Malware analysis 123.rar Malicious activity | ANY.RUN

Add for printing

File name:	123.rar
Full analysis:	https://app.any.run/tasks/2d03e1cb-c4ba-4aa5-a574-2dac1be5f20b
Verdict:	Malicious activity
Analysis date:	December 08, 2025, 09:05:38
OS:	Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME:	application/x-rar
File info:	RAR archive data, v5
MD5:	44E41FC36BA65877634C4A162E685CB8
SHA1:	69A2065D3C125F10BE7924479C6D31A84CC57A10
SHA256:	2BA8DE5F38B239404341DA0A615B50B6C57830A3F7E89FED309C920878FD6508
SSDEEP:	12288:ziCw0Jz2Vfl6daa7k7Vux6dZX4yahGM9c1xoZyqfLQ4Ue:ziCw2zGl6daa7k7Vux6vXpahGM9c1xoB

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 60 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: none
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: on
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
Google Chrome (133.0.6943.127)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (133.0.3065.92)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (136.0)
Mozilla Maintenance Service (136.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- Changes the autorun value in the registry
  - 123.com (PID: 7764)
- Run PowerShell with an invisible window
  - powershell.exe (PID: 8084)
SUSPICIOUS
- Reads security settings of Internet Explorer
  - WinRAR.exe (PID: 7516)
  - 123.com (PID: 7764)
  - WinRAR.exe (PID: 6544)
- Executable content was dropped or overwritten
  - 123.com (PID: 7764)
  - driver.exe (PID: 2856)
- Uses ATTRIB.EXE to modify file attributes
  - 123.com (PID: 7764)
- Starts application with an unusual extension
  - WinRAR.exe (PID: 7516)
- Executing commands from a ".bat" file
  - 123.com (PID: 7764)
  - powershell.exe (PID: 8084)
- Starts process via Powershell
  - powershell.exe (PID: 8084)
- Starts CMD.EXE for commands execution
  - 123.com (PID: 7764)
  - powershell.exe (PID: 8084)
- Starts POWERSHELL.EXE for commands execution
  - cmd.exe (PID: 8000)
- Runs PING.EXE to delay simulation
  - cmd.exe (PID: 7312)
  - cmd.exe (PID: 5900)
- Drops 7-zip archiver for unpacking
  - driver.exe (PID: 2856)
  - WinRAR.exe (PID: 6544)
INFO
- The sample compiled with english language support
  - WinRAR.exe (PID: 7516)
  - driver.exe (PID: 2856)
  - WinRAR.exe (PID: 6544)
- Create files in a temporary directory
  - 123.com (PID: 7764)
- Creates a software uninstall entry
  - 123.com (PID: 7764)
- Executable content was dropped or overwritten
  - WinRAR.exe (PID: 7516)
  - WinRAR.exe (PID: 6544)
- Reads the computer name
  - 123.com (PID: 7764)
  - curl.exe (PID: 7668)
  - curl.exe (PID: 7816)
  - TextInputHost.exe (PID: 7072)
- Launching a file from a Registry key
  - 123.com (PID: 7764)
- Checks supported languages
  - 123.com (PID: 7764)
  - curl.exe (PID: 7668)
  - curl.exe (PID: 7816)
  - TextInputHost.exe (PID: 7072)
  - driver.exe (PID: 2856)
  - blat.exe (PID: 5876)
  - driver.exe (PID: 4968)
- Reads Microsoft Office registry keys
  - 123.com (PID: 7764)
- Process checks computer location settings
  - 123.com (PID: 7764)
- Reads security settings of Internet Explorer
  - notepad.exe (PID: 8152)
- Execution of CURL command
  - cmd.exe (PID: 7312)
  - cmd.exe (PID: 5900)
- Manual execution by a user
  - notepad.exe (PID: 8152)
  - cmd.exe (PID: 5900)
  - WinRAR.exe (PID: 6544)
- The sample compiled with russian language support
  - driver.exe (PID: 2856)
  - WinRAR.exe (PID: 6544)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.rar	\|	RAR compressed archive (v5.0) (61.5)
.rar	\|	RAR compressed archive (gen) (38.4)

EXIF

ZIP

FileVersion:	RAR v5
CompressedSize:	304899
UncompressedSize:	484491
OperatingSystem:	Win32
ArchivedFileName:	123/123.com

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

173

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

224

\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Console Window Host

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

412

\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

—

blat.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Console Window Host

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

2856

C:\driver\data\driver.exe x -r -ep2 -p"limpid29033" C:\driver\data\jgbfsofrtysdfd.rar C:\driver\data /y

C:\driver\data\driver.exe

cmd.exe

User:

admin

Integrity Level:

HIGH

Exit code:

Modules

Images
c:\driver\data\driver.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll

3168

ping -n 63 127.0.0.1

C:\Windows\SysWOW64\PING.EXE

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

TCP/IP Ping Command

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\syswow64\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\ws2_32.dll

4540

\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Console Window Host

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

4828

"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe" "1B202147-7800-4964-B97E-2A85461E80D5" "B87F709F-2B88-4B7E-B703-3877A60C9F22" "7984"

C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe

—

WINWORD.EXE

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Artificial Intelligence (AI) Host for the Microsoft® Windows® Operating System and Platform x64.

Version:

0.12.2.0

Modules

Images
c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\ai.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\program files\common files\microsoft shared\clicktorun\c2r64.dll
c:\windows\system32\sechost.dll

4968

C:\driver\data\driver.exe x -r -ep2 -p"limpid29033" C:\driver\data\jgbfsofrtysdfd.rar C:\driver\data /y

C:\driver\data\driver.exe

—

cmd.exe

User:

admin

Integrity Level:

MEDIUM

Exit code:

Modules

Images
c:\driver\data\driver.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll

5876

"C:\Users\admin\AppData\Local\Temp\Rar$EXb6544.42674\blat.exe"

C:\Users\admin\AppData\Local\Temp\Rar$EXb6544.42674\blat.exe

—

WinRAR.exe

User:

admin

Company:

http://www.blat.net/

Integrity Level:

MEDIUM

Description:

A Win32 command line eMail tool

Exit code:

Version:

3.2.24

Modules

Images
c:\users\admin\appdata\local\temp\rar$exb6544.42674\blat.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll

5900

C:\WINDOWS\system32\cmd.exe /c ""C:\driver\data\nice_to_meet.bat" "

C:\Windows\System32\cmd.exe

—

explorer.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows Command Processor

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll

6240

ping -n 17 127.0.0.1

C:\Windows\System32\PING.EXE

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

TCP/IP Ping Command

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\nsi.dll

Add for printing

Total events

25 791

Read events

25 093

Write events

677

Delete events

Modification events


(PID) Process:	(7516) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:	write	Name:	3
Value: C:\Users\admin\Desktop\preferences.zip
(PID) Process:	(7516) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:	write	Name:	2
Value: C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:	(7516) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:	write	Name:	1
Value: C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:	(7516) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:	write	Name:	0
Value: C:\Users\admin\AppData\Local\Temp\123.rar
(PID) Process:	(7516) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	name
Value: 120
(PID) Process:	(7516) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	size
Value: 80
(PID) Process:	(7516) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	type
Value: 120
(PID) Process:	(7516) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	mtime
Value: 100
(PID) Process:	(7764) 123.com	Key:	HKEY_CURRENT_USER\SOFTWARE\4t Niagara Software\4t Tray Minimizer
Operation:	write	Name:	FirstRun
Value: 0
(PID) Process:	(7764) 123.com	Key:	HKEY_CURRENT_USER\SOFTWARE\4t Niagara Software\4t Tray Minimizer
Operation:	write	Name:	JustInstalled
Value: 0

Add for printing

Executable files

Suspicious files

170

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
7764	123.com	C:\Users\admin\AppData\Local\Temp\$inst\temp_0.tmp		compressed
		MD5:43731B5E126B88766A64EA525A145184	SHA256:F3EE94448B434499615D02E128A6BA2698ABFD64AD36728AB95F2AFEB783359B
7764	123.com	C:\intel\Uninstall.ini		text
		MD5:A5E2DF6DF628B08F8FB0448B14115F47	SHA256:68F0FF3E47608DB12AE1D923C8891DA059738857F8C64A5E9701EF130551D551
7764	123.com	C:\intel\Uninstall.exe		executable
		MD5:499CCC8D6D7C08E135A91928CCC2FD7A	SHA256:1FA5D83A5766556CF2FF16AD279E73CB40584746BD388E0A4E818A2CC06613D3
7984	WINWORD.EXE	C:\Users\admin\AppData\Local\Temp\mso8C58.tmp		image
		MD5:ED3C1C40B68BA4F40DB15529D5443DEC	SHA256:039FE79B74E6D3D561E32D4AF570E6CA70DB6BB3718395BE2BF278B9E601279A
7984	WINWORD.EXE	C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm		binary
		MD5:4B18C6573DE92F407588BB63405F4375	SHA256:1F12E1FE979744622AA40205F8D54F49E11507D72C8C0EE1C87414D7CCD5B279
7516	WinRAR.exe	C:\Users\admin\AppData\Local\Temp\Rar$DIa7516.38579\123.com		executable
		MD5:B2768DBC89063869D139C1EBE759D860	SHA256:F1B03EDD175A78022FB9E41887EA0679CE77190D8EEBD0A5ABED1477193023EA
7764	123.com	C:\Users\admin\AppData\Local\Temp\$inst\2.tmp		compressed
		MD5:8708699D2C73BED30A0A08D80F96D6D7	SHA256:A32E0A83001D2C5D41649063217923DAC167809CAB50EC5784078E41C9EC0F0F
7764	123.com	C:\driver\data\driver.exe		executable
		MD5:29086D9247FDF40452563C11B3DCA394	SHA256:BB243113D236F823ABD1839025190E763FE34C40DA4949B77558995CC1A07625
7764	123.com	C:\driver\data\nice_to_meet.bat		text
		MD5:CC730526A19174C6E37BBC646E09BDD2	SHA256:09255AA6B5A7B25BC6E9762FCCB08A4664A0DD3A506BCFB318AB967EDBEF7F09
7764	123.com	C:\driver\data\ÀÎ_ÊÏ_ÂÍÈÈÀ_3.docx		binary
		MD5:57DC90CD4E7A100D36D0D8EFE9AAD74C	SHA256:5E91D426518CE7D2EB4958CA7D7B2A85657DC2C79440A6EBC3A61A276DD0EBC8

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
6976	svchost.exe	GET	200	162.159.142.9:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	US	binary	471 b	whitelisted
872	svchost.exe	GET	200	2.17.251.99:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	NL	binary	825 b	whitelisted
872	svchost.exe	GET	200	184.24.152.100:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	US	binary	814 b	whitelisted
7984	WINWORD.EXE	GET	200	162.159.142.9:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D	US	binary	471 b	whitelisted
7984	WINWORD.EXE	GET	200	162.159.142.9:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D	US	binary	471 b	whitelisted
7984	WINWORD.EXE	GET	200	2.17.251.99:80	http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl	NL	binary	767 b	whitelisted
7984	WINWORD.EXE	GET	200	2.17.251.99:80	http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl	NL	binary	519 b	whitelisted
7984	WINWORD.EXE	GET	200	2.17.251.99:80	http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl	NL	binary	564 b	whitelisted
7784	SIHClient.exe	GET	200	184.24.152.100:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl	US	binary	419 b	whitelisted
7984	WINWORD.EXE	GET	200	2.17.251.99:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	NL	binary	825 b	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:137	—	Not routed	—	whitelisted
872	svchost.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted
6768	MoUsoCoreWorker.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted
2016	RUXIMICS.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted
—	—	92.123.104.38:443	www.bing.com	AKAMAI-ASN1	NL	whitelisted
4	System	192.168.100.255:138	—	Not routed	—	whitelisted
6976	svchost.exe	20.190.147.0:443	login.live.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted
6976	svchost.exe	162.159.142.9:80	ocsp.digicert.com	CLOUDFLARENET	US	whitelisted
872	svchost.exe	2.17.251.99:80	crl.microsoft.com	AKAMAI-ASN1	NL	whitelisted
872	svchost.exe	184.24.152.100:80	www.microsoft.com	AKAMAI-AS	US	whitelisted

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	4.231.128.59	whitelisted
www.bing.com	92.123.104.38 92.123.104.46 92.123.104.36 92.123.104.47 92.123.104.37 92.123.104.44 92.123.104.43 92.123.104.41 92.123.104.45	whitelisted
google.com	216.58.207.238	whitelisted
login.live.com	20.190.147.0	whitelisted
ocsp.digicert.com	162.159.142.9	whitelisted
crl.microsoft.com	2.17.251.99	whitelisted
www.microsoft.com	184.24.152.100	whitelisted
officeclient.microsoft.com	52.109.89.18	whitelisted
roaming.svc.cloud.microsoft	52.109.89.19	whitelisted
omex.cdn.office.net	2.16.56.86	whitelisted

Threats

PID	Process	Class	Message
—	—	Unknown Traffic	ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)

Add for printing

Process	Message
WINWORD.EXE	WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
WINWORD.EXE	WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
WINWORD.EXE	WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.

General Info

123.rar

44E41FC36BA65877634C4A162E685CB8

69A2065D3C125F10BE7924479C6D31A84CC57A10

2BA8DE5F38B239404341DA0A615B50B6C57830A3F7E89FED309C920878FD6508

12288:ziCw0Jz2Vfl6daa7k7Vux6dZX4yahGM9c1xoZyqfLQ4Ue:ziCw2zGl6daa7k7Vux6vXpahGM9c1xoB

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Changes the autorun value in the registry

Run PowerShell with an invisible window

SUSPICIOUS

Reads security settings of Internet Explorer

Executable content was dropped or overwritten

Uses ATTRIB.EXE to modify file attributes

Starts application with an unusual extension

Executing commands from a ".bat" file

Starts process via Powershell

Starts CMD.EXE for commands execution

Starts POWERSHELL.EXE for commands execution

Runs PING.EXE to delay simulation

Drops 7-zip archiver for unpacking

INFO

The sample compiled with english language support

Create files in a temporary directory

Creates a software uninstall entry

Executable content was dropped or overwritten

Reads the computer name

Launching a file from a Registry key

Checks supported languages

Reads Microsoft Office registry keys

Process checks computer location settings

Reads security settings of Internet Explorer

Execution of CURL command

Manual execution by a user

The sample compiled with russian language support

Malware configuration

Static information

TRiD

EXIF

ZIP

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings