File name:

NBA 2k21 HACK.zip

Full analysis: https://app.any.run/tasks/2d80d9b7-d796-410d-9414-0a7a8cfee804
Verdict: Malicious activity
Analysis date: May 22, 2021, 15:12:57
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

859A7F60617B9DBE73BEB8AE3C99B526

SHA1:

ADD75B223085193EFF8B7C5EF9C01CE5A5C22592

SHA256:

1B29F455D4C660C015422D1C9418FFF05606CE495A5338EFABD1C58813719ECC

SSDEEP:

98304:WWotYtEuaVgWyq0uGGe2auv15pzI3bf+xWc:wStEXVgBZEqO15pkL7c

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • loader.exe (PID: 568)
      • loader.exe (PID: 1916)
      • loader.exe (PID: 2296)

    • Task Manager has been disabled (taskmgr)

      • reg.exe (PID: 3308)

  • SUSPICIOUS

    • Uses REG.EXE to modify Windows registry

      • cmd.exe (PID: 3032)
      • cmd.exe (PID: 3376)
      • cmd.exe (PID: 2384)

    • Executes scripts

      • loader.exe (PID: 568)
      • loader.exe (PID: 1916)
      • loader.exe (PID: 2296)

    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 272)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 272)

    • Drops a file that was compiled in debug mode

      • WinRAR.exe (PID: 272)

    • Starts CMD.EXE for commands execution

      • WScript.exe (PID: 2680)
      • WScript.exe (PID: 2072)
      • WScript.exe (PID: 3524)

    • Creates files in the user directory

      • loader.exe (PID: 568)
      • loader.exe (PID: 1916)
      • loader.exe (PID: 2296)

  • INFO

    • Manual execution by user

      • loader.exe (PID: 1916)
      • loader.exe (PID: 2296)
      • NOTEPAD.EXE (PID: 3124)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: loader.exe
ZipUncompressedSize: 317049
ZipCompressedSize: 183909
ZipCRC: 0x1d7fac9f
ZipModifyDate: 2021:05:15 13:04:08
ZipCompression: Deflated
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
56
Monitored processes
14
Malicious processes
1
Suspicious processes
2

Behavior graph

Click at the process to see the details
drop and start start winrar.exe loader.exe no specs wscript.exe no specs cmd.exe no specs reg.exe no specs loader.exe no specs wscript.exe no specs cmd.exe no specs reg.exe no specs loader.exe wscript.exe no specs cmd.exe no specs reg.exe no specs notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
272"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\NBA 2k21 HACK.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
568"C:\Users\admin\AppData\Local\Temp\Rar$EXa272.22892\loader.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa272.22892\loader.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa272.22892\loader.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1916"C:\Users\admin\Desktop\New folder\loader.exe" C:\Users\admin\Desktop\New folder\loader.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
10
Modules
Images
c:\users\admin\desktop\new folder\loader.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1956reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /fC:\Windows\system32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2072"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Roaming\runtimeMonitor\NyfA3wvdq7bpVs63LwXybMHCK.vbe" C:\Windows\System32\WScript.exe—loader.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2296"C:\Users\admin\Desktop\New folder\loader.exe" C:\Users\admin\Desktop\New folder\loader.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
10
Modules
Images
c:\users\admin\desktop\new folder\loader.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2384cmd /c ""C:\Users\admin\AppData\Roaming\runtimeMonitor\AYWP5.bat" "C:\Windows\System32\cmd.exe—WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2420reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /fC:\Windows\system32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2680"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Roaming\runtimeMonitor\NyfA3wvdq7bpVs63LwXybMHCK.vbe" C:\Windows\System32\WScript.exe—loader.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3032cmd /c ""C:\Users\admin\AppData\Roaming\runtimeMonitor\AYWP5.bat" "C:\Windows\System32\cmd.exe—WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
2 766
Read events
2 705
Write events
61
Delete events
0

Modification events

(PID) Process:(272) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(272) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(272) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(272) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\NBA 2k21 HACK.zip
(PID) Process:(272) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(272) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(272) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(272) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(272) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:@C:\Windows\system32\notepad.exe,-469
Value:
Text Document
(PID) Process:(272) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
Executable files
5
Suspicious files
0
Text files
2
Unknown types
1

Dropped files

PID
Process
Filename
Type
272WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa272.24724\loader.exe —
MD5:—
SHA256:—
272WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa272.24724\Header.dll —
MD5:—
SHA256:—
272WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa272.24724\DirectX\DirectX.exe —
MD5:—
SHA256:—
272WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa272.24724\GameOverlayRenderer64.dll —
MD5:—
SHA256:—
272WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa272.24724\readme.txt —
MD5:—
SHA256:—
272WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa272.24724\Syslx.dll —
MD5:—
SHA256:—
272WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa272.22892\Header.dllexecutable
MD5:—
SHA256:—
272WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa272.22892\loader.exeexecutable
MD5:—
SHA256:—
272WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa272.22892\Syslx.dllexecutable
MD5:—
SHA256:—
568loader.exeC:\Users\admin\AppData\Roaming\runtimeMonitor\AYWP5.battext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
NBA 2k21 HACK.zip