File name:

@NERESTPC.zip

Full analysis: https://app.any.run/tasks/772a6c39-1977-4bed-890d-0db82754d8e3
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: September 12, 2024, 12:20:57
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
stealer
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=store
MD5:

2E2DFA6C22AADDD1822EF9FEC4C830AB

SHA1:

A3C35E7EF9C2984175126F60CCFA299F6EB277B2

SHA256:

320C76775F78EE3196ADD715DC94C3707C182D7CDE6E7D41A1BA77081B8892A9

SSDEEP:

98304:44JyufehSiKT72RNQesSa4SSlkxayEk88xBsrZo90XJYaxUibxiL7wEfgIvJShnw:EPM1osky4jC20/doZDo4P4

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Steals credentials

      • WinRAR.exe (PID: 4704)

  • SUSPICIOUS

    • Detected use of alternative data streams (AltDS)

      • WFS.exe (PID: 3328)

    • Write to the desktop.ini file (may be used to cloak folders)

      • WFS.exe (PID: 3328)

    • Executes as Windows Service

      • FXSSVC.exe (PID: 2728)

    • Executes application which crashes

      • WFS.exe (PID: 3328)

  • INFO

    • Checks supported languages

      • NERESTPC FREE.exe (PID: 2876)
      • NERESTPC FREE.exe (PID: 5516)
      • NERESTPC FREE.exe (PID: 2796)
      • adb.exe (PID: 2636)
      • NERESTPC FREE.exe (PID: 5760)
      • NERESTPC FREE.exe (PID: 6576)
      • NERESTPC FREE.exe (PID: 1776)
      • NERESTPC FREE.exe (PID: 6988)
      • NERESTPC FREE.exe (PID: 1840)
      • NERESTPC FREE.exe (PID: 4084)
      • NERESTPC FREE.exe (PID: 3208)

    • Reads the computer name

      • NERESTPC FREE.exe (PID: 5516)
      • NERESTPC FREE.exe (PID: 5760)
      • NERESTPC FREE.exe (PID: 2876)
      • NERESTPC FREE.exe (PID: 6576)
      • NERESTPC FREE.exe (PID: 2796)
      • NERESTPC FREE.exe (PID: 6988)
      • NERESTPC FREE.exe (PID: 1840)
      • NERESTPC FREE.exe (PID: 3208)
      • NERESTPC FREE.exe (PID: 4084)
      • NERESTPC FREE.exe (PID: 1776)

    • The process uses the downloaded file

      • WinRAR.exe (PID: 4704)

    • Manual execution by a user

      • NERESTPC FREE.exe (PID: 2876)
      • NERESTPC FREE.exe (PID: 5516)
      • NERESTPC FREE.exe (PID: 5760)
      • NERESTPC FREE.exe (PID: 6576)
      • NERESTPC FREE.exe (PID: 2796)
      • adb.exe (PID: 2636)
      • NERESTPC FREE.exe (PID: 1776)
      • WFS.exe (PID: 6556)
      • WFS.exe (PID: 3328)
      • NERESTPC FREE.exe (PID: 1840)
      • NERESTPC FREE.exe (PID: 4084)
      • NERESTPC FREE.exe (PID: 6988)
      • NERESTPC FREE.exe (PID: 3208)

    • Checks transactions between databases Windows and Oracle

      • WFS.exe (PID: 6556)

    • Disables trace logs

      • FXSSVC.exe (PID: 2728)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 4704)

    • Creates files in the program directory

      • FXSSVC.exe (PID: 2728)

    • Reads the software policy settings

      • WerFault.exe (PID: 6832)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 6832)

    • Create files in a temporary directory

      • WFS.exe (PID: 3328)

    • Checks proxy server information

      • WerFault.exe (PID: 6832)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2024:09:01 23:34:28
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: @NERESTPC/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
156
Monitored processes
29
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe rundll32.exe no specs nerestpc free.exe no specs conhost.exe no specs nerestpc free.exe no specs conhost.exe no specs nerestpc free.exe conhost.exe no specs nerestpc free.exe no specs conhost.exe no specs adb.exe no specs conhost.exe no specs nerestpc free.exe no specs conhost.exe no specs nerestpc free.exe conhost.exe no specs wfs.exe wfs.exe no specs fxssvc.exe no specs werfault.exe FaxCommon Class no specs nerestpc free.exe no specs conhost.exe no specs nerestpc free.exe no specs conhost.exe no specs nerestpc free.exe no specs conhost.exe no specs nerestpc free.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
532\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—NERESTPC FREE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1556\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—NERESTPC FREE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1568\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—NERESTPC FREE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1776"C:\Users\admin\Desktop\@NERESTPC\NERESTPC FREE.exe" C:\Users\admin\Desktop\@NERESTPC\NERESTPC FREE.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
adb_test
Exit code:
1
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\@nerestpc\nerestpc free.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
1840"C:\Users\admin\Desktop\@NERESTPC\NERESTPC FREE.exe" C:\Users\admin\Desktop\@NERESTPC\NERESTPC FREE.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
adb_test
Exit code:
1
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\@nerestpc\nerestpc free.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
2612\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—NERESTPC FREE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2636"C:\Users\admin\Desktop\@NERESTPC\bin\adb.exe" C:\Users\admin\Desktop\@NERESTPC\bin\adb.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\users\admin\desktop\@nerestpc\bin\adb.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
2648\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—NERESTPC FREE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2728C:\WINDOWS\system32\fxssvc.exeC:\Windows\System32\FXSSVC.exe—services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Fax Service
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\fxssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\shlwapi.dll
2796"C:\Users\admin\Desktop\@NERESTPC\NERESTPC FREE.exe" C:\Users\admin\Desktop\@NERESTPC\NERESTPC FREE.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
adb_test
Exit code:
1
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\@nerestpc\nerestpc free.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
Total events
6 737
Read events
6 706
Write events
30
Delete events
1

Modification events

(PID) Process:(4704) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(4704) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\@NERESTPC.zip
(PID) Process:(4704) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(4704) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(4704) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(4704) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(4704) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
(PID) Process:(4704) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:name
Value:
256
(PID) Process:(4704) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(4704) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:psize
Value:
80
Executable files
7
Suspicious files
8
Text files
3
Unknown types
1

Dropped files

PID
Process
Filename
Type
3328WFS.exeC:\Users\admin\Documents\Scanned Documents\Welcome Scan.jpg:3or4kl4x13tuuug3Byamue2s4b —
MD5:—
SHA256:—
6832WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_WFS.exe_c6fae68c73411bacb2eae650ece09b4cd5ff62_012a80bd_49711b7a-c21e-412a-a02d-0316b5d76064\Report.wer —
MD5:—
SHA256:—
4704WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4704.48616\@NERESTPC\bin\Adb.dllbinary
MD5:79E4AFAD921B9BBD3F6786A62AE6C827
SHA256:62E1D6DB7EF9737094A6221AA951668D9FDD8B2E267772727187F0E6397BFB3F
4704WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4704.48616\@NERESTPC\bin\AdbWinUsbApi.dllexecutable
MD5:F67D9EC28D19316754D7ECB0E990197D
SHA256:13918FDAB0C3AC77D077453A6036247CFECA10910AEC845F188C41148C630BB2
3328WFS.exeC:\Users\admin\Documents\Fax\Inbox\desktop.initext
MD5:78123470C02CA0DB68A5E9F355503B1A
SHA256:E07BD44303DEF6DA0204F92CDDCDAA6A44A393CF8E713C617FC66640486DA4B8
3328WFS.exeC:\Users\admin\Documents\Scanned Documents\desktop.initext
MD5:88CC9559EF771AE2D5F1879721226E8A
SHA256:FC1162993DE676F59BEFF2FB6A315081755C7500CD3CA729E691AEA0EB41B516
4704WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4704.48616\@NERESTPC\bin\HD-Adb.dllo
MD5:B89E47C9347E2AAD29266DCAE09B8569
SHA256:5F5AF7D54AE7905FA04BCF5625C5E60215BBCA5479F4F0C3506583B43BCB55F7
3328WFS.exeC:\Users\admin\Documents\Scanned Documents\Welcome Scan.jpgimage
MD5:73D4281E46A68222934403627E5B4E19
SHA256:AAC4AC970EC47CD95DC7C65D7D38D29C1F948BE24D5DAD1D5AA21053125367C7
6832WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER2AB3.tmp.dmpbinary
MD5:F86502C60F2854930492760A34220960
SHA256:4E89C86BEC0A1FE8ACFA0DE47A9B1B4080C8CB461CB6183BDC0FDA6FA4056B06
6832WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\21253908F3CB05D51B1C2DA8B681A785binary
MD5:1B7FD5177461034E4086724C5845E927
SHA256:065AF18C229898A1C2A8D989911ADCD9B1E2AB14B1953EBF8EAF34AE37EA1627
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
33
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2120
MoUsoCoreWorker.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5284
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
3716
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6832
WerFault.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5284
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
2660
RUXIMICS.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
—
—
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
2120
MoUsoCoreWorker.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
6056
svchost.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
3260
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3716
svchost.exe
20.190.159.75:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3716
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
www.microsoft.com
  • 88.221.169.152
  • 184.30.21.171
whitelisted
google.com
  • 172.217.18.14
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
login.live.com
  • 20.190.159.75
  • 20.190.159.23
  • 20.190.159.68
  • 20.190.159.64
  • 20.190.159.2
  • 20.190.159.0
  • 40.126.31.71
  • 20.190.159.73
  • 40.126.32.133
  • 40.126.32.68
  • 20.190.160.20
  • 20.190.160.22
  • 40.126.32.74
  • 20.190.160.14
  • 20.190.160.17
  • 40.126.32.134
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
slscr.update.microsoft.com
  • 20.114.59.183
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted
watson.events.data.microsoft.com
  • 20.189.173.20
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
@NERESTPC.zip