Find similar analyses in TI Lookup
Analysis date (UTC): 26 August 2024, 05:39Analysis environment: Windows 10 Pro, build 19045, x64

https://www.mediafire.com/file/o50xaz6wgtazqnx/fix.zip/file

MD5:73805ED84B6C3D42A6354DCD4A0260F3
SHA1:02DC6A018EA4DB045BEF94214B19BBB1CC8886FE
SHA256:1E02C6393FF400B251E95DFC14B5C913E579269BDE45B2A15797653C761E0855

Analysis result

Threat level:Malicious activity
Tags:
stealer
Full analysis:Analysis https://www.mediafire.com/file/o50xaz6wgtazqnx/fix.zip/file Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Actions looks like stealing of personal data

  • RegAsm.exe (PID: 7572)
  • RegAsm.exe (PID: 6124)
  • RegAsm.exe (PID: 7580)
  • RegAsm.exe (PID: 2144)

SUSPICIOUS

Searches for installed software

  • RegAsm.exe (PID: 7572)
  • RegAsm.exe (PID: 6124)
  • RegAsm.exe (PID: 7580)
  • RegAsm.exe (PID: 2144)

INFO

Manual execution by a user

  • WinRAR.exe (PID: 7348)
  • x86_64-w64-ranlib.exe (PID: 7716)
  • x86_64-w64-ranlib.exe (PID: 460)
  • cmd.exe (PID: 7052)

Reads Microsoft Office registry keys

  • chrome.exe (PID: 6600)

Executable content was dropped or overwritten

  • WinRAR.exe (PID: 7348)

Checks supported languages

  • RegAsm.exe (PID: 7572)
  • x86_64-w64-ranlib.exe (PID: 7716)
  • RegAsm.exe (PID: 6124)
  • x86_64-w64-ranlib.exe (PID: 460)
  • x86_64-w64-ranlib.exe (PID: 7484)
  • x86_64-w64-ranlib.exe (PID: 1744)
  • RegAsm.exe (PID: 7580)
  • RegAsm.exe (PID: 2144)

Reads the computer name

  • x86_64-w64-ranlib.exe (PID: 7716)
  • RegAsm.exe (PID: 7572)
  • x86_64-w64-ranlib.exe (PID: 460)
  • RegAsm.exe (PID: 6124)
  • x86_64-w64-ranlib.exe (PID: 7484)
  • RegAsm.exe (PID: 7580)
  • x86_64-w64-ranlib.exe (PID: 1744)
  • RegAsm.exe (PID: 2144)

Reads the software policy settings

  • RegAsm.exe (PID: 7572)
  • RegAsm.exe (PID: 6124)
  • RegAsm.exe (PID: 7580)
  • RegAsm.exe (PID: 2144)

Application launched itself

  • chrome.exe (PID: 6600)

Threats

PIDProcessClassMessage
6920chrome.exePotentially Bad TrafficET HUNTING File Sharing Related Domain (www .mediafire .com) in DNS Lookup
6920chrome.exePotentially Bad TrafficET HUNTING File Sharing Related Domain (www .mediafire .com) in DNS Lookup
2256svchost.exePotentially Bad TrafficET HUNTING File Sharing Related Domain (www .mediafire .com) in DNS Lookup
6920chrome.exeNot Suspicious TrafficINFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
6920chrome.exeNot Suspicious TrafficINFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
6920chrome.exePotentially Bad TrafficET HUNTING File Sharing Related Domain in DNS Lookup (download .mediafire .com)
6920chrome.exePotentially Bad TrafficET HUNTING File Sharing Related Domain in DNS Lookup (download .mediafire .com)

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Interactive malware hunting service ANY.RUN

© 2017-2026 ANY.RUN LLC. ALL RIGHTS RESERVED