File name:

Downloads.zip

Full analysis: https://app.any.run/tasks/56dbf239-a6e4-4b9f-b90d-04b1e570663d
Verdict: Malicious activity
Analysis date: February 26, 2023, 13:54:50
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

9DBB1905F440548C82E78D4C6618DE64

SHA1:

0E9E837A434D7E59F794AF6C9EAE8003340383B6

SHA256:

287375907E26B9FC8C31E72EC23F320815C5EC6A1628494C02EDB7F30F1AB654

SSDEEP:

12288:gVb1w//9cRa4GSxQmP4kFsz8zZD6u6I7HSD9g/g6nuonqOKUViyxDg9EzCde+Npq:o1vRa4+pzd590TqOYY84NzYuZNmPnSl3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • BulletsPassView.exe (PID: 3380)
      • Dialupass.exe (PID: 1772)
      • Dialupass.exe (PID: 2420)
      • mailpv.exe (PID: 1836)
      • NetRouteView.exe (PID: 3872)
      • RouterPassView.exe (PID: 2184)
      • VNCPassView.exe (PID: 4040)
      • WebBrowserPassView.exe (PID: 2492)

    • Actions looks like stealing of personal data

      • mailpv.exe (PID: 1836)
      • WebBrowserPassView.exe (PID: 2492)

    • Steals credentials from Web Browsers

      • WebBrowserPassView.exe (PID: 2492)

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 832)

    • Manual execution by a user

      • BulletsPassView.exe (PID: 3380)
      • NOTEPAD.EXE (PID: 116)
      • Dialupass.exe (PID: 1772)
      • Dialupass.exe (PID: 2420)
      • mailpv.exe (PID: 1836)
      • NetRouteView.exe (PID: 3872)
      • RouterPassView.exe (PID: 2184)
      • WebBrowserPassView.exe (PID: 2492)
      • VNCPassView.exe (PID: 4040)

    • Drops a file that was compiled in debug mode

      • WinRAR.exe (PID: 832)

    • Checks supported languages

      • BulletsPassView.exe (PID: 3380)
      • Dialupass.exe (PID: 1772)
      • mailpv.exe (PID: 1836)
      • NetRouteView.exe (PID: 3872)
      • RouterPassView.exe (PID: 2184)
      • VNCPassView.exe (PID: 4040)
      • WebBrowserPassView.exe (PID: 2492)

    • Reads the computer name

      • BulletsPassView.exe (PID: 3380)
      • Dialupass.exe (PID: 1772)
      • RouterPassView.exe (PID: 2184)
      • NetRouteView.exe (PID: 3872)
      • mailpv.exe (PID: 1836)
      • WebBrowserPassView.exe (PID: 2492)

    • The process checks LSA protection

      • BulletsPassView.exe (PID: 3380)
      • RouterPassView.exe (PID: 2184)
      • WebBrowserPassView.exe (PID: 2492)

    • Reads the machine GUID from the registry

      • BulletsPassView.exe (PID: 3380)
      • RouterPassView.exe (PID: 2184)
      • WebBrowserPassView.exe (PID: 2492)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 832)

    • Create files in a temporary directory

      • WebBrowserPassView.exe (PID: 2492)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: bulletspassview/
ZipUncompressedSize: -
ZipCompressedSize: -
ZipCRC: 0x00000000
ZipModifyDate: 2023:02:26 22:52:10
ZipCompression: None
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
62
Monitored processes
10
Malicious processes
1
Suspicious processes
3

Behavior graph

Click at the process to see the details
start winrar.exe bulletspassview.exe no specs notepad.exe no specs dialupass.exe no specs dialupass.exe mailpv.exe netrouteview.exe no specs routerpassview.exe no specs vncpassview.exe no specs webbrowserpassview.exe

Process information

PID
CMD
Path
Indicators
Parent process
116"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\Downloads\bulletspassview\readme.txtC:\Windows\system32\NOTEPAD.EXE—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\notepad.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
832"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Downloads.zip"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
1772"C:\Users\admin\Desktop\Downloads\dialupass\Dialupass.exe" C:\Users\admin\Desktop\Downloads\dialupass\Dialupass.exe
Explorer.EXE
User:
admin
Company:
NirSoft
Integrity Level:
HIGH
Description:
Dialup/VPN Password Recovery
Exit code:
0
Version:
3.61
Modules
Images
c:\users\admin\desktop\downloads\dialupass\dialupass.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\shlwapi.dll
1836"C:\Users\admin\Desktop\Downloads\mailpv\mailpv.exe" C:\Users\admin\Desktop\Downloads\mailpv\mailpv.exe
Explorer.EXE
User:
admin
Company:
NirSoft
Integrity Level:
MEDIUM
Description:
Email Password-Recovery
Exit code:
0
Version:
1.92
Modules
Images
c:\users\admin\desktop\downloads\mailpv\mailpv.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2184"C:\Users\admin\Desktop\Downloads\routerpassview\RouterPassView.exe" C:\Users\admin\Desktop\Downloads\routerpassview\RouterPassView.exe—Explorer.EXE
User:
admin
Company:
NirSoft
Integrity Level:
MEDIUM
Description:
Decrypts Router files.
Exit code:
0
Version:
1.90
Modules
Images
c:\users\admin\desktop\downloads\routerpassview\routerpassview.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2420"C:\Users\admin\Desktop\Downloads\dialupass\Dialupass.exe" C:\Users\admin\Desktop\Downloads\dialupass\Dialupass.exe—Explorer.EXE
User:
admin
Company:
NirSoft
Integrity Level:
MEDIUM
Description:
Dialup/VPN Password Recovery
Exit code:
3221226540
Version:
3.61
Modules
Images
c:\users\admin\desktop\downloads\dialupass\dialupass.exe
c:\windows\system32\ntdll.dll
2492"C:\Users\admin\Desktop\Downloads\webbrowserpassview (1)\WebBrowserPassView.exe" C:\Users\admin\Desktop\Downloads\webbrowserpassview (1)\WebBrowserPassView.exe
Explorer.EXE
User:
admin
Company:
NirSoft
Integrity Level:
MEDIUM
Description:
Web Browser Password Viewer
Exit code:
0
Version:
2.12
Modules
Images
c:\users\admin\desktop\downloads\webbrowserpassview (1)\webbrowserpassview.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3380"C:\Users\admin\Desktop\Downloads\bulletspassview\BulletsPassView.exe" C:\Users\admin\Desktop\Downloads\bulletspassview\BulletsPassView.exe—Explorer.EXE
User:
admin
Company:
NirSoft
Integrity Level:
MEDIUM
Description:
BulletsPassView
Exit code:
0
Version:
1.32
Modules
Images
c:\users\admin\desktop\downloads\bulletspassview\bulletspassview.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\shlwapi.dll
3872"C:\Users\admin\Desktop\Downloads\netrouteview\NetRouteView.exe" C:\Users\admin\Desktop\Downloads\netrouteview\NetRouteView.exe—Explorer.EXE
User:
admin
Company:
NirSoft
Integrity Level:
MEDIUM
Description:
NetRouteView
Exit code:
0
Version:
1.40
Modules
Images
c:\users\admin\desktop\downloads\netrouteview\netrouteview.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
4040"C:\Users\admin\Desktop\Downloads\vncpassview\VNCPassView.exe" C:\Users\admin\Desktop\Downloads\vncpassview\VNCPassView.exe—Explorer.EXE
User:
admin
Company:
NirSoft
Integrity Level:
MEDIUM
Description:
VNCPassView
Exit code:
0
Version:
1.05
Modules
Images
c:\users\admin\desktop\downloads\vncpassview\vncpassview.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
4 448
Read events
4 340
Write events
106
Delete events
2

Modification events

(PID) Process:(832) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(832) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(832) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(832) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(832) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(832) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(832) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Downloads.zip
(PID) Process:(832) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(832) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(832) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
14
Suspicious files
0
Text files
28
Unknown types
14

Dropped files

PID
Process
Filename
Type
832WinRAR.exeC:\Users\admin\Desktop\Downloads\bulletspassview\readme.txttext
MD5:57AEE80A94BAF45512C0B7BD598C9B35
SHA256:4B1D52F644239A09BAF545CD54C7DDFC9D04CB5F65E73F63989F71ED1B99612B
832WinRAR.exeC:\Users\admin\Desktop\Downloads\bulletspassview\BulletsPassView.chmchm
MD5:C957F7AB8D05FABAC84EF239FB36CB29
SHA256:32F9F133832ADC8116F5A588D35CA4F036B7E435E9AEEADE48B3A823DA56372F
832WinRAR.exeC:\Users\admin\Desktop\Downloads\dialupass\Dialupass.chmchm
MD5:287F794AA15CB93FA91B763B34FE3A3A
SHA256:1E3EC12FBE9825C1EB044994D27C6FB97E5B2CEE352D114B0AE6F8862E2A2DD5
832WinRAR.exeC:\Users\admin\Desktop\Downloads\dialupass\readme.txttext
MD5:4F4A1F874F73C9236B92C6BBD1F36E3B
SHA256:C136C24B40756F9CF4D5AD3C7F7F1AEA9CE13E82979918E70326262F801A8F4C
832WinRAR.exeC:\Users\admin\Desktop\Downloads\bulletspassview\BulletsPassView.exeexecutable
MD5:E40C9293EA0B6D62A0F62F40212DF07B
SHA256:B19DFE440E515C39928B475A946656A12B1051E98E0DF36C016586B34A766D5C
832WinRAR.exeC:\Users\admin\Desktop\Downloads\vncpassview\VNCPassView.exeexecutable
MD5:D28F0CFAE377553FCB85918C29F4889B
SHA256:816D7616238958DFE0BB811A063EB3102EFD82EFF14408F5CAB4CB5258BFD019
832WinRAR.exeC:\Users\admin\Desktop\Downloads\webbrowserpassview (1)\readme.txttext
MD5:DFF7CBF7A7A6FC115C45D8E384FFCA0F
SHA256:496794C2682DE2961E0D48EC79DB5511F9274AC06405A40F64BE927DE89E05FC
832WinRAR.exeC:\Users\admin\Desktop\Downloads\routerpassview\RouterPassView.exeexecutable
MD5:10D1D830605DB00287A616674EF9154A
SHA256:3EE00A42A65D2DF9EE571875A11F53B56C8494E90E1E8E60E128AABDB56399C8
2492WebBrowserPassView.exeC:\Users\admin\AppData\Local\Temp\bhv5156.tmp —
MD5:—
SHA256:—
832WinRAR.exeC:\Users\admin\Desktop\Downloads\vncpassview\VNCPassView.chmchm
MD5:4314DF5882277917E89357D7243A3CEC
SHA256:CBA64638575E382BAB065F43DC60B76943BCE77854A80AF38DEBEB803EDB96E4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Downloads.zip