File name:

@NERESTPC.zip

Full analysis: https://app.any.run/tasks/772a6c39-1977-4bed-890d-0db82754d8e3
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: September 12, 2024, 12:20:57
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
stealer
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=store
MD5:

2E2DFA6C22AADDD1822EF9FEC4C830AB

SHA1:

A3C35E7EF9C2984175126F60CCFA299F6EB277B2

SHA256:

320C76775F78EE3196ADD715DC94C3707C182D7CDE6E7D41A1BA77081B8892A9

SSDEEP:

98304:44JyufehSiKT72RNQesSa4SSlkxayEk88xBsrZo90XJYaxUibxiL7wEfgIvJShnw:EPM1osky4jC20/doZDo4P4

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Steals credentials

      • WinRAR.exe (PID: 4704)

  • SUSPICIOUS

    • Write to the desktop.ini file (may be used to cloak folders)

      • WFS.exe (PID: 3328)

    • Executes as Windows Service

      • FXSSVC.exe (PID: 2728)

    • Detected use of alternative data streams (AltDS)

      • WFS.exe (PID: 3328)

    • Executes application which crashes

      • WFS.exe (PID: 3328)

  • INFO

    • Checks supported languages

      • NERESTPC FREE.exe (PID: 5516)
      • NERESTPC FREE.exe (PID: 2876)
      • NERESTPC FREE.exe (PID: 5760)
      • NERESTPC FREE.exe (PID: 6576)
      • NERESTPC FREE.exe (PID: 1776)
      • adb.exe (PID: 2636)
      • NERESTPC FREE.exe (PID: 2796)
      • NERESTPC FREE.exe (PID: 6988)
      • NERESTPC FREE.exe (PID: 1840)
      • NERESTPC FREE.exe (PID: 4084)
      • NERESTPC FREE.exe (PID: 3208)

    • The process uses the downloaded file

      • WinRAR.exe (PID: 4704)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 4704)

    • Manual execution by a user

      • NERESTPC FREE.exe (PID: 5516)
      • NERESTPC FREE.exe (PID: 2876)
      • NERESTPC FREE.exe (PID: 5760)
      • NERESTPC FREE.exe (PID: 6576)
      • adb.exe (PID: 2636)
      • NERESTPC FREE.exe (PID: 1776)
      • WFS.exe (PID: 3328)
      • WFS.exe (PID: 6556)
      • NERESTPC FREE.exe (PID: 2796)
      • NERESTPC FREE.exe (PID: 1840)
      • NERESTPC FREE.exe (PID: 3208)
      • NERESTPC FREE.exe (PID: 4084)
      • NERESTPC FREE.exe (PID: 6988)

    • Reads the computer name

      • NERESTPC FREE.exe (PID: 5516)
      • NERESTPC FREE.exe (PID: 2876)
      • NERESTPC FREE.exe (PID: 5760)
      • NERESTPC FREE.exe (PID: 6576)
      • NERESTPC FREE.exe (PID: 1776)
      • NERESTPC FREE.exe (PID: 2796)
      • NERESTPC FREE.exe (PID: 6988)
      • NERESTPC FREE.exe (PID: 1840)
      • NERESTPC FREE.exe (PID: 4084)
      • NERESTPC FREE.exe (PID: 3208)

    • Create files in a temporary directory

      • WFS.exe (PID: 3328)

    • Creates files in the program directory

      • FXSSVC.exe (PID: 2728)

    • Disables trace logs

      • FXSSVC.exe (PID: 2728)

    • Checks transactions between databases Windows and Oracle

      • WFS.exe (PID: 6556)

    • Checks proxy server information

      • WerFault.exe (PID: 6832)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 6832)

    • Reads the software policy settings

      • WerFault.exe (PID: 6832)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2024:09:01 23:34:28
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: @NERESTPC/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
156
Monitored processes
29
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe rundll32.exe no specs nerestpc free.exe no specs conhost.exe no specs nerestpc free.exe no specs conhost.exe no specs nerestpc free.exe conhost.exe no specs nerestpc free.exe no specs conhost.exe no specs adb.exe no specs conhost.exe no specs nerestpc free.exe no specs conhost.exe no specs nerestpc free.exe conhost.exe no specs wfs.exe wfs.exe no specs fxssvc.exe no specs werfault.exe FaxCommon Class no specs nerestpc free.exe no specs conhost.exe no specs nerestpc free.exe no specs conhost.exe no specs nerestpc free.exe no specs conhost.exe no specs nerestpc free.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
532\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—NERESTPC FREE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1556\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—NERESTPC FREE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1568\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—NERESTPC FREE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1776"C:\Users\admin\Desktop\@NERESTPC\NERESTPC FREE.exe" C:\Users\admin\Desktop\@NERESTPC\NERESTPC FREE.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
adb_test
Exit code:
1
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\@nerestpc\nerestpc free.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
1840"C:\Users\admin\Desktop\@NERESTPC\NERESTPC FREE.exe" C:\Users\admin\Desktop\@NERESTPC\NERESTPC FREE.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
adb_test
Exit code:
1
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\@nerestpc\nerestpc free.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
2612\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—NERESTPC FREE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2636"C:\Users\admin\Desktop\@NERESTPC\bin\adb.exe" C:\Users\admin\Desktop\@NERESTPC\bin\adb.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\users\admin\desktop\@nerestpc\bin\adb.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
2648\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—NERESTPC FREE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2728C:\WINDOWS\system32\fxssvc.exeC:\Windows\System32\FXSSVC.exe—services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Fax Service
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\fxssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\shlwapi.dll
2796"C:\Users\admin\Desktop\@NERESTPC\NERESTPC FREE.exe" C:\Users\admin\Desktop\@NERESTPC\NERESTPC FREE.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
adb_test
Exit code:
1
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\@nerestpc\nerestpc free.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
Total events
6 737
Read events
6 706
Write events
30
Delete events
1

Modification events

(PID) Process:(4704) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(4704) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\@NERESTPC.zip
(PID) Process:(4704) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(4704) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(4704) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(4704) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(4704) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
(PID) Process:(4704) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:name
Value:
256
(PID) Process:(4704) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(4704) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:psize
Value:
80
Executable files
7
Suspicious files
8
Text files
3
Unknown types
1

Dropped files

PID
Process
Filename
Type
3328WFS.exeC:\Users\admin\Documents\Scanned Documents\Welcome Scan.jpg:3or4kl4x13tuuug3Byamue2s4b —
MD5:—
SHA256:—
6832WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_WFS.exe_c6fae68c73411bacb2eae650ece09b4cd5ff62_012a80bd_49711b7a-c21e-412a-a02d-0316b5d76064\Report.wer —
MD5:—
SHA256:—
4704WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4704.48616\@NERESTPC\bin\AdbWinUsbApi.dllexecutable
MD5:F67D9EC28D19316754D7ECB0E990197D
SHA256:13918FDAB0C3AC77D077453A6036247CFECA10910AEC845F188C41148C630BB2
4704WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4704.48616\@NERESTPC\bin\HD-Adb.dllo
MD5:B89E47C9347E2AAD29266DCAE09B8569
SHA256:5F5AF7D54AE7905FA04BCF5625C5E60215BBCA5479F4F0C3506583B43BCB55F7
4704WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4704.48616\@NERESTPC\bin\AdbWinApi.dllexecutable
MD5:73030F38C867F5A7BD6EE331203F3D7A
SHA256:9FFACEDC41B2752075571E1A474FF50C5DCBE1F64DB56DB24AAEC78AEA1126DF
4704WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4704.48616\@NERESTPC\NERESTPC FREE.exeexecutable
MD5:07DA1F55BE3E780FDF66E55B12D10362
SHA256:DF7C5759426EC618B7614ED6872171F350A3C2CC87F840084F770A8DE802951A
4704WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4704.48616\@NERESTPC\bin\adb.exeexecutable
MD5:F1F479BBA21298E758FC22D8D98F8E48
SHA256:705DDC21F33AC52105D1B075B019962AD0E44FB3D560BDE69CE8CB3A36BCA183
4704WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4704.48616\@NERESTPC\bin\Adb.dllbinary
MD5:79E4AFAD921B9BBD3F6786A62AE6C827
SHA256:62E1D6DB7EF9737094A6221AA951668D9FDD8B2E267772727187F0E6397BFB3F
6832WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\WFS.exe.3328.dmpbinary
MD5:E8C7BFCF22F3BC57425E9627C67E3FC9
SHA256:955552B5BF74959ADC7D25F1BB6B6C4ABDF76EDE6EC5B31F3BBFE3544B4648D2
6832WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER2AB3.tmp.dmpbinary
MD5:F86502C60F2854930492760A34220960
SHA256:4E89C86BEC0A1FE8ACFA0DE47A9B1B4080C8CB461CB6183BDC0FDA6FA4056B06
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
33
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2120
MoUsoCoreWorker.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
3716
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5284
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6832
WerFault.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5284
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
2660
RUXIMICS.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
—
—
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
2120
MoUsoCoreWorker.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
6056
svchost.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
3260
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3716
svchost.exe
20.190.159.75:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3716
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
www.microsoft.com
  • 88.221.169.152
  • 184.30.21.171
whitelisted
google.com
  • 172.217.18.14
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
login.live.com
  • 20.190.159.75
  • 20.190.159.23
  • 20.190.159.68
  • 20.190.159.64
  • 20.190.159.2
  • 20.190.159.0
  • 40.126.31.71
  • 20.190.159.73
  • 40.126.32.133
  • 40.126.32.68
  • 20.190.160.20
  • 20.190.160.22
  • 40.126.32.74
  • 20.190.160.14
  • 20.190.160.17
  • 40.126.32.134
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
slscr.update.microsoft.com
  • 20.114.59.183
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted
watson.events.data.microsoft.com
  • 20.189.173.20
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
@NERESTPC.zip