File name:

Velocitys15TweaksPack.7z

Full analysis: https://app.any.run/tasks/8f568d16-d618-4c49-92a3-19d9b42f7396
Verdict: Malicious activity
Analysis date: December 13, 2024, 19:04:10
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
arch-doc
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

A983DB96CF6A69AF17F625228694C6D9

SHA1:

99289978C8734F51F798CEB12F3AB490ABF68288

SHA256:

29EC4B66B1127759FB830322AE431D78BCCB42CE23167D041A910FF859ACBBB1

SSDEEP:

98304:6Zzs6z1FiGt5MqCZdE5qOLb0UCCMbIQb0Zuypf0BOg7LulkOI3z8Ycy0Wmy2oTV6:waLn45

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Antivirus name has been found in the command line (generic signature)

      • MpCmdRun.exe (PID: 3780)
      • MpCmdRun.exe (PID: 4596)

    • Generic archive extractor

      • WinRAR.exe (PID: 4504)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 4504)

    • Probably fake Windows Update file has been dropped

      • WinRAR.exe (PID: 4504)

    • Executing commands from a ".bat" file

      • WinRAR.exe (PID: 4504)

    • Starts CMD.EXE for commands execution

      • WinRAR.exe (PID: 4504)

    • Write to the desktop.ini file (may be used to cloak folders)

      • WinRAR.exe (PID: 4504)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 4504)

    • Checks supported languages

      • MpCmdRun.exe (PID: 3780)
      • MpCmdRun.exe (PID: 4596)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 4504)

    • The process uses the downloaded file

      • WinRAR.exe (PID: 4504)

    • Create files in a temporary directory

      • MpCmdRun.exe (PID: 3780)

    • Reads the computer name

      • MpCmdRun.exe (PID: 4596)
      • MpCmdRun.exe (PID: 3780)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)

EXIF

ZIP

ArchivedFileName: Velocity's 15 Tweaks Pack
ModifyDate: 2024:08:16 06:25:42+00:00
FileVersion: 7z v0.04
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
124
Monitored processes
7
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe cmd.exe no specs conhost.exe no specs mpcmdrun.exe no specs cmd.exe no specs conhost.exe no specs mpcmdrun.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
4504"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\Velocitys15TweaksPack.7zC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4724C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\Rar$VR4504.49478\Rar$Scan25697.bat" "C:\Windows\System32\cmd.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
2072\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3780"C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\admin\AppData\Local\Temp\Rar$VR4504.49478"C:\Program Files\Windows Defender\MpCmdRun.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Malware Protection Command Line Utility
Exit code:
2
Version:
4.18.1909.6 (WinBuild.160101.0800)
Modules
Images
c:\program files\windows defender\mpcmdrun.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
4444C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\Rar$VR4504.3636\Rar$Scan67490.bat" "C:\Windows\System32\cmd.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
6072\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4596"C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\admin\AppData\Local\Temp\Rar$VR4504.3636"C:\Program Files\Windows Defender\MpCmdRun.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Malware Protection Command Line Utility
Exit code:
2
Version:
4.18.1909.6 (WinBuild.160101.0800)
Modules
Images
c:\program files\windows defender\mpcmdrun.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
Total events
1 710
Read events
1 700
Write events
10
Delete events
0

Modification events

(PID) Process:(4504) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(4504) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(4504) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(4504) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Velocitys15TweaksPack.7z
(PID) Process:(4504) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(4504) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(4504) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(4504) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(4504) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\VirusScan
Operation:writeName:DefScanner
Value:
Windows Defender
Executable files
16
Suspicious files
8
Text files
23
Unknown types
14

Dropped files

PID
Process
Filename
Type
4504WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR4504.49478\Velocitys15TweaksPack.7z\Velocity's 15 Tweaks Pack\0. Create a restore point\Restore Point.lnklnk
MD5:7E6CA5FF427E56332EB24781283902B9
SHA256:C38003847F2A60E918FAFE557D5BCC56FB82205E0665F440A00490E51D78FF03
4504WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR4504.49478\Velocitys15TweaksPack.7z\Velocity's 15 Tweaks Pack\2. Power plan\Powerplan copy and paste.txttext
MD5:07AAB9F5581508AA0CFFCAF4A6211357
SHA256:231ED7D53087321FC8846AC082847976E5A29ACD4FF6077DE00759515E772FCA
4504WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR4504.49478\Velocitys15TweaksPack.7z\Velocity's 15 Tweaks Pack\4. NVIDIA Profile Inspector settings\Newest Nvidia Profile.nipxml
MD5:77667E62A091BB4835892B7D0DE5E20B
SHA256:DD45F5974A1C00893C8F1ABFB72D046D63BB76FB77EA09B6328B8A1C7D635454
4504WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR4504.49478\Velocitys15TweaksPack.7z\Velocity's 15 Tweaks Pack\6. Clean up storage\Temp2.lnklnk
MD5:6A3453163E386A9F90760C70AE9B64A4
SHA256:1C4DE816C111BE7FDFCEA88A9423A9C1F8E85201C31DC951C34FA8E290A847F5
4504WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR4504.49478\Velocitys15TweaksPack.7z\Velocity's 15 Tweaks Pack\13. Disable hardware acceleration\Read me.txttext
MD5:B9A99918C9BBF5BDDC2873F953504320
SHA256:343D8A09D5CA5F1F40A6BAC3128950E472E339DB92BAF336E1B3E313A6C0BAA6
4504WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR4504.49478\Velocitys15TweaksPack.7z\Velocity's 15 Tweaks Pack\11. Device cleanup\DeviceCleanup.initext
MD5:71F887495A2C25BFF5B00CA4E9F3A1EE
SHA256:45D2D92DEB3E872B1A78AFD8C1949C1ABF68BE98B0E072CD527C664FDC06C115
4504WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR4504.49478\Velocitys15TweaksPack.7z\Velocity's 15 Tweaks Pack\6. Clean up storage\Temp.lnkbinary
MD5:0E9EF88B2DF3DAE137B542EF560BA229
SHA256:6774369994A02DF8C145D53C33A559E223430A414A77B8A8424FC7D8D1AECBFB
4504WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR4504.49478\Velocitys15TweaksPack.7z\Velocity's 15 Tweaks Pack\6. Clean up storage\Prefetch.lnklnk
MD5:EE3FD984F7120999732D37D65C9AB31C
SHA256:3E11FDFB225CB76CFE17F8B781470A4EFCF8451CFD185EB2CE901DAA7F045E43
4504WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR4504.49478\Velocitys15TweaksPack.7z\Velocity's 15 Tweaks Pack\8. Disable windows updates\Wub.initext
MD5:E774BF5669B46760AA61C6AA0A31CB67
SHA256:26F47C23D2494C61CFE17DF6AA1B894602728877581C95FF124B879E7A6CE628
4504WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR4504.49478\Velocitys15TweaksPack.7z\Velocity's 15 Tweaks Pack\12. Fortnite Config\GameUserSettings.initext
MD5:EED267F8DF27A6FBF62C1E5D6A1315FB
SHA256:ED224F8D41730752197BFF65B9E9E5214B9301D5373C3DF8D2950B7C6BD66B0B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
19
DNS requests
7
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
2.16.164.113:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1688
svchost.exe
GET
200
2.16.164.113:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1688
svchost.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1688
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.23.209.185:443
www.bing.com
Akamai International B.V.
GB
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1688
svchost.exe
2.16.164.113:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4712
MoUsoCoreWorker.exe
2.16.164.113:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
1688
svchost.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4712
MoUsoCoreWorker.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.124.78.146
whitelisted
www.bing.com
  • 2.23.209.185
  • 2.23.209.133
  • 2.23.209.149
  • 2.23.209.130
  • 2.23.209.189
  • 2.23.209.179
  • 2.23.209.140
  • 2.23.209.182
whitelisted
google.com
  • 142.250.185.142
whitelisted
crl.microsoft.com
  • 2.16.164.113
  • 2.16.164.112
whitelisted
www.microsoft.com
  • 88.221.169.152
whitelisted
self.events.data.microsoft.com
  • 104.208.16.90
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Velocitys15TweaksPack.7z