File name:

WindowsVM.zip

Full analysis: https://app.any.run/tasks/a5f07adc-7bec-46b6-ab1b-cfd9d945161a
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: March 24, 2025, 15:19:59
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
arch-doc
arch-html
python
stealer
pyinstaller
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

EEE10A809A27C3A22ED6E03DB2F00ACB

SHA1:

597F00C99C107479E219515FB5147A340E3D08E6

SHA256:

2B94C347580EC7CC881513AB535BD05A12CD7D441FEA850BD9542520E0B06751

SSDEEP:

98304:xJ5Uwa8fZP1uV/7Xx1vc6ISO/xBx2RZ8Y2ypf21Wrs4x2CRlYaA/TG07gnEoccZL:OBvlLZkHhxk572S/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • Brave.exe (PID: 2240)
      • Brave.exe (PID: 3268)

  • SUSPICIOUS

    • Process drops python dynamic module

      • fakenet.exe (PID: 5392)

    • Loads Python modules

      • fakenet.exe (PID: 5556)

    • Process uses IPCONFIG to clear DNS cache

      • cmd.exe (PID: 6112)

    • Drops a system driver (possible attempt to evade defenses)

      • fakenet.exe (PID: 5392)

    • Executable content was dropped or overwritten

      • fakenet.exe (PID: 5392)

    • Process drops legitimate windows executable

      • fakenet.exe (PID: 5392)

    • The process drops C-runtime libraries

      • fakenet.exe (PID: 5392)

    • Starts CMD.EXE for commands execution

      • fakenet.exe (PID: 5556)

    • Application launched itself

      • fakenet.exe (PID: 5392)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 896)
      • WinRAR.exe (PID: 5640)

    • Checks operating system version

      • fakenet.exe (PID: 5556)

    • Manual execution by a user

      • Brave.exe (PID: 2240)
      • fakenet.exe (PID: 5392)
      • fakenet.exe (PID: 4608)
      • WinRAR.exe (PID: 5640)
      • Brave.exe (PID: 3268)

    • PyInstaller has been detected (YARA)

      • fakenet.exe (PID: 5392)
      • fakenet.exe (PID: 5556)

    • Create files in a temporary directory

      • fakenet.exe (PID: 5392)

    • The sample compiled with english language support

      • fakenet.exe (PID: 5392)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2025:03:24 20:11:50
ZipCRC: 0x9d9604ee
ZipCompressedSize: 1234402
ZipUncompressedSize: 2646016
ZipFileName: Brave.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
150
Monitored processes
17
Malicious processes
1
Suspicious processes
3

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe winrar.exe rundll32.exe no specs fakenet.exe no specs fakenet.exe conhost.exe no specs fakenet.exe no specs cmd.exe no specs cmd.exe no specs ipconfig.exe no specs brave.exe conhost.exe no specs slui.exe brave.exe conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
896"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\WindowsVM.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1164\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—Brave.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2240"C:\Users\admin\Desktop\Brave.exe" C:\Users\admin\Desktop\Brave.exe
explorer.exe
User:
admin
Company:
Brave
Integrity Level:
MEDIUM
Description:
Brave
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\brave.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2320C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
3268"C:\Users\admin\Desktop\Brave.exe" C:\Users\admin\Desktop\Brave.exe
explorer.exe
User:
admin
Company:
Brave
Integrity Level:
MEDIUM
Description:
Brave
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\brave.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ole32.dll
3676ipconfig /flushdnsC:\Windows\SysWOW64\ipconfig.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
IP Configuration Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\ipconfig.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4608"C:\Users\admin\Desktop\fakenet3.3\fakenet3.3\fakenet.exe" C:\Users\admin\Desktop\fakenet3.3\fakenet3.3\fakenet.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\fakenet3.3\fakenet3.3\fakenet.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
4868\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—fakenet.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5392"C:\Users\admin\Desktop\fakenet3.3\fakenet3.3\fakenet.exe" C:\Users\admin\Desktop\fakenet3.3\fakenet3.3\fakenet.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
3221225786
Modules
Images
c:\users\admin\desktop\fakenet3.3\fakenet3.3\fakenet.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
5400C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
Total events
7 219
Read events
7 190
Write events
16
Delete events
13

Modification events

(PID) Process:(896) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(896) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(896) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(896) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\WindowsVM.zip
(PID) Process:(896) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(896) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(896) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(896) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(896) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:15
Value:
(PID) Process:(896) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:14
Value:
Executable files
35
Suspicious files
3
Text files
32
Unknown types
0

Dropped files

PID
Process
Filename
Type
5640WinRAR.exeC:\Users\admin\Desktop\fakenet3.3\fakenet3.3\configs\default.initext
MD5:37CF30D263937C9E16FEC9D6AE84F9D0
SHA256:7B4AD0E292A74A559E72FD776496BBCBCC94FC347A12D928DAAA8667A3964962
5640WinRAR.exeC:\Users\admin\Desktop\fakenet3.3\fakenet3.3\CHANGELOG.txttext
MD5:DC00725E4EADE1B166473C434748CA4F
SHA256:A3BC6FE3C83602C251A58496336CD5EE4711D7B0E62A7730A2BC7C91E9DB8749
5640WinRAR.exeC:\Users\admin\Desktop\fakenet3.3\fakenet3.3\configs\sample_custom_response.initext
MD5:7CE0E79F0DA1BCC3F186E4656C885B72
SHA256:B41EA1A0599A3470BE16CE431C712632C7920E2345E74E150A7D6A153C76494B
5640WinRAR.exeC:\Users\admin\Desktop\fakenet3.3\fakenet3.3\defaultFiles\FakeNet.htmlhtml
MD5:C3DB1EC52176574CD44762A7407F3905
SHA256:FE4B63AD9F486B7664C240397CCDEE91FABF15DF5CCD39B80B0EEAA6A47B86E4
5640WinRAR.exeC:\Users\admin\Desktop\fakenet3.3\fakenet3.3\configs\CustomProviderExample.pytext
MD5:E2CCAD4974E80328EA32071D59A8A6F0
SHA256:9EBAC6DBA12C9C20487C701621684543C35A440758542F8E4AC67D5033D74C65
5640WinRAR.exeC:\Users\admin\Desktop\fakenet3.3\fakenet3.3\defaultFiles\FakeNet.pdfpdf
MD5:BC066D69B77764A7F84EEFA9E102FBCA
SHA256:096FAB8B9D5C463EE13DDC4F2EC69D74ACFF14B2800B0FCF442E5AA811E49E2C
896WinRAR.exeC:\Users\admin\Desktop\fakenet3.3.zipcompressed
MD5:85DE6B0DD12DCEA4946C9854401F7788
SHA256:CD3F263A01926366643118C541A6AD24A171B4369363A60DEB9A570A1D600865
5640WinRAR.exeC:\Users\admin\Desktop\fakenet3.3\fakenet3.3\configs\html_report_template.htmlhtml
MD5:A3FEDA7141A65A6B5F34BF4D7774B273
SHA256:8E0FC9E7294706B0DB9A71208AB3A7B33708A4AF4E2BEE446F3B7C2E37E2906F
5640WinRAR.exeC:\Users\admin\Desktop\fakenet3.3\fakenet3.3\defaultFiles\FakeNet.jpgimage
MD5:58163342C72056066A9199ADD8AE83AC
SHA256:4D553FD4E2D9868F3A2ED461400EBBD0DE512CC513B2CB2A1ED7FA65DF53C0E7
5640WinRAR.exeC:\Users\admin\Desktop\fakenet3.3\fakenet3.3\configs\sample_raw_response.txttext
MD5:CA93984F187FD48EB964CDA740E201B1
SHA256:6F0BB805D23DBB6BD0248CED56DE0ABDD85926075CD900A01F55D5E06056F868
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
24
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3900
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
unknown
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
2104
svchost.exe
GET
200
2.16.168.124:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
6488
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
unknown
6488
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
unknown
5496
MoUsoCoreWorker.exe
GET
200
2.16.168.124:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:137
—
—
—
unknown
5496
MoUsoCoreWorker.exe
2.16.168.124:80
crl.microsoft.com
Akamai International B.V.
RU
unknown
4
System
192.168.100.255:138
—
—
—
unknown
2104
svchost.exe
2.16.168.124:80
crl.microsoft.com
Akamai International B.V.
RU
unknown
3216
svchost.exe
20.198.162.78:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
SG
unknown
6544
svchost.exe
40.126.31.1:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
unknown
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
3900
backgroundTaskHost.exe
20.223.36.55:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.78
unknown
settings-win.data.microsoft.com
  • 40.127.240.158
unknown
crl.microsoft.com
  • 2.16.168.124
  • 2.16.168.114
unknown
client.wns.windows.com
  • 20.198.162.78
unknown
login.live.com
  • 40.126.31.1
  • 20.190.159.73
  • 20.190.159.128
  • 20.190.159.129
  • 20.190.159.0
  • 40.126.31.71
  • 40.126.31.128
  • 20.190.159.71
unknown
ocsp.digicert.com
  • 184.30.131.245
unknown
arc.msn.com
  • 20.223.36.55
unknown
slscr.update.microsoft.com
  • 172.202.163.200
unknown
www.microsoft.com
  • 184.30.21.171
unknown
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
WindowsVM.zip