File name:

for testing.zip

Full analysis: https://app.any.run/tasks/df5489df-f565-4cb5-922c-1f6be2ca320f
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: June 09, 2025, 22:54:41
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
arch-exec
wannacry
ransomware
darkroad
Indicators:
MIME: application/zip
File info: Zip archive data, at least v4.5 to extract, compression method=deflate
MD5:

DFE93128359F0A23A69B2B0454DE6D36

SHA1:

18C54A5FF37E2E12E0C7C769C8B54780C13C1A2D

SHA256:

193E270B561BCE48E62B990CE8C4DAC541690F47C9BBCB512A5429597326AA4D

SSDEEP:

98304:QZOQDQogM/xLURvNr5K9Tpy3gp/j0qAYuqTVrhjdDT0BbYdxk8DkNCkPeuKY5VBI:4Xoh+ucbRURxobFOSxD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

    • Checks whether a specified folder exists (SCRIPT)

      • wscript.exe (PID: 1120)
      • wscript.exe (PID: 2272)

    • Gets TEMP folder path (SCRIPT)

      • wscript.exe (PID: 1120)

    • Accesses environment variables (SCRIPT)

      • wscript.exe (PID: 1120)
      • wscript.exe (PID: 1220)

    • Gets path to any of the special folders (SCRIPT)

      • wscript.exe (PID: 1120)

    • Creates a new folder (SCRIPT)

      • wscript.exe (PID: 2272)

    • Disables task manager

      • 000.exe (PID: 3072)
      • wscript.exe (PID: 1220)

    • Changes the login/logoff helper path in the registry

      • 000.exe (PID: 3072)
      • wscript.exe (PID: 1220)

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 1120)
      • wscript.exe (PID: 2272)
      • wscript.exe (PID: 1220)

    • WANNACRY has been detected

      • ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe (PID: 1472)

    • Creates a new registry key or changes the value of an existing one (SCRIPT)

      • wscript.exe (PID: 1120)
      • wscript.exe (PID: 2272)
      • wscript.exe (PID: 1220)

    • Gets username (SCRIPT)

      • wscript.exe (PID: 1220)

    • Task Manager has been disabled (taskmgr)

      • wscript.exe (PID: 1220)

    • Disables Windows Defender

      • wscript.exe (PID: 1220)

    • Create files in the Startup directory

      • cmd.exe (PID: 2832)

    • DARKROAD has been detected

      • cmd.exe (PID: 2832)

    • Opens a text file (SCRIPT)

      • wscript.exe (PID: 1220)

    • Copies file to a new location (SCRIPT)

      • wscript.exe (PID: 1220)

    • Writes a file to the Word startup folder

      • ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe (PID: 1472)

    • RANSOMWARE has been detected

      • wscript.exe (PID: 1220)

    • DARKROAD has been detected (YARA)

      • 000.exe (PID: 3072)

    • Modifies files in the Chrome extension folder

      • ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe (PID: 1472)

    • WANNACRY has been detected (YARA)

      • ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe (PID: 1472)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 2328)
      • ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe (PID: 1472)
      • cmd.exe (PID: 2688)

    • Executable content was dropped or overwritten

      • [email protected] (PID: 2792)
      • BUG32.exe (PID: 3012)
      • BossDaMajor.exe (PID: 1168)
      • wscript.exe (PID: 1120)
      • wscript.exe (PID: 2272)
      • ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe (PID: 1472)
      • 000.exe (PID: 3072)
      • cmd.exe (PID: 2832)
      • cmd.exe (PID: 2700)
      • wscript.exe (PID: 1220)
      • cmd.exe (PID: 2688)
      • cmd.exe (PID: 3380)
      • cmd.exe (PID: 3216)
      • cmd.exe (PID: 2540)
      • cmd.exe (PID: 3288)
      • cmd.exe (PID: 3920)
      • cmd.exe (PID: 4056)
      • cmd.exe (PID: 3664)

    • Creates a software uninstall entry

    • Reads security settings of Internet Explorer

      • [email protected] (PID: 2792)
      • BossDaMajor.exe (PID: 1168)
      • BUG32.exe (PID: 3012)
      • wmplayer.exe (PID: 1964)

    • Reads the Internet Settings

      • [email protected] (PID: 2792)
      • BossDaMajor.exe (PID: 1168)
      • BUG32.exe (PID: 3012)
      • wscript.exe (PID: 1120)
      • wscript.exe (PID: 2272)
      • wscript.exe (PID: 3016)
      • wscript.exe (PID: 1220)
      • wmplayer.exe (PID: 1964)
      • WMIC.exe (PID: 2928)
      • WMIC.exe (PID: 3528)

    • The process executes VB scripts

      • BossDaMajor.exe (PID: 1168)
      • BUG32.exe (PID: 3012)
      • wscript.exe (PID: 2272)
      • wscript.exe (PID: 3016)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • wscript.exe (PID: 1120)
      • wscript.exe (PID: 2272)
      • wscript.exe (PID: 1220)

    • Changes the desktop background image

      • 000.exe (PID: 3072)
      • wscript.exe (PID: 1220)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 1120)
      • wscript.exe (PID: 2272)
      • wscript.exe (PID: 3016)
      • wscript.exe (PID: 1220)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 2832)

    • Uses ATTRIB.EXE to modify file attributes

      • ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe (PID: 1472)

    • Uses ICACLS.EXE to modify access control lists

      • ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe (PID: 1472)

    • Starts CMD.EXE for commands execution

      • 000.exe (PID: 3072)
      • ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe (PID: 1472)
      • wscript.exe (PID: 1220)

    • Executing commands from a ".bat" file

      • 000.exe (PID: 3072)
      • ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe (PID: 1472)

    • Starts a Microsoft application from unusual location

      • ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe (PID: 1472)
      • taskdl.exe (PID: 604)

    • Application launched itself

      • wscript.exe (PID: 3016)
      • wscript.exe (PID: 2272)

    • Accesses current user name via WMI (SCRIPT)

      • wscript.exe (PID: 1220)

    • Checks whether a specific file exists (SCRIPT)

      • wscript.exe (PID: 1220)

    • Uses WMIC.EXE to obtain user accounts information

      • cmd.exe (PID: 2832)

    • Reads data from a binary Stream object (SCRIPT)

      • wscript.exe (PID: 1220)

    • There is functionality for taking screenshot (YARA)

      • Mythlas.exe (PID: 3800)
      • 000.exe (PID: 3072)
      • BossDaMajor.exe (PID: 1168)
      • Core.exe (PID: 3140)
      • neptunium.exe (PID: 3868)

    • The system shut down or reboot

      • cmd.exe (PID: 2832)

    • Suspicious files were dropped or overwritten

      • wscript.exe (PID: 1220)

  • INFO

    • The sample compiled with english language support

      • WinRAR.exe (PID: 2328)
      • ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe (PID: 1472)
      • cmd.exe (PID: 2688)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2328)

    • Checks supported languages

      • [email protected] (PID: 2792)
      • Mythlas.exe (PID: 3800)
      • neptunium.exe (PID: 3868)
      • Free YouTube Downloader.exe (PID: 3816)
      • 000.exe (PID: 3072)
      • BossDaMajor.exe (PID: 1168)
      • BUG32.exe (PID: 3012)
      • Core.exe (PID: 3140)
      • ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe (PID: 1472)
      • taskdl.exe (PID: 604)
      • wmplayer.exe (PID: 1964)
      • setup_wm.exe (PID: 2676)

    • Manual execution by a user

      • [email protected] (PID: 2792)
      • Mythlas.exe (PID: 3800)
      • neptunium.exe (PID: 3868)
      • 000.exe (PID: 3072)
      • BossDaMajor.exe (PID: 1168)
      • BUG32.exe (PID: 3012)
      • Core.exe (PID: 3140)
      • ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe (PID: 1472)

    • Create files in a temporary directory

      • [email protected] (PID: 2792)
      • BossDaMajor.exe (PID: 1168)
      • BUG32.exe (PID: 3012)
      • 000.exe (PID: 3072)
      • setup_wm.exe (PID: 2676)

    • Launching a file from a Registry key

    • Reads the computer name

      • [email protected] (PID: 2792)
      • Free YouTube Downloader.exe (PID: 3816)
      • BossDaMajor.exe (PID: 1168)
      • BUG32.exe (PID: 3012)
      • 000.exe (PID: 3072)
      • Core.exe (PID: 3140)
      • neptunium.exe (PID: 3868)
      • ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe (PID: 1472)
      • wmplayer.exe (PID: 1964)
      • setup_wm.exe (PID: 2676)
      • Mythlas.exe (PID: 3800)

    • Reads the machine GUID from the registry

      • Free YouTube Downloader.exe (PID: 3816)
      • 000.exe (PID: 3072)
      • ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe (PID: 1472)
      • setup_wm.exe (PID: 2676)

    • Creates files in the program directory

      • wscript.exe (PID: 1120)
      • cmd.exe (PID: 2832)
      • ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe (PID: 1472)

    • Reads Environment values

      • setup_wm.exe (PID: 2676)

    • Process checks computer location settings

      • setup_wm.exe (PID: 2676)

    • Launching a file from the Startup directory

      • cmd.exe (PID: 2832)

    • Changes file name

      • cmd.exe (PID: 2152)
      • cmd.exe (PID: 2700)
      • cmd.exe (PID: 2540)
      • cmd.exe (PID: 3608)
      • cmd.exe (PID: 4012)
      • cmd.exe (PID: 2688)
      • cmd.exe (PID: 3380)
      • cmd.exe (PID: 3216)
      • cmd.exe (PID: 4000)
      • cmd.exe (PID: 124)
      • cmd.exe (PID: 3376)
      • cmd.exe (PID: 1584)
      • cmd.exe (PID: 3288)
      • cmd.exe (PID: 3008)
      • cmd.exe (PID: 3520)
      • cmd.exe (PID: 184)
      • cmd.exe (PID: 2944)
      • cmd.exe (PID: 2172)
      • cmd.exe (PID: 4056)
      • cmd.exe (PID: 2588)
      • cmd.exe (PID: 3424)
      • cmd.exe (PID: 2524)
      • cmd.exe (PID: 3920)
      • cmd.exe (PID: 3328)
      • cmd.exe (PID: 3840)
      • cmd.exe (PID: 3684)
      • cmd.exe (PID: 3572)
      • cmd.exe (PID: 3088)
      • cmd.exe (PID: 2484)
      • cmd.exe (PID: 2948)
      • cmd.exe (PID: 1768)
      • cmd.exe (PID: 3972)
      • cmd.exe (PID: 2396)
      • cmd.exe (PID: 2144)
      • cmd.exe (PID: 904)
      • cmd.exe (PID: 4064)
      • cmd.exe (PID: 1996)
      • cmd.exe (PID: 3664)
      • cmd.exe (PID: 2280)
      • cmd.exe (PID: 3040)
      • cmd.exe (PID: 1936)
      • cmd.exe (PID: 3396)
      • cmd.exe (PID: 2944)
      • cmd.exe (PID: 3968)
      • cmd.exe (PID: 2232)
      • cmd.exe (PID: 1456)
      • cmd.exe (PID: 3704)
      • cmd.exe (PID: 2328)
      • cmd.exe (PID: 2600)
      • cmd.exe (PID: 3592)
      • cmd.exe (PID: 3372)
      • cmd.exe (PID: 2860)
      • cmd.exe (PID: 3540)
      • cmd.exe (PID: 3500)
      • cmd.exe (PID: 3316)
      • cmd.exe (PID: 4012)
      • cmd.exe (PID: 3136)
      • cmd.exe (PID: 2788)
      • cmd.exe (PID: 2804)
      • cmd.exe (PID: 3848)
      • cmd.exe (PID: 2016)
      • cmd.exe (PID: 1076)
      • cmd.exe (PID: 3380)
      • cmd.exe (PID: 3404)
      • cmd.exe (PID: 2732)
      • cmd.exe (PID: 3032)
      • cmd.exe (PID: 3064)
      • cmd.exe (PID: 568)
      • cmd.exe (PID: 624)
      • cmd.exe (PID: 2824)
      • cmd.exe (PID: 2792)
      • cmd.exe (PID: 1108)
      • cmd.exe (PID: 3196)
      • cmd.exe (PID: 1780)
      • cmd.exe (PID: 184)
      • cmd.exe (PID: 3272)
      • cmd.exe (PID: 916)
      • cmd.exe (PID: 1784)
      • cmd.exe (PID: 3772)
      • cmd.exe (PID: 3288)
      • cmd.exe (PID: 2532)
      • cmd.exe (PID: 3248)
      • cmd.exe (PID: 3892)
      • cmd.exe (PID: 1612)
      • cmd.exe (PID: 3420)
      • cmd.exe (PID: 3408)
      • cmd.exe (PID: 320)
      • cmd.exe (PID: 1560)
      • cmd.exe (PID: 2000)
      • cmd.exe (PID: 2080)
      • cmd.exe (PID: 3040)
      • cmd.exe (PID: 3396)
      • cmd.exe (PID: 1036)
      • cmd.exe (PID: 780)
      • cmd.exe (PID: 1600)
      • cmd.exe (PID: 3688)
      • cmd.exe (PID: 2524)
      • cmd.exe (PID: 4092)
      • cmd.exe (PID: 2764)
      • cmd.exe (PID: 1488)
      • cmd.exe (PID: 1276)
      • cmd.exe (PID: 1996)
      • cmd.exe (PID: 1748)
      • cmd.exe (PID: 3124)
      • cmd.exe (PID: 1824)
      • cmd.exe (PID: 2156)
      • cmd.exe (PID: 3444)
      • cmd.exe (PID: 1604)
      • cmd.exe (PID: 3924)
      • cmd.exe (PID: 3128)
      • cmd.exe (PID: 2772)
      • cmd.exe (PID: 1936)
      • cmd.exe (PID: 904)
      • cmd.exe (PID: 1108)
      • cmd.exe (PID: 4392)
      • cmd.exe (PID: 2344)
      • cmd.exe (PID: 4324)
      • cmd.exe (PID: 4116)
      • cmd.exe (PID: 4140)
      • cmd.exe (PID: 4276)
      • cmd.exe (PID: 4172)
      • cmd.exe (PID: 4252)
      • cmd.exe (PID: 4300)
      • cmd.exe (PID: 4356)
      • cmd.exe (PID: 4420)
      • cmd.exe (PID: 4452)
      • cmd.exe (PID: 4048)
      • cmd.exe (PID: 1864)
      • cmd.exe (PID: 1408)
      • cmd.exe (PID: 2996)
      • cmd.exe (PID: 2840)
      • cmd.exe (PID: 3888)
      • cmd.exe (PID: 4196)
      • cmd.exe (PID: 4548)
      • cmd.exe (PID: 4516)
      • cmd.exe (PID: 4736)
      • cmd.exe (PID: 4612)
      • cmd.exe (PID: 4648)
      • cmd.exe (PID: 4676)
      • cmd.exe (PID: 4800)
      • cmd.exe (PID: 4972)
      • cmd.exe (PID: 4840)
      • cmd.exe (PID: 4872)
      • cmd.exe (PID: 4896)
      • cmd.exe (PID: 4928)
      • cmd.exe (PID: 4996)
      • cmd.exe (PID: 4492)
      • cmd.exe (PID: 4588)
      • cmd.exe (PID: 4776)
      • cmd.exe (PID: 5148)
      • cmd.exe (PID: 5436)
      • cmd.exe (PID: 5276)
      • cmd.exe (PID: 5244)
      • cmd.exe (PID: 5300)
      • cmd.exe (PID: 5380)
      • cmd.exe (PID: 5340)
      • cmd.exe (PID: 5544)
      • cmd.exe (PID: 5412)
      • cmd.exe (PID: 5460)
      • cmd.exe (PID: 5480)
      • cmd.exe (PID: 5568)
      • cmd.exe (PID: 5504)
      • cmd.exe (PID: 5640)
      • cmd.exe (PID: 5028)
      • cmd.exe (PID: 5060)
      • cmd.exe (PID: 5084)
      • cmd.exe (PID: 5124)
      • cmd.exe (PID: 5172)
      • cmd.exe (PID: 5220)
      • cmd.exe (PID: 5704)
      • cmd.exe (PID: 5744)
      • cmd.exe (PID: 5784)
      • cmd.exe (PID: 5816)
      • cmd.exe (PID: 5904)
      • cmd.exe (PID: 5880)
      • cmd.exe (PID: 5936)
      • cmd.exe (PID: 6056)
      • cmd.exe (PID: 5992)
      • cmd.exe (PID: 6088)
      • cmd.exe (PID: 6128)
      • cmd.exe (PID: 4108)
      • cmd.exe (PID: 4164)
      • cmd.exe (PID: 5848)
      • cmd.exe (PID: 5968)
      • cmd.exe (PID: 6024)
      • cmd.exe (PID: 4416)
      • cmd.exe (PID: 4812)
      • cmd.exe (PID: 4668)
      • cmd.exe (PID: 5048)
      • cmd.exe (PID: 4672)
      • cmd.exe (PID: 4728)
      • cmd.exe (PID: 4916)
      • cmd.exe (PID: 4864)
      • cmd.exe (PID: 4940)
      • cmd.exe (PID: 5016)
      • cmd.exe (PID: 5144)
      • cmd.exe (PID: 4228)
      • cmd.exe (PID: 4292)
      • cmd.exe (PID: 4336)
      • cmd.exe (PID: 4444)
      • cmd.exe (PID: 4528)
      • cmd.exe (PID: 4600)
      • cmd.exe (PID: 4080)
      • cmd.exe (PID: 5524)
      • cmd.exe (PID: 5652)
      • cmd.exe (PID: 5764)
      • cmd.exe (PID: 5736)
      • cmd.exe (PID: 3604)
      • cmd.exe (PID: 5924)
      • cmd.exe (PID: 6008)
      • cmd.exe (PID: 6076)
      • cmd.exe (PID: 2736)
      • cmd.exe (PID: 5180)
      • cmd.exe (PID: 5236)
      • cmd.exe (PID: 5352)
      • cmd.exe (PID: 5404)
      • cmd.exe (PID: 5428)
      • cmd.exe (PID: 5948)
      • cmd.exe (PID: 5368)
      • cmd.exe (PID: 5564)
      • cmd.exe (PID: 5832)
      • cmd.exe (PID: 4152)
      • cmd.exe (PID: 2576)
      • cmd.exe (PID: 4188)
      • cmd.exe (PID: 5808)
      • cmd.exe (PID: 5176)
      • cmd.exe (PID: 4512)
      • cmd.exe (PID: 5488)
      • cmd.exe (PID: 5160)
      • cmd.exe (PID: 5664)
      • cmd.exe (PID: 4664)
      • cmd.exe (PID: 4768)
      • cmd.exe (PID: 4888)
      • cmd.exe (PID: 4968)
      • cmd.exe (PID: 764)
      • cmd.exe (PID: 5932)
      • cmd.exe (PID: 4720)
      • cmd.exe (PID: 4720)
      • cmd.exe (PID: 3304)
      • cmd.exe (PID: 2324)
      • cmd.exe (PID: 5892)
      • cmd.exe (PID: 6076)
      • cmd.exe (PID: 5844)
      • cmd.exe (PID: 5360)
      • cmd.exe (PID: 3924)
      • cmd.exe (PID: 5212)
      • cmd.exe (PID: 5120)
      • cmd.exe (PID: 5096)
      • cmd.exe (PID: 5960)
      • cmd.exe (PID: 4672)
      • cmd.exe (PID: 5808)
      • cmd.exe (PID: 6084)
      • cmd.exe (PID: 5964)
      • cmd.exe (PID: 5188)
      • cmd.exe (PID: 4716)
      • cmd.exe (PID: 4924)
      • cmd.exe (PID: 5500)
      • cmd.exe (PID: 4352)
      • cmd.exe (PID: 4152)
      • cmd.exe (PID: 3924)
      • cmd.exe (PID: 4912)
      • cmd.exe (PID: 5120)
      • cmd.exe (PID: 5832)
      • cmd.exe (PID: 4716)
      • cmd.exe (PID: 6140)
      • cmd.exe (PID: 5632)
      • cmd.exe (PID: 4508)
      • cmd.exe (PID: 4968)
      • cmd.exe (PID: 4608)
      • cmd.exe (PID: 4980)
      • cmd.exe (PID: 5364)
      • cmd.exe (PID: 4164)
      • cmd.exe (PID: 6096)
      • cmd.exe (PID: 5636)
      • cmd.exe (PID: 5428)
      • cmd.exe (PID: 5912)
      • cmd.exe (PID: 5648)
      • cmd.exe (PID: 5796)
      • cmd.exe (PID: 4688)
      • cmd.exe (PID: 5568)
      • cmd.exe (PID: 4884)
      • cmd.exe (PID: 5340)
      • cmd.exe (PID: 5524)
      • cmd.exe (PID: 5188)
      • cmd.exe (PID: 5012)
      • cmd.exe (PID: 5936)
      • cmd.exe (PID: 5652)
      • cmd.exe (PID: 2584)
      • cmd.exe (PID: 6028)
      • cmd.exe (PID: 5216)
      • cmd.exe (PID: 5880)
      • cmd.exe (PID: 5704)
      • cmd.exe (PID: 4812)
      • cmd.exe (PID: 4188)
      • cmd.exe (PID: 3604)
      • cmd.exe (PID: 2964)
      • cmd.exe (PID: 4940)
      • cmd.exe (PID: 5464)
      • cmd.exe (PID: 3300)
      • cmd.exe (PID: 5396)
      • cmd.exe (PID: 5756)
      • cmd.exe (PID: 4924)
      • cmd.exe (PID: 4464)
      • cmd.exe (PID: 4232)
      • cmd.exe (PID: 4132)
      • cmd.exe (PID: 4640)
      • cmd.exe (PID: 3300)
      • cmd.exe (PID: 4292)
      • cmd.exe (PID: 4108)
      • cmd.exe (PID: 6088)
      • cmd.exe (PID: 5048)
      • cmd.exe (PID: 5744)
      • cmd.exe (PID: 5460)
      • cmd.exe (PID: 4160)
      • cmd.exe (PID: 5096)
      • cmd.exe (PID: 4824)
      • cmd.exe (PID: 5040)
      • cmd.exe (PID: 5808)
      • cmd.exe (PID: 5416)
      • cmd.exe (PID: 5060)
      • cmd.exe (PID: 5644)
      • cmd.exe (PID: 2584)
      • cmd.exe (PID: 5460)
      • cmd.exe (PID: 4348)
      • cmd.exe (PID: 4800)
      • cmd.exe (PID: 4560)
      • cmd.exe (PID: 2312)
      • cmd.exe (PID: 5436)
      • cmd.exe (PID: 5412)
      • cmd.exe (PID: 4420)
      • cmd.exe (PID: 5524)
      • cmd.exe (PID: 4736)
      • cmd.exe (PID: 4496)
      • cmd.exe (PID: 5748)

    • Creates files or folders in the user directory

      • ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe (PID: 1472)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 45
ZipBitFlag: 0x0800
ZipCompression: Deflated
ZipModifyDate: 2025:06:09 21:59:42
ZipCRC: 0x00000000
ZipCompressedSize: 2
ZipUncompressedSize: -
ZipFileName: for testing/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
753
Monitored processes
362
Malicious processes
10
Suspicious processes
0

Behavior graph

Click at the process to see the details
start start winrar.exe [email protected] mythlas.exe free youtube downloader.exe no specs neptunium.exe #DARKROAD 000.exe bossdamajor.exe bug32.exe wscript.exe core.exe wscript.exe cmd.exe notepad.exe no specs #WANNACRY ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe taskkill.exe no specs attrib.exe no specs icacls.exe no specs wscript.exe no specs taskdl.exe no specs cmd.exe no specs THREAT wscript.exe wmplayer.exe no specs cmd.exe no specs setup_wm.exe no specs taskkill.exe no specs wmic.exe no specs cmd.exe cmd.exe no specs cmd.exe no specs cmd.exe cmd.exe no specs wmic.exe no specs cmd.exe cmd.exe cmd.exe cmd.exe no specs cmd.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe cmd.exe no specs cmd.exe no specs shutdown.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
124"C:\Windows\System32\cmd.exe" /c ren "C:\Users\admin\Music\*.*" "*.exe"C:\Windows\System32\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
184"C:\Windows\System32\cmd.exe" /c ren "C:\Users\admin\PrintHood\*.*" "*.exe"C:\Windows\System32\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
184"C:\Windows\System32\cmd.exe" /c ren "C:\Users\admin\AppData\Local\Diagnostics\733862231\*.*" "*.exe"C:\Windows\System32\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
3221225794
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
320"C:\Windows\System32\cmd.exe" /c ren "C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crowd Deny\*.*" "*.exe"C:\Windows\System32\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
3221225794
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
568"C:\Windows\System32\cmd.exe" /c ren "C:\Users\admin\AppData\Local\Apps\2.0\OQVLXTZK.4P5\*.*" "*.exe"C:\Windows\System32\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
3221225794
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
604taskdl.exeC:\Users\admin\Desktop\taskdl.exe—ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
SQL Client Configuration Utility EXE
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\users\admin\desktop\taskdl.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp60.dll
c:\windows\system32\msvcrt.dll
624"C:\Windows\System32\cmd.exe" /c ren "C:\Users\admin\AppData\Local\Apps\2.0\OQVLXTZK.4P5\AK6KX289.K1P\manifests\*.*" "*.exe"C:\Windows\System32\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
3221225794
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
752attrib +h .C:\Windows\System32\attrib.exe—ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Attribute Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\attrib.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ulib.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
764"C:\Windows\System32\cmd.exe" /c ren "C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB\*.*" "*.exe"C:\Windows\System32\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
3221225794
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
780"C:\Windows\System32\cmd.exe" /c ren "C:\Users\admin\AppData\Local\ElevatedDiagnostics\460911090\2019073012.000\*.*" "*.exe"C:\Windows\System32\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
3221225794
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
Total events
17 516
Read events
17 348
Write events
160
Delete events
8

Modification events

(PID) Process:(2328) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2328) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(2328) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(2328) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\for testing.zip
(PID) Process:(2328) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2328) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2328) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2328) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2328) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2328) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
Executable files
984
Suspicious files
1 223
Text files
734
Unknown types
0

Dropped files

PID
Process
Filename
Type
2328WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2328.643\for testing\quantizer.exeexecutable
MD5:1458480CF8803569195F934D47AC7481
SHA256:68D528F9AC891E920449188198A233B71B2860838AF4FB970B9966F941CE82CA
2328WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2328.643\for testing\neptunium.exeexecutable
MD5:94259B5AD79024A5B6F5388F18EC061F
SHA256:100B97224063DBAEA25B4D53672B7E3FC81443AEEF10151C47096FFB3C849334
2328WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2328.643\for testing\[email protected]executable
MD5:13F4B868603CF0DD6C32702D1BD858C9
SHA256:CAE57A60C4D269CD1CA43EF143AEDB8BFC4C09A7E4A689544883D05CE89406E7
2328WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2328.643\for testing\Heptoxide.exeexecutable
MD5:F970A59A728C152EBDBD8E45F26AC9D8
SHA256:FA544F8E0146D5F12BD904F65C2E999E475A525FF676350F90289A0CA834C21F
3800Mythlas.exe\Device\Harddisk0\DR0 —
MD5:—
SHA256:—
2328WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2328.643\for testing\Potassium.exeexecutable
MD5:86D3F3F29362283921A9277BDFB73648
SHA256:B264D303E833F180F46A5B5F04C8A4EBD41DB3E5AADB2E1E0058F2C2BF7B5A5C
2328WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2328.643\for testing\000.exeexecutable
MD5:D5671758956B39E048680B6A8275E96A
SHA256:4A900B344EF765A66F98CF39AC06273D565CA0F5D19F7EA4CA183786155D4A47
2328WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2328.643\for testing\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeexecutable
MD5:84C82835A5D21BBCF75A61706D8AB549
SHA256:ED01EBFBC9EB5BBEA545AF4D01BF5F1071661840480439C6E5BABE8E080E41AA
3868neptunium.exe\Device\Harddisk0\DR0 —
MD5:—
SHA256:—
2328WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2328.643\for testing\BUG32.exeexecutable
MD5:149CC2EC1900CB778AFB50D8026EADF5
SHA256:817A695E53A1D6E24F2C701751B4D18468F20698F30FADA420DFBA6E21A09797
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
6
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.174
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
for testing.zip