URL:

http://download2272.mediafire.com/x4b7dozb8mmgrZ-JHsVU4k2Ml0FY0g-j3Qv8fk5L4DTJ_3k6AYLudonskVwcCCH9dPgHbGtkdmh5_CuVwGNoQgzfZkTjPiIMxnMocxWW2tVfudIpXk66Ht3Gendu5mN0yjdetc-849gcOnhflc9mipr65_JdqWtF4NNDVHYTgw0jhA/jxa6b0sxeyv2sz7/PentiumTools.b.19.by.xakumm.public.v0.2.rar

Full analysis: https://app.any.run/tasks/5e5afc50-f285-40a6-8bfe-72b13dda702d
Verdict: Malicious activity
Analysis date: February 19, 2024, 01:21:08
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

D4958BBD7816334E9903244689F59A3E

SHA1:

AD2DF7D0FA07ADD3517E57B5DCE33CCB70014D3F

SHA256:

1FA60790C8E212FF6AEFF3ADFF03B27337C7AC4506FB431238603996345D7A5E

SSDEEP:

6:CalJeGO/CH4LEcwGgwHoKEDUsM5QI4Axrm7zPdsqGlCUIL8V+:NJev6HvjGpIKED+dDxq7zPd2d284

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • PentiumTools.b.19.exe (PID: 268)
      • PentiumTools.b.19.exe (PID: 3040)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 2376)

    • Executable content was dropped or overwritten

      • PentiumTools.b.19.exe (PID: 268)
      • PentiumTools.b.19.exe (PID: 3040)

  • INFO

    • Manual execution by a user

      • explorer.exe (PID: 3068)
      • WinRAR.exe (PID: 2376)
      • PentiumTools.b.19.exe (PID: 268)
      • msinfo32.exe (PID: 3080)
      • PentiumTools.b.19.exe (PID: 3040)

    • Application launched itself

      • iexplore.exe (PID: 3864)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 3864)

    • The process uses the downloaded file

      • iexplore.exe (PID: 3864)
      • WinRAR.exe (PID: 2376)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2376)

    • Checks supported languages

      • PentiumTools.b.19.exe (PID: 268)
      • PentiumTools.b.19.exe (PID: 3040)

    • Reads the time zone

      • PentiumTools.b.19.exe (PID: 268)
      • PentiumTools.b.19.exe (PID: 3040)

    • Create files in a temporary directory

      • PentiumTools.b.19.exe (PID: 268)
      • PentiumTools.b.19.exe (PID: 3040)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 2376)

    • Reads the computer name

      • PentiumTools.b.19.exe (PID: 3040)
      • PentiumTools.b.19.exe (PID: 268)

    • Reads the machine GUID from the registry

      • PentiumTools.b.19.exe (PID: 3040)
      • PentiumTools.b.19.exe (PID: 268)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
54
Monitored processes
7
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe explorer.exe no specs winrar.exe pentiumtools.b.19.exe pentiumtools.b.19.exe msinfo32.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
268"C:\Users\admin\Downloads\PentiumTools.b.19.by.xakumm.public.v0.2\PentiumTools.b.19\PentiumTools.b.19.exe" C:\Users\admin\Downloads\PentiumTools.b.19.by.xakumm.public.v0.2\PentiumTools.b.19\PentiumTools.b.19.exe
explorer.exe
User:
admin
Company:
Pentium Software
Integrity Level:
MEDIUM
Description:
PentiumTools
Exit code:
0
Version:
2.0.0.19
Modules
Images
c:\users\admin\downloads\pentiumtools.b.19.by.xakumm.public.v0.2\pentiumtools.b.19\pentiumtools.b.19.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2376"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Downloads\PentiumTools.b.19.by.xakumm.public.v0.2.rar" C:\Users\admin\Downloads\PentiumTools.b.19.by.xakumm.public.v0.2\C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3040"C:\Users\admin\Downloads\PentiumTools.b.19.by.xakumm.public.v0.2\PentiumTools.b.19\PentiumTools.b.19.exe" C:\Users\admin\Downloads\PentiumTools.b.19.by.xakumm.public.v0.2\PentiumTools.b.19\PentiumTools.b.19.exe
explorer.exe
User:
admin
Company:
Pentium Software
Integrity Level:
MEDIUM
Description:
PentiumTools
Exit code:
0
Version:
2.0.0.19
Modules
Images
c:\users\admin\downloads\pentiumtools.b.19.by.xakumm.public.v0.2\pentiumtools.b.19\pentiumtools.b.19.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3068"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3080"C:\Windows\system32\msinfo32.exe" "C:\Users\admin\Downloads\PentiumTools.b.19.by.xakumm.public.v0.2\PentiumTools.b.19\xakumm.nfo"C:\Windows\System32\msinfo32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
System Information
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msinfo32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3864"C:\Program Files\Internet Explorer\iexplore.exe" "http://download2272.mediafire.com/x4b7dozb8mmgrZ-JHsVU4k2Ml0FY0g-j3Qv8fk5L4DTJ_3k6AYLudonskVwcCCH9dPgHbGtkdmh5_CuVwGNoQgzfZkTjPiIMxnMocxWW2tVfudIpXk66Ht3Gendu5mN0yjdetc-849gcOnhflc9mipr65_JdqWtF4NNDVHYTgw0jhA/jxa6b0sxeyv2sz7/PentiumTools.b.19.by.xakumm.public.v0.2.rar"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3952"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3864 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
47 131
Read events
46 952
Write events
141
Delete events
38

Modification events

(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31089361
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
20022348
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31089362
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
81
Suspicious files
58
Text files
199
Unknown types
33

Dropped files

PID
Process
Filename
Type
3952iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\download_repair[1].htmhtml
MD5:BC285EB4AF02DB3C48EC6C9E6E28C92A
SHA256:1B5E979B2553CEEF1FA61DA88807D80B6EDE269DB64940B7C45CFCEBFC517C07
3952iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\NY0CYG1G.txttext
MD5:1C4BC561724D60915AF4DC79D36BE87E
SHA256:88945D1932A26285119FBC98FB2C04D700F6D2B48AD37B7BD959BF67A558A83D
3952iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\master_121925[1].jstext
MD5:6B5CAF0BB6C58716C9CE2BA29E8B45EB
SHA256:02F0D99176865796E1F3C031048B3CF2084CC389E501FDE0F25EF75BD739BCAF
3952iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\060EYAQY.txttext
MD5:9EFC838C261DDF503F27683809199F96
SHA256:C8F137D96227E90DEC41CD013F944ACAF3313A5B18E91D50FFA8983D4D3842C1
3952iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\mf_logo_u1_full_color[1].svgimage
MD5:E09B5AF507BD602AD839B261FD897170
SHA256:BFCC5BC8242D357752657942690541BB3E4B907384AF1C56586F6466D7116DB2
3952iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\jquery.min[1].jshtml
MD5:B8D64D0BC142B3F670CC0611B0AEBCAE
SHA256:47B68DCE8CB6805AD5B3EA4D27AF92A241F4E29A5C12A274C852E4346A0500B4
3952iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\7JONOM7H.txttext
MD5:6CD24E4EEB38CAFB933656EC8401B6AD
SHA256:986576A769D4571E4BB7098F4E7629DBC2E78AE4C552AA623011F05817D7E058
3952iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAbinary
MD5:B2FE9AE1871B51DEBB5436CC1C91092C
SHA256:E7B14251EEFD7A6CCCC1D84EE39040D4954D1A10551EF9404EE2E7AF2D420FF3
3952iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:5386C4748AF64CA2369F54B4A418DD59
SHA256:CEBAE3280C7DF65DC0BA3E6D74F0DDA554E5343121D8CAAE5B60364651FC796F
3952iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_8F986B155B6342EE1ACF678AFF6889B0der
MD5:DD0E7A365E693C451036B8CBD84D6351
SHA256:D97D69B4B62609977DAC8C6D648AF27CE3DFE5ACF67B1D6C3E591312E6EC33E7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
148
TCP/UDP connections
101
DNS requests
43
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3952
iexplore.exe
GET
200
104.16.113.74:80
http://www.mediafire.com/download_repair.php?flag=2&dkey=x4b7dozb8mmgrZ%2DJHsVU4k2Ml0FY0g%2Dj3Qv8fk5L4DTJ%5F3k6AYLudonskVwcCCH9dPgHbGtkdmh5%5FCuVwGNoQgzfZkTjPiIMxnMocxWW2tVfudIpXk66Ht3Gendu5mN0yjdetc%2D849gcOnhflc9mipr65%5FJdqWtF4NNDVHYTgw0jhA&qkey=jxa6b0sxeyv2sz7&ip=216%2E24%2E213%2E187
unknown
html
10.2 Kb
unknown
3952
iexplore.exe
GET
302
199.91.155.13:80
http://download2272.mediafire.com/x4b7dozb8mmgrZ-JHsVU4k2Ml0FY0g-j3Qv8fk5L4DTJ_3k6AYLudonskVwcCCH9dPgHbGtkdmh5_CuVwGNoQgzfZkTjPiIMxnMocxWW2tVfudIpXk66Ht3Gendu5mN0yjdetc-849gcOnhflc9mipr65_JdqWtF4NNDVHYTgw0jhA/jxa6b0sxeyv2sz7/PentiumTools.b.19.by.xakumm.public.v0.2.rar
unknown
—
—
unknown
3952
iexplore.exe
GET
304
173.222.108.210:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?31edca662c8b6304
unknown
—
—
unknown
3952
iexplore.exe
GET
304
173.222.108.210:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?bdd1e87152b01aed
unknown
—
—
unknown
3952
iexplore.exe
GET
304
173.222.108.210:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?21e2d5edb0479497
unknown
—
—
unknown
3952
iexplore.exe
GET
304
173.222.108.210:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?bf012385ffb92421
unknown
—
—
unknown
3952
iexplore.exe
GET
304
173.222.108.210:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?4088c777bef75a89
unknown
—
—
unknown
3952
iexplore.exe
GET
304
173.222.108.210:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?2788e0fe40679967
unknown
—
—
unknown
3952
iexplore.exe
GET
304
173.222.108.210:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?fe621b814c27cf17
unknown
—
—
unknown
3952
iexplore.exe
GET
304
173.222.108.210:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?9d96f712d6f75dda
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3952
iexplore.exe
199.91.155.13:80
download2272.mediafire.com
MEDIAFIRE
US
unknown
3952
iexplore.exe
104.16.113.74:80
www.mediafire.com
CLOUDFLARENET
—
unknown
3952
iexplore.exe
216.58.212.170:443
fonts.googleapis.com
GOOGLE
US
whitelisted
3952
iexplore.exe
172.217.16.196:443
www.google.com
GOOGLE
US
whitelisted
3952
iexplore.exe
172.217.18.10:80
ajax.googleapis.com
GOOGLE
US
whitelisted
3952
iexplore.exe
142.250.185.136:443
www.googletagmanager.com
GOOGLE
US
unknown
3952
iexplore.exe
104.16.57.101:443
static.cloudflareinsights.com
CLOUDFLARENET
—
unknown

DNS requests

Domain
IP
Reputation
download2272.mediafire.com
  • 199.91.155.13
unknown
www.mediafire.com
  • 104.16.113.74
  • 104.16.114.74
shared
static.mediafire.com
  • 104.16.113.74
  • 104.16.114.74
shared
fonts.googleapis.com
  • 216.58.212.170
whitelisted
www.google.com
  • 172.217.16.196
whitelisted
ajax.googleapis.com
  • 172.217.18.10
whitelisted
www.googletagmanager.com
  • 142.250.185.136
whitelisted
static.cloudflareinsights.com
  • 104.16.57.101
  • 104.16.56.101
whitelisted
ctldl.windowsupdate.com
  • 173.222.108.210
  • 173.222.108.226
  • 93.184.221.240
whitelisted
ocsp.pki.goog
  • 142.250.181.227
whitelisted

Threats

PID
Process
Class
Message
1080
svchost.exe
Potentially Bad Traffic
ET HUNTING File Sharing Related Domain in DNS Lookup (download .mediafire .com)
1080
svchost.exe
Potentially Bad Traffic
ET HUNTING File Sharing Related Domain (www .mediafire .com) in DNS Lookup
1080
svchost.exe
Potentially Bad Traffic
ET HUNTING File Sharing Related Domain in DNS Lookup (download .mediafire .com)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://download2272.mediafire.com/x4b7dozb8mmgrZ-JHsVU4k2Ml0FY0g-j3Qv8fk5L4DTJ_3k6AYLudonskVwcCCH9dPgHbGtkdmh5_CuVwGNoQgzfZkTjPiIMxnMocxWW2tVfudIpXk66Ht3Gendu5mN0yjdetc-849gcOnhflc9mipr65_JdqWtF4NNDVHYTgw0jhA/jxa6b0sxeyv2sz7/PentiumTools.b.19.by.xakumm.public.v0.2.rar