File name:	unknown.exe.7z
Full analysis:	https://app.any.run/tasks/f423b2bf-de34-43af-8f8a-6fa7da2f177d
Verdict:	Malicious activity
Threats:	Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links. Malware Trends Tracker >>>
Analysis date:	May 24, 2025, 05:24:39
OS:	Windows 11 Professional (build: 22000, 64 bit)
Tags:	sainbox rat
MIME:	application/x-7z-compressed
File info:	7-zip archive data, version 0.4
MD5:	102E15BE6F151C593C7DCF0CF08EF263
SHA1:	48ED093BAD6F564BC387D45A8687F000A85E14FA
SHA256:	20126031A24D2CCDB928F97A6B0495976DF6D5757E645C0066E0DFF80819126F
SSDEEP:	1536:0vzAJHscsXhlohclzIxw505Anirr+720i5vi2OFcCizVRnfFfonH0rI5b+gawJr:CsJNs+ET+hrr+72X5qRHAVRnfe5b+Mt

.7z	\|	7-Zip compressed archive (v0.4) (57.1)
.7z	\|	7-Zip compressed archive (gen) (42.8)


(PID) Process:	(5512) WinRAR.exe	Key:	HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:	write	Name:	2
Value: C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:	(5512) WinRAR.exe	Key:	HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:	write	Name:	1
Value: C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:	(5512) WinRAR.exe	Key:	HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:	write	Name:	0
Value: C:\Users\admin\Desktop\unknown.exe.7z
(PID) Process:	(5512) WinRAR.exe	Key:	HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	name
Value: 120
(PID) Process:	(5512) WinRAR.exe	Key:	HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	size
Value: 80
(PID) Process:	(5512) WinRAR.exe	Key:	HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	type
Value: 120
(PID) Process:	(5512) WinRAR.exe	Key:	HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	mtime
Value: 100
(PID) Process:	(5512) WinRAR.exe	Key:	HKEY_CURRENT_USER\Software\WinRAR\FileList
Operation:	write	Name:	ArcSort
Value: 32
(PID) Process:	(5512) WinRAR.exe	Key:	HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:	write	Name:	ShellExtBMP
Value:
(PID) Process:	(5512) WinRAR.exe	Key:	HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:	write	Name:	ShellExtIcon
Value:

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	POST	200	172.205.25.163:443	https://checkappexec.microsoft.com/windows/shell/actions	unknown	binary	182 b	whitelisted
—	—	HEAD	200	23.197.142.186:443	https://fs.microsoft.com/fs/windows/config.json	unknown	—	—	—
—	—	GET	200	23.197.142.186:443	https://fs.microsoft.com/fs/windows/config.json	unknown	binary	55 b	whitelisted
1352	svchost.exe	GET	200	2.16.168.101:80	http://www.msftconnecttest.com/connecttest.txt	unknown	—	—	whitelisted
2768	svchost.exe	GET	200	199.232.210.172:80	http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?2efe063e74f19306	unknown	—	—	whitelisted
2768	svchost.exe	GET	200	199.232.210.172:80	http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?673bef073e0b4dd4	unknown	—	—	whitelisted
—	—	POST	200	52.178.17.233:443	https://self.events.data.microsoft.com/OneCollector/1.0/	unknown	binary	9 b	whitelisted
—	—	POST	200	40.126.31.129:443	https://login.live.com/RST2.srf	unknown	xml	10.3 Kb	whitelisted
—	—	POST	200	20.190.159.68:443	https://login.live.com/RST2.srf	unknown	xml	11.1 Kb	whitelisted
3596	smartscreen.exe	GET	200	23.32.238.211:80	http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?57ea00879d5f4be2	unknown	—	—	whitelisted

Domain	IP	Reputation
google.com	142.250.186.46	whitelisted
checkappexec.microsoft.com	172.205.25.163	whitelisted
ctldl.windowsupdate.com	23.32.238.211 23.32.238.201 23.32.238.216 23.32.238.200 23.32.238.192 23.32.238.209 23.32.238.203 23.32.238.210 23.32.238.217 199.232.210.172 199.232.214.172	whitelisted
settings-win.data.microsoft.com	51.104.136.2	whitelisted
fs.microsoft.com	23.197.142.186	whitelisted
self.events.data.microsoft.com	52.178.17.233	whitelisted
login.live.com	20.190.160.20 20.190.160.22 20.190.160.65 40.126.32.138 20.190.160.3 40.126.32.74 20.190.160.2 20.190.160.131	whitelisted

PID	Process	Class	Message
1352	svchost.exe	Misc activity	ET INFO Microsoft Connection Test
—	—	Generic Protocol Command Decode	SURICATA HTTP Request unrecognized authorization method

General Info

unknown.exe.7z