File name:

for testing.zip

Full analysis: https://app.any.run/tasks/df5489df-f565-4cb5-922c-1f6be2ca320f
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: June 09, 2025, 22:54:41
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
arch-exec
wannacry
ransomware
darkroad
Indicators:
MIME: application/zip
File info: Zip archive data, at least v4.5 to extract, compression method=deflate
MD5:

DFE93128359F0A23A69B2B0454DE6D36

SHA1:

18C54A5FF37E2E12E0C7C769C8B54780C13C1A2D

SHA256:

193E270B561BCE48E62B990CE8C4DAC541690F47C9BBCB512A5429597326AA4D

SSDEEP:

98304:QZOQDQogM/xLURvNr5K9Tpy3gp/j0qAYuqTVrhjdDT0BbYdxk8DkNCkPeuKY5VBI:4Xoh+ucbRURxobFOSxD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • Endermanch@FreeYoutubeDownloader.exe (PID: 2792)

    • Accesses environment variables (SCRIPT)

      • wscript.exe (PID: 1120)
      • wscript.exe (PID: 1220)

    • Gets path to any of the special folders (SCRIPT)

      • wscript.exe (PID: 1120)

    • Checks whether a specified folder exists (SCRIPT)

      • wscript.exe (PID: 2272)
      • wscript.exe (PID: 1120)

    • Creates a new folder (SCRIPT)

      • wscript.exe (PID: 2272)

    • Disables task manager

      • 000.exe (PID: 3072)
      • wscript.exe (PID: 1220)

    • Creates a new registry key or changes the value of an existing one (SCRIPT)

      • wscript.exe (PID: 1120)
      • wscript.exe (PID: 2272)
      • wscript.exe (PID: 1220)

    • Gets TEMP folder path (SCRIPT)

      • wscript.exe (PID: 1120)

    • Changes the login/logoff helper path in the registry

      • 000.exe (PID: 3072)
      • wscript.exe (PID: 1220)

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 2272)
      • wscript.exe (PID: 1120)
      • wscript.exe (PID: 1220)

    • WANNACRY has been detected

      • ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe (PID: 1472)

    • Gets username (SCRIPT)

      • wscript.exe (PID: 1220)

    • Task Manager has been disabled (taskmgr)

      • wscript.exe (PID: 1220)

    • Disables Windows Defender

      • wscript.exe (PID: 1220)

    • Create files in the Startup directory

      • cmd.exe (PID: 2832)

    • DARKROAD has been detected

      • cmd.exe (PID: 2832)

    • Opens a text file (SCRIPT)

      • wscript.exe (PID: 1220)

    • Copies file to a new location (SCRIPT)

      • wscript.exe (PID: 1220)

    • Writes a file to the Word startup folder

      • ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe (PID: 1472)

    • DARKROAD has been detected (YARA)

      • 000.exe (PID: 3072)

    • RANSOMWARE has been detected

      • wscript.exe (PID: 1220)

    • Modifies files in the Chrome extension folder

      • ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe (PID: 1472)

    • WANNACRY has been detected (YARA)

      • ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe (PID: 1472)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 2328)
      • ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe (PID: 1472)
      • cmd.exe (PID: 2688)

    • Creates a software uninstall entry

      • Endermanch@FreeYoutubeDownloader.exe (PID: 2792)

    • Executable content was dropped or overwritten

      • Endermanch@FreeYoutubeDownloader.exe (PID: 2792)
      • BUG32.exe (PID: 3012)
      • BossDaMajor.exe (PID: 1168)
      • wscript.exe (PID: 1120)
      • 000.exe (PID: 3072)
      • ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe (PID: 1472)
      • wscript.exe (PID: 2272)
      • cmd.exe (PID: 2832)
      • cmd.exe (PID: 2688)
      • wscript.exe (PID: 1220)
      • cmd.exe (PID: 2700)
      • cmd.exe (PID: 2540)
      • cmd.exe (PID: 3216)
      • cmd.exe (PID: 3288)
      • cmd.exe (PID: 3380)
      • cmd.exe (PID: 3920)
      • cmd.exe (PID: 4056)
      • cmd.exe (PID: 3664)

    • Reads security settings of Internet Explorer

      • Endermanch@FreeYoutubeDownloader.exe (PID: 2792)
      • BossDaMajor.exe (PID: 1168)
      • BUG32.exe (PID: 3012)
      • wmplayer.exe (PID: 1964)

    • Reads the Internet Settings

      • Endermanch@FreeYoutubeDownloader.exe (PID: 2792)
      • BUG32.exe (PID: 3012)
      • BossDaMajor.exe (PID: 1168)
      • wscript.exe (PID: 1120)
      • wscript.exe (PID: 2272)
      • wscript.exe (PID: 3016)
      • wscript.exe (PID: 1220)
      • wmplayer.exe (PID: 1964)
      • WMIC.exe (PID: 2928)
      • WMIC.exe (PID: 3528)

    • The process executes VB scripts

      • BossDaMajor.exe (PID: 1168)
      • BUG32.exe (PID: 3012)
      • wscript.exe (PID: 2272)
      • wscript.exe (PID: 3016)

    • Changes the desktop background image

      • 000.exe (PID: 3072)
      • wscript.exe (PID: 1220)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • wscript.exe (PID: 2272)
      • wscript.exe (PID: 1120)
      • wscript.exe (PID: 1220)

    • Starts CMD.EXE for commands execution

      • 000.exe (PID: 3072)
      • ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe (PID: 1472)
      • wscript.exe (PID: 1220)

    • Executing commands from a ".bat" file

      • 000.exe (PID: 3072)
      • ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe (PID: 1472)

    • Starts a Microsoft application from unusual location

      • ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe (PID: 1472)
      • taskdl.exe (PID: 604)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 2832)

    • Uses ATTRIB.EXE to modify file attributes

      • ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe (PID: 1472)

    • Uses ICACLS.EXE to modify access control lists

      • ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe (PID: 1472)

    • Application launched itself

      • wscript.exe (PID: 2272)
      • wscript.exe (PID: 3016)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 1120)
      • wscript.exe (PID: 2272)
      • wscript.exe (PID: 3016)
      • wscript.exe (PID: 1220)

    • Accesses current user name via WMI (SCRIPT)

      • wscript.exe (PID: 1220)

    • Checks whether a specific file exists (SCRIPT)

      • wscript.exe (PID: 1220)

    • Uses WMIC.EXE to obtain user accounts information

      • cmd.exe (PID: 2832)

    • Reads data from a binary Stream object (SCRIPT)

      • wscript.exe (PID: 1220)

    • There is functionality for taking screenshot (YARA)

      • Mythlas.exe (PID: 3800)
      • neptunium.exe (PID: 3868)
      • 000.exe (PID: 3072)
      • BossDaMajor.exe (PID: 1168)
      • Core.exe (PID: 3140)

    • The system shut down or reboot

      • cmd.exe (PID: 2832)

    • Suspicious files were dropped or overwritten

      • wscript.exe (PID: 1220)

  • INFO

    • The sample compiled with english language support

      • WinRAR.exe (PID: 2328)
      • ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe (PID: 1472)
      • cmd.exe (PID: 2688)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2328)

    • Create files in a temporary directory

      • Endermanch@FreeYoutubeDownloader.exe (PID: 2792)
      • BUG32.exe (PID: 3012)
      • BossDaMajor.exe (PID: 1168)
      • 000.exe (PID: 3072)
      • setup_wm.exe (PID: 2676)

    • Manual execution by a user

      • Endermanch@FreeYoutubeDownloader.exe (PID: 2792)
      • BossDaMajor.exe (PID: 1168)
      • BUG32.exe (PID: 3012)
      • Mythlas.exe (PID: 3800)
      • neptunium.exe (PID: 3868)
      • 000.exe (PID: 3072)
      • Core.exe (PID: 3140)
      • ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe (PID: 1472)

    • Checks supported languages

      • Endermanch@FreeYoutubeDownloader.exe (PID: 2792)
      • Mythlas.exe (PID: 3800)
      • 000.exe (PID: 3072)
      • BossDaMajor.exe (PID: 1168)
      • neptunium.exe (PID: 3868)
      • Free YouTube Downloader.exe (PID: 3816)
      • Core.exe (PID: 3140)
      • BUG32.exe (PID: 3012)
      • ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe (PID: 1472)
      • taskdl.exe (PID: 604)
      • wmplayer.exe (PID: 1964)
      • setup_wm.exe (PID: 2676)

    • Reads the computer name

      • Endermanch@FreeYoutubeDownloader.exe (PID: 2792)
      • 000.exe (PID: 3072)
      • Free YouTube Downloader.exe (PID: 3816)
      • BossDaMajor.exe (PID: 1168)
      • BUG32.exe (PID: 3012)
      • Core.exe (PID: 3140)
      • neptunium.exe (PID: 3868)
      • ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe (PID: 1472)
      • wmplayer.exe (PID: 1964)
      • setup_wm.exe (PID: 2676)
      • Mythlas.exe (PID: 3800)

    • Reads the machine GUID from the registry

      • Free YouTube Downloader.exe (PID: 3816)
      • 000.exe (PID: 3072)
      • ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe (PID: 1472)
      • setup_wm.exe (PID: 2676)

    • Launching a file from a Registry key

      • Endermanch@FreeYoutubeDownloader.exe (PID: 2792)

    • Creates files in the program directory

      • wscript.exe (PID: 1120)
      • cmd.exe (PID: 2832)
      • ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe (PID: 1472)

    • Reads Environment values

      • setup_wm.exe (PID: 2676)

    • Process checks computer location settings

      • setup_wm.exe (PID: 2676)

    • Launching a file from the Startup directory

      • cmd.exe (PID: 2832)

    • Creates files or folders in the user directory

      • ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe (PID: 1472)

    • Changes file name

      • cmd.exe (PID: 2700)
      • cmd.exe (PID: 2540)
      • cmd.exe (PID: 3608)
      • cmd.exe (PID: 4012)
      • cmd.exe (PID: 2688)
      • cmd.exe (PID: 2152)
      • cmd.exe (PID: 3288)
      • cmd.exe (PID: 3380)
      • cmd.exe (PID: 3216)
      • cmd.exe (PID: 1584)
      • cmd.exe (PID: 4000)
      • cmd.exe (PID: 124)
      • cmd.exe (PID: 3376)
      • cmd.exe (PID: 3920)
      • cmd.exe (PID: 3008)
      • cmd.exe (PID: 2588)
      • cmd.exe (PID: 3520)
      • cmd.exe (PID: 2944)
      • cmd.exe (PID: 4056)
      • cmd.exe (PID: 2172)
      • cmd.exe (PID: 2524)
      • cmd.exe (PID: 3424)
      • cmd.exe (PID: 3664)
      • cmd.exe (PID: 2280)
      • cmd.exe (PID: 3328)
      • cmd.exe (PID: 3840)
      • cmd.exe (PID: 184)
      • cmd.exe (PID: 3040)
      • cmd.exe (PID: 3684)
      • cmd.exe (PID: 3572)
      • cmd.exe (PID: 3088)
      • cmd.exe (PID: 2484)
      • cmd.exe (PID: 2144)
      • cmd.exe (PID: 1768)
      • cmd.exe (PID: 2948)
      • cmd.exe (PID: 3972)
      • cmd.exe (PID: 2396)
      • cmd.exe (PID: 4064)
      • cmd.exe (PID: 904)
      • cmd.exe (PID: 1996)
      • cmd.exe (PID: 2804)
      • cmd.exe (PID: 3848)
      • cmd.exe (PID: 1936)
      • cmd.exe (PID: 2944)
      • cmd.exe (PID: 3968)
      • cmd.exe (PID: 2232)
      • cmd.exe (PID: 2328)
      • cmd.exe (PID: 3396)
      • cmd.exe (PID: 3500)
      • cmd.exe (PID: 2600)
      • cmd.exe (PID: 3592)
      • cmd.exe (PID: 1076)
      • cmd.exe (PID: 3372)
      • cmd.exe (PID: 2860)
      • cmd.exe (PID: 3540)
      • cmd.exe (PID: 2788)
      • cmd.exe (PID: 4012)
      • cmd.exe (PID: 3136)
      • cmd.exe (PID: 3704)
      • cmd.exe (PID: 916)
      • cmd.exe (PID: 3380)
      • cmd.exe (PID: 3404)
      • cmd.exe (PID: 2732)
      • cmd.exe (PID: 1456)
      • cmd.exe (PID: 3316)
      • cmd.exe (PID: 1784)
      • cmd.exe (PID: 3032)
      • cmd.exe (PID: 2016)
      • cmd.exe (PID: 3064)
      • cmd.exe (PID: 2824)
      • cmd.exe (PID: 624)
      • cmd.exe (PID: 2792)
      • cmd.exe (PID: 184)
      • cmd.exe (PID: 1108)
      • cmd.exe (PID: 1780)
      • cmd.exe (PID: 3196)
      • cmd.exe (PID: 3272)
      • cmd.exe (PID: 780)
      • cmd.exe (PID: 1036)
      • cmd.exe (PID: 1600)
      • cmd.exe (PID: 3772)
      • cmd.exe (PID: 3688)
      • cmd.exe (PID: 2532)
      • cmd.exe (PID: 568)
      • cmd.exe (PID: 1612)
      • cmd.exe (PID: 3420)
      • cmd.exe (PID: 3288)
      • cmd.exe (PID: 3408)
      • cmd.exe (PID: 320)
      • cmd.exe (PID: 1560)
      • cmd.exe (PID: 3040)
      • cmd.exe (PID: 2000)
      • cmd.exe (PID: 2080)
      • cmd.exe (PID: 3396)
      • cmd.exe (PID: 904)
      • cmd.exe (PID: 2772)
      • cmd.exe (PID: 1936)
      • cmd.exe (PID: 4092)
      • cmd.exe (PID: 2524)
      • cmd.exe (PID: 1276)
      • cmd.exe (PID: 1488)
      • cmd.exe (PID: 3248)
      • cmd.exe (PID: 3892)
      • cmd.exe (PID: 1824)
      • cmd.exe (PID: 1748)
      • cmd.exe (PID: 3124)
      • cmd.exe (PID: 2156)
      • cmd.exe (PID: 1996)
      • cmd.exe (PID: 3444)
      • cmd.exe (PID: 3924)
      • cmd.exe (PID: 3128)
      • cmd.exe (PID: 4048)
      • cmd.exe (PID: 3888)
      • cmd.exe (PID: 1864)
      • cmd.exe (PID: 1408)
      • cmd.exe (PID: 1108)
      • cmd.exe (PID: 2996)
      • cmd.exe (PID: 2344)
      • cmd.exe (PID: 2840)
      • cmd.exe (PID: 4116)
      • cmd.exe (PID: 2764)
      • cmd.exe (PID: 1604)
      • cmd.exe (PID: 4172)
      • cmd.exe (PID: 4324)
      • cmd.exe (PID: 4252)
      • cmd.exe (PID: 4300)
      • cmd.exe (PID: 4548)
      • cmd.exe (PID: 4356)
      • cmd.exe (PID: 4392)
      • cmd.exe (PID: 4420)
      • cmd.exe (PID: 4452)
      • cmd.exe (PID: 4516)
      • cmd.exe (PID: 4588)
      • cmd.exe (PID: 4612)
      • cmd.exe (PID: 4648)
      • cmd.exe (PID: 4676)
      • cmd.exe (PID: 4140)
      • cmd.exe (PID: 4196)
      • cmd.exe (PID: 4276)
      • cmd.exe (PID: 4492)
      • cmd.exe (PID: 4840)
      • cmd.exe (PID: 4896)
      • cmd.exe (PID: 4872)
      • cmd.exe (PID: 4996)
      • cmd.exe (PID: 4928)
      • cmd.exe (PID: 4972)
      • cmd.exe (PID: 5084)
      • cmd.exe (PID: 5060)
      • cmd.exe (PID: 5124)
      • cmd.exe (PID: 5148)
      • cmd.exe (PID: 5172)
      • cmd.exe (PID: 5220)
      • cmd.exe (PID: 5244)
      • cmd.exe (PID: 5300)
      • cmd.exe (PID: 5276)
      • cmd.exe (PID: 4736)
      • cmd.exe (PID: 4776)
      • cmd.exe (PID: 4800)
      • cmd.exe (PID: 5028)
      • cmd.exe (PID: 5412)
      • cmd.exe (PID: 5460)
      • cmd.exe (PID: 5480)
      • cmd.exe (PID: 5544)
      • cmd.exe (PID: 5504)
      • cmd.exe (PID: 5568)
      • cmd.exe (PID: 5640)
      • cmd.exe (PID: 5744)
      • cmd.exe (PID: 5784)
      • cmd.exe (PID: 5816)
      • cmd.exe (PID: 5848)
      • cmd.exe (PID: 5880)
      • cmd.exe (PID: 5904)
      • cmd.exe (PID: 5340)
      • cmd.exe (PID: 5380)
      • cmd.exe (PID: 5436)
      • cmd.exe (PID: 5704)
      • cmd.exe (PID: 6056)
      • cmd.exe (PID: 6024)
      • cmd.exe (PID: 6088)
      • cmd.exe (PID: 6128)
      • cmd.exe (PID: 4108)
      • cmd.exe (PID: 4292)
      • cmd.exe (PID: 4164)
      • cmd.exe (PID: 4228)
      • cmd.exe (PID: 4528)
      • cmd.exe (PID: 4416)
      • cmd.exe (PID: 4336)
      • cmd.exe (PID: 4444)
      • cmd.exe (PID: 4600)
      • cmd.exe (PID: 5936)
      • cmd.exe (PID: 5968)
      • cmd.exe (PID: 5992)
      • cmd.exe (PID: 4916)
      • cmd.exe (PID: 4940)
      • cmd.exe (PID: 5016)
      • cmd.exe (PID: 5048)
      • cmd.exe (PID: 5144)
      • cmd.exe (PID: 5180)
      • cmd.exe (PID: 5236)
      • cmd.exe (PID: 5352)
      • cmd.exe (PID: 5404)
      • cmd.exe (PID: 5524)
      • cmd.exe (PID: 5428)
      • cmd.exe (PID: 4080)
      • cmd.exe (PID: 5652)
      • cmd.exe (PID: 4668)
      • cmd.exe (PID: 4672)
      • cmd.exe (PID: 4728)
      • cmd.exe (PID: 4812)
      • cmd.exe (PID: 4864)
      • cmd.exe (PID: 3604)
      • cmd.exe (PID: 5924)
      • cmd.exe (PID: 6008)
      • cmd.exe (PID: 4888)
      • cmd.exe (PID: 2736)
      • cmd.exe (PID: 6076)
      • cmd.exe (PID: 4664)
      • cmd.exe (PID: 4768)
      • cmd.exe (PID: 2576)
      • cmd.exe (PID: 5932)
      • cmd.exe (PID: 4968)
      • cmd.exe (PID: 764)
      • cmd.exe (PID: 5368)
      • cmd.exe (PID: 5564)
      • cmd.exe (PID: 5832)
      • cmd.exe (PID: 5736)
      • cmd.exe (PID: 5764)
      • cmd.exe (PID: 5948)
      • cmd.exe (PID: 5176)
      • cmd.exe (PID: 4512)
      • cmd.exe (PID: 5808)
      • cmd.exe (PID: 4720)
      • cmd.exe (PID: 5160)
      • cmd.exe (PID: 5488)
      • cmd.exe (PID: 5664)
      • cmd.exe (PID: 4720)
      • cmd.exe (PID: 5964)
      • cmd.exe (PID: 6084)
      • cmd.exe (PID: 2324)
      • cmd.exe (PID: 3304)
      • cmd.exe (PID: 6076)
      • cmd.exe (PID: 5188)
      • cmd.exe (PID: 5844)
      • cmd.exe (PID: 5892)
      • cmd.exe (PID: 4716)
      • cmd.exe (PID: 4188)
      • cmd.exe (PID: 4152)
      • cmd.exe (PID: 5360)
      • cmd.exe (PID: 3924)
      • cmd.exe (PID: 5120)
      • cmd.exe (PID: 5212)
      • cmd.exe (PID: 5808)
      • cmd.exe (PID: 3924)
      • cmd.exe (PID: 5096)
      • cmd.exe (PID: 5960)
      • cmd.exe (PID: 5428)
      • cmd.exe (PID: 4672)
      • cmd.exe (PID: 4352)
      • cmd.exe (PID: 4152)
      • cmd.exe (PID: 4912)
      • cmd.exe (PID: 5636)
      • cmd.exe (PID: 5120)
      • cmd.exe (PID: 4716)
      • cmd.exe (PID: 5832)
      • cmd.exe (PID: 4924)
      • cmd.exe (PID: 5500)
      • cmd.exe (PID: 4508)
      • cmd.exe (PID: 4968)
      • cmd.exe (PID: 4980)
      • cmd.exe (PID: 5364)
      • cmd.exe (PID: 5632)
      • cmd.exe (PID: 5704)
      • cmd.exe (PID: 5880)
      • cmd.exe (PID: 6096)
      • cmd.exe (PID: 6028)
      • cmd.exe (PID: 5216)
      • cmd.exe (PID: 5912)
      • cmd.exe (PID: 5648)
      • cmd.exe (PID: 5568)
      • cmd.exe (PID: 6140)
      • cmd.exe (PID: 4608)
      • cmd.exe (PID: 4164)
      • cmd.exe (PID: 4688)
      • cmd.exe (PID: 5188)
      • cmd.exe (PID: 5012)
      • cmd.exe (PID: 2584)
      • cmd.exe (PID: 4108)
      • cmd.exe (PID: 6088)
      • cmd.exe (PID: 4188)
      • cmd.exe (PID: 4884)
      • cmd.exe (PID: 5796)
      • cmd.exe (PID: 4812)
      • cmd.exe (PID: 5340)
      • cmd.exe (PID: 5524)
      • cmd.exe (PID: 5936)
      • cmd.exe (PID: 5652)
      • cmd.exe (PID: 3604)
      • cmd.exe (PID: 5396)
      • cmd.exe (PID: 4924)
      • cmd.exe (PID: 4464)
      • cmd.exe (PID: 4232)
      • cmd.exe (PID: 4640)
      • cmd.exe (PID: 4132)
      • cmd.exe (PID: 4560)
      • cmd.exe (PID: 2312)
      • cmd.exe (PID: 4292)
      • cmd.exe (PID: 4940)
      • cmd.exe (PID: 5048)
      • cmd.exe (PID: 5464)
      • cmd.exe (PID: 3300)
      • cmd.exe (PID: 5756)
      • cmd.exe (PID: 2964)
      • cmd.exe (PID: 5040)
      • cmd.exe (PID: 4160)
      • cmd.exe (PID: 4824)
      • cmd.exe (PID: 5644)
      • cmd.exe (PID: 2584)
      • cmd.exe (PID: 4800)
      • cmd.exe (PID: 5060)
      • cmd.exe (PID: 5460)
      • cmd.exe (PID: 4348)
      • cmd.exe (PID: 4496)
      • cmd.exe (PID: 4736)
      • cmd.exe (PID: 5748)
      • cmd.exe (PID: 5412)
      • cmd.exe (PID: 5744)
      • cmd.exe (PID: 5460)
      • cmd.exe (PID: 3300)
      • cmd.exe (PID: 5436)
      • cmd.exe (PID: 5808)
      • cmd.exe (PID: 5096)
      • cmd.exe (PID: 5416)
      • cmd.exe (PID: 5524)
      • cmd.exe (PID: 4420)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 45
ZipBitFlag: 0x0800
ZipCompression: Deflated
ZipModifyDate: 2025:06:09 21:59:42
ZipCRC: 0x00000000
ZipCompressedSize: 2
ZipUncompressedSize: -
ZipFileName: for testing/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
753
Monitored processes
362
Malicious processes
10
Suspicious processes
0

Behavior graph

Click at the process to see the details
start start winrar.exe endermanch@freeyoutubedownloader.exe mythlas.exe free youtube downloader.exe no specs neptunium.exe #DARKROAD 000.exe bossdamajor.exe bug32.exe wscript.exe core.exe wscript.exe cmd.exe notepad.exe no specs #WANNACRY ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe taskkill.exe no specs attrib.exe no specs icacls.exe no specs wscript.exe no specs taskdl.exe no specs cmd.exe no specs THREAT wscript.exe wmplayer.exe no specs cmd.exe no specs setup_wm.exe no specs taskkill.exe no specs wmic.exe no specs cmd.exe cmd.exe no specs cmd.exe no specs cmd.exe cmd.exe no specs wmic.exe no specs cmd.exe cmd.exe cmd.exe cmd.exe no specs cmd.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe cmd.exe no specs cmd.exe no specs shutdown.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
124"C:\Windows\System32\cmd.exe" /c ren "C:\Users\admin\Music\*.*" "*.exe"C:\Windows\System32\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
184"C:\Windows\System32\cmd.exe" /c ren "C:\Users\admin\PrintHood\*.*" "*.exe"C:\Windows\System32\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
184"C:\Windows\System32\cmd.exe" /c ren "C:\Users\admin\AppData\Local\Diagnostics\733862231\*.*" "*.exe"C:\Windows\System32\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
3221225794
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
320"C:\Windows\System32\cmd.exe" /c ren "C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crowd Deny\*.*" "*.exe"C:\Windows\System32\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
3221225794
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
568"C:\Windows\System32\cmd.exe" /c ren "C:\Users\admin\AppData\Local\Apps\2.0\OQVLXTZK.4P5\*.*" "*.exe"C:\Windows\System32\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
3221225794
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
604taskdl.exeC:\Users\admin\Desktop\taskdl.exe—ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
SQL Client Configuration Utility EXE
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\users\admin\desktop\taskdl.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp60.dll
c:\windows\system32\msvcrt.dll
624"C:\Windows\System32\cmd.exe" /c ren "C:\Users\admin\AppData\Local\Apps\2.0\OQVLXTZK.4P5\AK6KX289.K1P\manifests\*.*" "*.exe"C:\Windows\System32\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
3221225794
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
752attrib +h .C:\Windows\System32\attrib.exe—ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Attribute Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\attrib.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ulib.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
764"C:\Windows\System32\cmd.exe" /c ren "C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB\*.*" "*.exe"C:\Windows\System32\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
3221225794
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
780"C:\Windows\System32\cmd.exe" /c ren "C:\Users\admin\AppData\Local\ElevatedDiagnostics\460911090\2019073012.000\*.*" "*.exe"C:\Windows\System32\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
3221225794
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
Total events
17 516
Read events
17 348
Write events
160
Delete events
8

Modification events

(PID) Process:(2328) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2328) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(2328) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(2328) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\for testing.zip
(PID) Process:(2328) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2328) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2328) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2328) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2328) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2328) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
Executable files
984
Suspicious files
1 223
Text files
734
Unknown types
0

Dropped files

PID
Process
Filename
Type
2328WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2328.643\for testing\neptunium.exeexecutable
MD5:94259B5AD79024A5B6F5388F18EC061F
SHA256:100B97224063DBAEA25B4D53672B7E3FC81443AEEF10151C47096FFB3C849334
2328WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2328.643\for testing\Phsyletric.exeexecutable
MD5:4DB23CF50F64A83759DB9DF6AD222D65
SHA256:465F8BF12FE8FC53C9EF45E498B5F9D95B783C61096147BBC09182F6D19DD129
2328WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2328.643\for testing\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeexecutable
MD5:84C82835A5D21BBCF75A61706D8AB549
SHA256:ED01EBFBC9EB5BBEA545AF4D01BF5F1071661840480439C6E5BABE8E080E41AA
2328WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2328.643\for testing\000.exeexecutable
MD5:D5671758956B39E048680B6A8275E96A
SHA256:4A900B344EF765A66F98CF39AC06273D565CA0F5D19F7EA4CA183786155D4A47
3800Mythlas.exe\Device\Harddisk0\DR0 —
MD5:—
SHA256:—
2328WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2328.643\for testing\quantizer.exeexecutable
MD5:1458480CF8803569195F934D47AC7481
SHA256:68D528F9AC891E920449188198A233B71B2860838AF4FB970B9966F941CE82CA
2328WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2328.643\for testing\BossDaMajor.exeexecutable
MD5:38FF71C1DEE2A9ADD67F1EDB1A30FF8C
SHA256:730A41A7656F606A22E9F0D68782612D6E00AB8CFE1260160B9E0B00BC2E442A
2328WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2328.643\for testing\Mythlas.exeexecutable
MD5:1BCCDB1CBBDB299F4053DBAB4236DADC
SHA256:E65C793A31137AE75A6F30AE2933BD7CAE74FCD4330B6C8770C14466BC3A878F
3868neptunium.exe\Device\Harddisk0\DR0 —
MD5:—
SHA256:—
2328WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2328.643\for testing\Heptoxide.exeexecutable
MD5:F970A59A728C152EBDBD8E45F26AC9D8
SHA256:FA544F8E0146D5F12BD904F65C2E999E475A525FF676350F90289A0CA834C21F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
6
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.174
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
for testing.zip