File name:

Taskbar Themes Styles 2024 (1).zip

Full analysis: https://app.any.run/tasks/93d06629-0a3a-417a-a576-f4fa5790e86a
Verdict: Malicious activity
Analysis date: September 13, 2024, 03:36:09
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

BBCE5AF5003B12FD1B7DC5B48D497427

SHA1:

AA69ADD762449BB83640DCBE544D28C12AD47F0C

SHA256:

258F173916BB22E869510B99A998F0220B1338F8515B29D06AAD70BF1533193E

SSDEEP:

98304:NCK4TdpZC8KPEANCjdLpwTto9Zx/LtYb3WCvlKcDdA1HwocD9NJ5zjSCaU0v1Y34:YajWsb4doNyVXgI0on7ccdtpkWza/U1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes powershell execution policy (Bypass)

      • [Setup] Taskbar Themes Styles 2024.exe (PID: 3564)
      • [Setup] Taskbar Themes Styles 2024.exe (PID: 3120)
      • [Setup] Taskbar Themes Styles 2024.exe (PID: 1412)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 1892)
      • powershell.exe (PID: 3220)
      • powershell.exe (PID: 2512)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 1892)
      • powershell.exe (PID: 3220)
      • powershell.exe (PID: 2512)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 2788)

    • Drops 7-zip archiver for unpacking

      • WinRAR.exe (PID: 2788)

    • The process creates files with name similar to system file names

      • WinRAR.exe (PID: 2788)

    • Starts POWERSHELL.EXE for commands execution

      • [Setup] Taskbar Themes Styles 2024.exe (PID: 3564)
      • [Setup] Taskbar Themes Styles 2024.exe (PID: 3120)
      • [Setup] Taskbar Themes Styles 2024.exe (PID: 1412)

    • Reads the Internet Settings

      • [Setup] Taskbar Themes Styles 2024.exe (PID: 3564)
      • [Setup] Taskbar Themes Styles 2024.exe (PID: 3120)
      • [Setup] Taskbar Themes Styles 2024.exe (PID: 1412)

  • INFO

    • The process uses the downloaded file

      • WinRAR.exe (PID: 2788)

    • Checks supported languages

      • [Setup] Taskbar Themes Styles 2024.exe (PID: 3564)
      • wmpnscfg.exe (PID: 4080)
      • [Setup] Taskbar Themes Styles 2024.exe (PID: 3120)
      • [Setup] Taskbar Themes Styles 2024.exe (PID: 1412)

    • Reads the computer name

      • [Setup] Taskbar Themes Styles 2024.exe (PID: 3564)
      • wmpnscfg.exe (PID: 4080)
      • [Setup] Taskbar Themes Styles 2024.exe (PID: 3120)
      • [Setup] Taskbar Themes Styles 2024.exe (PID: 1412)

    • Manual execution by a user

      • [Setup] Taskbar Themes Styles 2024.exe (PID: 3564)
      • wmpnscfg.exe (PID: 4080)
      • [Setup] Taskbar Themes Styles 2024.exe (PID: 3120)
      • [Setup] Taskbar Themes Styles 2024.exe (PID: 1412)

    • Reads the machine GUID from the registry

      • [Setup] Taskbar Themes Styles 2024.exe (PID: 3564)
      • [Setup] Taskbar Themes Styles 2024.exe (PID: 3120)
      • [Setup] Taskbar Themes Styles 2024.exe (PID: 1412)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2788)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2022:10:20 20:24:16
ZipCRC: 0xddb6b216
ZipCompressedSize: 243647
ZipUncompressedSize: 385256
ZipFileName: [Setup] Taskbar Themes Styles 2024.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
57
Monitored processes
8
Malicious processes
0
Suspicious processes
3

Behavior graph

Click at the process to see the details
start winrar.exe [setup] taskbar themes styles 2024.exe no specs powershell.exe no specs wmpnscfg.exe no specs [setup] taskbar themes styles 2024.exe powershell.exe no specs [setup] taskbar themes styles 2024.exe powershell.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1412"C:\Users\admin\AppData\Local\Temp\Taskbar Themes Styles 2024 (1)\[Setup] Taskbar Themes Styles 2024.exe" C:\Users\admin\AppData\Local\Temp\Taskbar Themes Styles 2024 (1)\[Setup] Taskbar Themes Styles 2024.exe
explorer.exe
User:
admin
Company:
YL Computing
Integrity Level:
HIGH
Description:
imDesktop
Version:
2.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\taskbar themes styles 2024 (1)\[setup] taskbar themes styles 2024.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1892"powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "(Get-CimInstance -ClassName Win32_VideoController).Caption;"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—[Setup] Taskbar Themes Styles 2024.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2512"powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "(Get-CimInstance -ClassName Win32_VideoController).Caption;"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—[Setup] Taskbar Themes Styles 2024.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2788"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Taskbar Themes Styles 2024 (1).zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3120"C:\Users\admin\AppData\Local\Temp\Taskbar Themes Styles 2024 (1)\[Setup] Taskbar Themes Styles 2024.exe" C:\Users\admin\AppData\Local\Temp\Taskbar Themes Styles 2024 (1)\[Setup] Taskbar Themes Styles 2024.exe
explorer.exe
User:
admin
Company:
YL Computing
Integrity Level:
HIGH
Description:
imDesktop
Exit code:
3762504530
Version:
2.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\taskbar themes styles 2024 (1)\[setup] taskbar themes styles 2024.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3220"powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "(Get-CimInstance -ClassName Win32_VideoController).Caption;"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—[Setup] Taskbar Themes Styles 2024.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
3564"C:\Users\admin\AppData\Local\Temp\Taskbar Themes Styles 2024 (1)\[Setup] Taskbar Themes Styles 2024.exe" C:\Users\admin\AppData\Local\Temp\Taskbar Themes Styles 2024 (1)\[Setup] Taskbar Themes Styles 2024.exe—explorer.exe
User:
admin
Company:
YL Computing
Integrity Level:
MEDIUM
Description:
imDesktop
Exit code:
3221225547
Version:
2.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\taskbar themes styles 2024 (1)\[setup] taskbar themes styles 2024.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
4080"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
6 236
Read events
6 214
Write events
20
Delete events
2

Modification events

(PID) Process:(2788) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2788) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2788) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2788) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(2788) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2788) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(2788) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Taskbar Themes Styles 2024 (1).zip
(PID) Process:(2788) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2788) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2788) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
9
Suspicious files
7
Text files
14
Unknown types
0

Dropped files

PID
Process
Filename
Type
2788WinRAR.exeC:\Users\admin\AppData\Local\Temp\Taskbar Themes Styles 2024 (1)\MetroStatic —
MD5:—
SHA256:—
2788WinRAR.exeC:\Users\admin\AppData\Local\Temp\Taskbar Themes Styles 2024 (1)\[Setup] Taskbar Themes Styles 2024.exeexecutable
MD5:A8BC7FB55A324F1BA1C7807B7C1C4F29
SHA256:F17B6DC2F1DC25B982D1D3DA8601121A1F21E16BE3FE406D3CFF62100CF7562B
2788WinRAR.exeC:\Users\admin\AppData\Local\Temp\Taskbar Themes Styles 2024 (1)\ControlzEx.dllexecutable
MD5:2D5035CB5A3678F2C2F5A889BD384813
SHA256:424CBE8F24A62C330149DBE0B80E214A984950C3B79B067058671608229FC2ED
2788WinRAR.exeC:\Users\admin\AppData\Local\Temp\Taskbar Themes Styles 2024 (1)\Microsoft.WindowsAPICodePack.Shell.dllexecutable
MD5:18A46202A1636B985208E2183D756617
SHA256:513D386FC084AD355D1A8668D8B4E43CC3B21F135AC3EABBC6B96ADEB3EE9E84
2788WinRAR.exeC:\Users\admin\AppData\Local\Temp\Taskbar Themes Styles 2024 (1)\Hardcodet.Wpf.TaskbarNotification.dllexecutable
MD5:D5D708E9E7625AB2C4AC1C1FAA099350
SHA256:F6FADF0375D22512B2B3F075362433C0DE173ADFB290B4D8999CDCB7ACEDB0B2
2788WinRAR.exeC:\Users\admin\AppData\Local\Temp\Taskbar Themes Styles 2024 (1)\Microsoft.WindowsAPICodePack.dllexecutable
MD5:ACE419174E1E0C792D028F25F60D6E5F
SHA256:90D56B0A1C7E631E5A12985F9B7CC943A1EBC31E40EC53D56DC9149BBA74BA24
2788WinRAR.exeC:\Users\admin\AppData\Local\Temp\Taskbar Themes Styles 2024 (1)\Languages\Chinese(Simplified).xmlxml
MD5:2BA8908901C62E486DC7D4CE5822ACF3
SHA256:BC98DB44EBC96B4BA51AD23A7B716584F40B8A1D5A46AE6751AA948CE9FE9F86
2788WinRAR.exeC:\Users\admin\AppData\Local\Temp\Taskbar Themes Styles 2024 (1)\Languages\Chinese(Simplified).pngimage
MD5:18BD6697BC44BCFAA606AEC883FDF1C4
SHA256:3705C17E9A6CF982234898D0269B94427FB3B1978BECE5CF4F3A6C3BF518DA70
2788WinRAR.exeC:\Users\admin\AppData\Local\Temp\Taskbar Themes Styles 2024 (1)\Languages\English.pngimage
MD5:00214D9E4E6155A04E3997D121641C98
SHA256:1037BB804C8DA171FB1869872BCD24AA1F0C96AD8CE783861DFF91D3174D12A7
2788WinRAR.exeC:\Users\admin\AppData\Local\Temp\Taskbar Themes Styles 2024 (1)\Languages\Portuguese (Brazil).xmlxml
MD5:50873071801AA9149F2995E3BAAE2006
SHA256:24579D4503460A3E5111E39522EF48B6DA1C45CDB1C1604AA116D3E22E4B7D82
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
9
DNS requests
5
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1372
svchost.exe
GET
404
199.232.210.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?33775f6043c93e33
unknown
—
—
whitelisted
1060
svchost.exe
GET
404
199.232.214.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?02aae7cfd52f5e66
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
whitelisted
1372
svchost.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1372
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1372
svchost.exe
199.232.210.172:80
ctldl.windowsupdate.com
FASTLY
US
whitelisted
1060
svchost.exe
199.232.214.172:80
ctldl.windowsupdate.com
FASTLY
US
whitelisted
240
WerFault.exe
104.208.16.93:443
watson.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.16.142
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
ctldl.windowsupdate.com
  • 199.232.210.172
  • 199.232.214.172
whitelisted
watson.microsoft.com
  • 104.208.16.93
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Taskbar Themes Styles 2024 (1).zip