File name:

RDPWrap-v1.6.2.zip

Full analysis: https://app.any.run/tasks/5dd08b4d-c450-4e05-b073-dc2a36d34d51
Verdict: Malicious activity
Analysis date: April 18, 2024, 16:37:35
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

C26A2C5F6154225E8D83C4000306F162

SHA1:

67C586CEDBF0852AA52268311841CBAC5C96FDF8

SHA256:

35A9481DDBED5177431A9EA4BD09468FE987797D7B1231D64942D17EB54EC269

SSDEEP:

49152:cPEbpqUPr0OMPjmNgyV24OXxr2/NV0CA7QUmu4LnB:cPEbpPPrC4gWFOBr4Wfg

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3768)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • WinRAR.exe (PID: 3768)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 3768)

    • Executing commands from a ".bat" file

      • WinRAR.exe (PID: 3768)

    • Reads the history of recent RDP connections

      • RDPCheck.exe (PID: 3244)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3768)

    • Reads the computer name

      • RDPCheck.exe (PID: 3244)
      • RDPConf.exe (PID: 2028)

    • Checks supported languages

      • RDPWInst.exe (PID: 2724)
      • RDPCheck.exe (PID: 3244)
      • RDPConf.exe (PID: 2028)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xpi | Mozilla Firefox browser extension (66.6)
.zip | ZIP compressed archive (33.3)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2016:07:23 19:19:08
ZipCRC: 0xfd9956a7
ZipCompressedSize: 250
ZipUncompressedSize: 458
ZipFileName: install.bat
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
50
Monitored processes
8
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe cmd.exe no specs rdpcheck.exe no specs rdpcheck.exe rdpconf.exe no specs rdpconf.exe rdpwinst.exe no specs rdpwinst.exe

Process information

PID
CMD
Path
Indicators
Parent process
2028"C:\Users\admin\AppData\Local\Temp\Rar$EXa3768.8580\RDPConf.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3768.8580\RDPConf.exe
WinRAR.exe
User:
admin
Company:
Stas'M Corp.
Integrity Level:
HIGH
Description:
RDP Configuration Program
Exit code:
0
Version:
1.4.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3768.8580\rdpconf.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2652C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\Rar$DIa3768.7895\install.bat" "C:\Windows\System32\cmd.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2724"C:\Users\admin\AppData\Local\Temp\Rar$EXa3768.9167\RDPWInst.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3768.9167\RDPWInst.exe
WinRAR.exe
User:
admin
Company:
Stas'M Corp.
Integrity Level:
HIGH
Description:
RDP Wrapper Library Installer
Exit code:
0
Version:
2.5.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3768.9167\rdpwinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2896"C:\Users\admin\AppData\Local\Temp\Rar$EXa3768.9167\RDPWInst.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3768.9167\RDPWInst.exe—WinRAR.exe
User:
admin
Company:
Stas'M Corp.
Integrity Level:
MEDIUM
Description:
RDP Wrapper Library Installer
Exit code:
3221226540
Version:
2.5.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3768.9167\rdpwinst.exe
c:\windows\system32\ntdll.dll
3244"C:\Users\admin\AppData\Local\Temp\Rar$EXa3768.8319\RDPCheck.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3768.8319\RDPCheck.exe
WinRAR.exe
User:
admin
Company:
Stas'M Corp.
Integrity Level:
HIGH
Description:
Local RDP Checker
Version:
2.2.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3768.8319\rdpcheck.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3492"C:\Users\admin\AppData\Local\Temp\Rar$EXa3768.8580\RDPConf.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3768.8580\RDPConf.exe—WinRAR.exe
User:
admin
Company:
Stas'M Corp.
Integrity Level:
MEDIUM
Description:
RDP Configuration Program
Exit code:
3221226540
Version:
1.4.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3768.8580\rdpconf.exe
c:\windows\system32\ntdll.dll
3584"C:\Users\admin\AppData\Local\Temp\Rar$EXa3768.8319\RDPCheck.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3768.8319\RDPCheck.exe—WinRAR.exe
User:
admin
Company:
Stas'M Corp.
Integrity Level:
MEDIUM
Description:
Local RDP Checker
Exit code:
3221226540
Version:
2.2.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3768.8319\rdpcheck.exe
c:\windows\system32\ntdll.dll
3768"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\RDPWrap-v1.6.2.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
Total events
5 365
Read events
5 342
Write events
23
Delete events
0

Modification events

(PID) Process:(3768) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3768) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3768) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3768) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3768) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3768) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(3768) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\RDPWrap-v1.6.2.zip
(PID) Process:(3768) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3768) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3768) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
9
Suspicious files
0
Text files
10
Unknown types
0

Dropped files

PID
Process
Filename
Type
3768WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3768.8319\update.battext
MD5:29CA1C35075247B035AF75C11CAB78F1
SHA256:353F2DC17A4E80564CAA175F7170DBEDC1B40F704444520AE671F78A5D1F2B6D
3768WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3768.8319\RDPCheck.exeexecutable
MD5:8F82226B2F24D470C02F6664F67F23F7
SHA256:5603338A1F8DBB46EFB8E0869DB3491D5DB92F362711D6680F91ECC5D18BFADF
3768WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3768.8319\install.battext
MD5:CBAD5B2CA73917006791882274F769E8
SHA256:022364EE1FCE61C8A867216C79F223BF47692CD648E3FD6B244FC615B86E4C58
3768WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3768.8319\RDPWInst.exeexecutable
MD5:3288C284561055044C489567FD630AC2
SHA256:AC92D4C6397EB4451095949AC485EF4EC38501D7BB6F475419529AE67E297753
3768WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3768.8580\update.battext
MD5:29CA1C35075247B035AF75C11CAB78F1
SHA256:353F2DC17A4E80564CAA175F7170DBEDC1B40F704444520AE671F78A5D1F2B6D
3768WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3768.8580\uninstall.battext
MD5:ECCB8A01D0427EF29C2380D7DDA399F3
SHA256:083CD340C800CC021D4A59388680CE0E7AB0F8B998E67DEF6A507070E7FA01B7
3768WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3768.8580\RDPConf.exeexecutable
MD5:03FB8E478F4BA100D37A136231FA2F78
SHA256:3C0E5D6863B03283AFDA9BD188501757D47DC57FC4BBA2BDBB0D9BAA34487FE0
3768WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3768.8580\install.battext
MD5:CBAD5B2CA73917006791882274F769E8
SHA256:022364EE1FCE61C8A867216C79F223BF47692CD648E3FD6B244FC615B86E4C58
3768WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3768.8580\RDPWInst.exeexecutable
MD5:3288C284561055044C489567FD630AC2
SHA256:AC92D4C6397EB4451095949AC485EF4EC38501D7BB6F475419529AE67E297753
3768WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3768.9167\install.battext
MD5:CBAD5B2CA73917006791882274F769E8
SHA256:022364EE1FCE61C8A867216C79F223BF47692CD648E3FD6B244FC615B86E4C58
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
RDPWrap-v1.6.2.zip