

      • splwow64.exe (PID: 7024)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6420)

    • Reads the computer name

      • HighEditConverter.exe (PID: 5860)

    • Checks supported languages

      • HighEditConverter.exe (PID: 5860)

    • Create files in a temporary directory

      • HighEditConverter.exe (PID: 5860)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0801
ZipCompression: Deflated
ZipModifyDate: 1980:00:00 00:00:00
ZipCRC: 0xde4d399d
ZipCompressedSize: 5183231
ZipUncompressedSize: 11419648
ZipFileName: Device/HarddiskVolume4/SYSTEM98/PROGRAMS/HighEditConverter.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
141
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe slui.exe no specs higheditconverter.exe splwow64.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3228C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5860"C:\Users\admin\AppData\Local\Temp\Rar$EXb6420.43263\Device\HarddiskVolume4\SYSTEM98\PROGRAMS\HighEditConverter.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb6420.43263\Device\HarddiskVolume4\SYSTEM98\PROGRAMS\HighEditConverter.exe
WinRAR.exe
User:
admin
Company:
Micromed
Integrity Level:
MEDIUM
Exit code:
4294967295
Version:
1.01
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb6420.43263\device\harddiskvolume4\system98\programs\higheditconverter.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6420"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\ZNNXKNCHOA004_2024-07-31_07_37_07.336.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
7024C:\WINDOWS\splwow64.exe 8192C:\Windows\splwow64.exe—HighEditConverter.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Print driver host for applications
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\splwow64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
7 087
Read events
7 069
Write events
18
Delete events
0

Modification events

(PID) Process:(6420) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(6420) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(6420) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(6420) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\ZNNXKNCHOA004_2024-07-31_07_37_07.336.zip
(PID) Process:(6420) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6420) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6420) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6420) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6420) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(6420) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
25
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
5860HighEditConverter.exeC:\Users\admin\AppData\Local\Temp\evb3D51.tmpexecutable
MD5:5503BC52553F1B25B7B440CE2EACCB45
SHA256:2DACC4ECB2030C32BAD8FB78E11768E0D1767F632746765020C15F50A87578E2
6420WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb6420.43263\Device\HarddiskVolume4\SYSTEM98\PROGRAMS\HighEditConverter.exeexecutable
MD5:C7C86C4E28A6460DC0FC59B86AEA9102
SHA256:6AB569EACB2BCC7F6D745715C4DA4B301B736474F930A8EBD027464B4641E20E
6420WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb6420.43263\manifest.jsontext
MD5:290CBFBBEB3EE66213AB60A08B70C06D
SHA256:4EE01C4DD0C1ED1F3152E9997E560A270E2858EEF83719BE64AAD9E4C11DC1BE
5860HighEditConverter.exeC:\Users\admin\AppData\Local\Temp\evb3D40.tmpexecutable
MD5:36BFB544737DE75D56546ACF55C2F554
SHA256:5BD8C4D46B83293A3432EEED79D8571054CC611FCFFB5D102C584958FCF55763
5860HighEditConverter.exeC:\Users\admin\AppData\Local\Temp\evb3D53.tmpexecutable
MD5:2F6A70F37590E69E9875C895052CCBF2
SHA256:CF53342ECC1159375154AF0F8AACAB6C2DC54F54C33A5A5FA1315C938047AC91
5860HighEditConverter.exeC:\Users\admin\AppData\Local\Temp\evb3D52.tmpexecutable
MD5:8968B7974AD611497A50494ADA090537
SHA256:6DD24F55B9154DE7C0EAF34FA18615DD37F93294B4610336C5AB47238AB3E68A
5860HighEditConverter.exeC:\Users\admin\AppData\Local\Temp\evb3D65.tmpexecutable
MD5:BB8A1373C60F9925A0CF15710AEFF3C1
SHA256:859725A32BDD1387F9E92D414547615A7F5297D91E9ECB53067B9D70DB40C2BF
5860HighEditConverter.exeC:\Users\admin\AppData\Local\Temp\evb3DB9.tmpexecutable
MD5:3CEE51F9884DDECB898A3E5A5B3C9942
SHA256:B79E0F7A9FEA00FBAA777DDFC31BFDBC9952F55B35D4C2B53B585511B91C45DC
5860HighEditConverter.exeC:\Users\admin\AppData\Local\Temp\evb3DB8.tmpexecutable
MD5:9A25981F4462C53DA63D04013BB12E7B
SHA256:0A3D613F717B4A186CE1C95FC6A145863BBCB2BAA9FA98DE5DBACFAE08F4CCF8
5860HighEditConverter.exeC:\Users\admin\AppData\Local\Temp\evb3DA8.tmpexecutable
MD5:AECD7F6C6857A0582CF27296BA20E589
SHA256:7CA0B53544D316229D7A9AB88C8952905637406A24B4E8DED88497F00FC1F8FB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
44
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5368
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
US
binary
312 b
whitelisted
4424
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
binary
471 b
whitelisted
5368
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
US
binary
471 b
whitelisted
3676
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
US
binary
471 b
whitelisted
6292
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
US
binary
471 b
whitelisted
5368
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
US
binary
471 b
whitelisted
4132
OfficeClickToRun.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
US
binary
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3952
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
—
—
184.86.251.11:443
www.bing.com
Akamai International B.V.
DE
unknown
3704
slui.exe
40.91.76.224:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6012
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2908
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5672
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
131.253.33.254:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
6340
slui.exe
40.91.76.224:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 184.86.251.11
  • 184.86.251.9
  • 184.86.251.6
  • 184.86.251.29
  • 184.86.251.4
  • 184.86.251.7
  • 184.86.251.5
  • 184.86.251.10
  • 184.86.251.30
  • 184.86.251.31
  • 184.86.251.26
  • 184.86.251.25
  • 184.86.251.24
  • 184.86.251.27
  • 184.86.251.23
  • 184.86.251.28
whitelisted
google.com
  • 142.250.185.78
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
fp-afd-nocache-ccp.azureedge.net
  • 13.107.246.60
whitelisted
login.live.com
  • 20.190.159.75
  • 20.190.159.73
  • 20.190.159.64
  • 20.190.159.0
  • 40.126.31.73
  • 40.126.31.71
  • 20.190.159.4
  • 40.126.31.69
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
th.bing.com
  • 184.86.251.31
  • 184.86.251.26
  • 184.86.251.25
  • 184.86.251.29
  • 184.86.251.24
  • 184.86.251.27
  • 184.86.251.23
  • 184.86.251.30
  • 184.86.251.28
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted
fp.msedge.net
  • 204.79.197.222
whitelisted

Threats

No threats detected
Process
Message
HighEditConverter.exe
RegisterClass Fehler
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ZNNXKNCHOA004_2024-07-31_07_37_07.336.zip