File name:

shroom-boom.zip

Full analysis: https://app.any.run/tasks/88692e6c-5253-409f-b264-574fc372c824
Verdict: Malicious activity
Analysis date: May 15, 2025, 10:58:51
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
Indicators:
MIME: application/zip
File info: Zip archive data, at least v5.1 to extract, compression method=AES Encrypted
MD5:

FF581A73473581966C98F8E4B27FDB21

SHA1:

39A5ACBA698F9F1E6ED81CAB8B36F5D251101691

SHA256:

3B00A039128A9FC41A2269EA943283E7254735AA98A4E218D2EBA42C25F2696D

SSDEEP:

49152:/cgvkotLDGZwX8b+WFeRyD1WTik3/2FmotgurHC9J/d7alfjCd3RTZYClM5x1VJg:EgvZe6WFeU4Td24oCeHehjRRjjr8fDNK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 7316)

    • Accesses environment variables (SCRIPT)

      • wscript.exe (PID: 7940)
      • wscript.exe (PID: 5156)

    • Gets %appdata% folder path (SCRIPT)

      • wscript.exe (PID: 7940)
      • wscript.exe (PID: 5156)

    • Copies file to a new location (SCRIPT)

      • wscript.exe (PID: 7960)
      • wscript.exe (PID: 8136)
      • wscript.exe (PID: 5156)

    • Reads the value of a key from the registry (SCRIPT)

      • wscript.exe (PID: 8136)

    • Modifies registry startup key (SCRIPT)

      • wscript.exe (PID: 8136)
      • wscript.exe (PID: 7960)

    • Creates a new registry key or changes the value of an existing one (SCRIPT)

      • wscript.exe (PID: 8136)
      • wscript.exe (PID: 7960)

    • Starts NET.EXE for service management

      • cmd.exe (PID: 1228)
      • net.exe (PID: 7828)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 8056)

    • Changes the autorun value in the registry

      • reg.exe (PID: 5304)

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 7940)

  • SUSPICIOUS

    • The process executes JS scripts

      • 31529c7f5c2f38a57227b307bb77e2dc86d283bd8110cf0b8a38285f75b7f872.exe (PID: 7876)
      • cmd.exe (PID: 8056)
      • wscript.exe (PID: 8352)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • wscript.exe (PID: 7940)
      • wscript.exe (PID: 7960)
      • wscript.exe (PID: 8136)
      • wscript.exe (PID: 5156)

    • Checks whether a specific file exists (SCRIPT)

      • wscript.exe (PID: 7940)
      • wscript.exe (PID: 5156)

    • Starts CMD.EXE for commands execution

      • 31529c7f5c2f38a57227b307bb77e2dc86d283bd8110cf0b8a38285f75b7f872.exe (PID: 7876)
      • wscript.exe (PID: 7940)
      • wscript.exe (PID: 8136)
      • wscript.exe (PID: 7960)
      • mshta.exe (PID: 8188)
      • cmd.exe (PID: 3008)
      • cmd.exe (PID: 3304)
      • cmd.exe (PID: 7428)
      • mshta.exe (PID: 4944)
      • wscript.exe (PID: 7848)
      • wscript.exe (PID: 8720)
      • wscript.exe (PID: 8604)
      • wscript.exe (PID: 5156)
      • wscript.exe (PID: 8712)
      • wscript.exe (PID: 8308)
      • wscript.exe (PID: 8736)
      • wscript.exe (PID: 8636)
      • wscript.exe (PID: 8840)
      • wscript.exe (PID: 9056)
      • wscript.exe (PID: 8352)
      • wscript.exe (PID: 8392)
      • wscript.exe (PID: 12316)
      • wscript.exe (PID: 10832)
      • wscript.exe (PID: 11240)
      • wscript.exe (PID: 12180)
      • wscript.exe (PID: 9060)

    • Executing commands from a ".bat" file

      • 31529c7f5c2f38a57227b307bb77e2dc86d283bd8110cf0b8a38285f75b7f872.exe (PID: 7876)
      • wscript.exe (PID: 8720)
      • wscript.exe (PID: 8604)
      • wscript.exe (PID: 8712)
      • wscript.exe (PID: 8308)
      • wscript.exe (PID: 8636)
      • wscript.exe (PID: 8840)
      • wscript.exe (PID: 8736)
      • wscript.exe (PID: 9056)
      • wscript.exe (PID: 7848)
      • wscript.exe (PID: 8352)
      • wscript.exe (PID: 8392)
      • wscript.exe (PID: 12316)
      • wscript.exe (PID: 11240)
      • wscript.exe (PID: 10832)
      • wscript.exe (PID: 12180)
      • wscript.exe (PID: 9060)

    • Gets full path of the running script (SCRIPT)

      • wscript.exe (PID: 7960)
      • wscript.exe (PID: 8136)
      • wscript.exe (PID: 5156)

    • Reads security settings of Internet Explorer

      • 31529c7f5c2f38a57227b307bb77e2dc86d283bd8110cf0b8a38285f75b7f872.exe (PID: 7876)
      • WinRAR.exe (PID: 7316)
      • ORNYAE.EXE (PID: 896)

    • Uses ATTRIB.EXE to modify file attributes

      • cmd.exe (PID: 8056)
      • cmd.exe (PID: 4408)
      • cmd.exe (PID: 3304)
      • cmd.exe (PID: 5772)
      • cmd.exe (PID: 7560)
      • cmd.exe (PID: 7744)
      • cmd.exe (PID: 8836)
      • cmd.exe (PID: 9008)
      • cmd.exe (PID: 8344)
      • cmd.exe (PID: 8296)
      • cmd.exe (PID: 8988)
      • cmd.exe (PID: 8924)
      • cmd.exe (PID: 8884)
      • cmd.exe (PID: 8344)
      • cmd.exe (PID: 9028)
      • cmd.exe (PID: 9124)
      • cmd.exe (PID: 8856)
      • cmd.exe (PID: 8252)
      • cmd.exe (PID: 8992)
      • cmd.exe (PID: 7228)
      • cmd.exe (PID: 6028)
      • cmd.exe (PID: 5392)
      • cmd.exe (PID: 9388)
      • cmd.exe (PID: 8936)
      • cmd.exe (PID: 7888)
      • cmd.exe (PID: 8144)

    • Gets the drive type (SCRIPT)

      • wscript.exe (PID: 5156)

    • Gets a collection of all available drive names (SCRIPT)

      • wscript.exe (PID: 5156)

    • Executable content was dropped or overwritten

      • 31529c7f5c2f38a57227b307bb77e2dc86d283bd8110cf0b8a38285f75b7f872.exe (PID: 7876)
      • ORNYAE.EXE (PID: 896)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 8136)
      • wscript.exe (PID: 7960)
      • wscript.exe (PID: 7848)
      • wscript.exe (PID: 7940)
      • wscript.exe (PID: 8604)
      • wscript.exe (PID: 8720)

    • The process executes VB scripts

      • 31529c7f5c2f38a57227b307bb77e2dc86d283bd8110cf0b8a38285f75b7f872.exe (PID: 7876)
      • cmd.exe (PID: 7744)
      • cmd.exe (PID: 8344)
      • cmd.exe (PID: 8056)
      • cmd.exe (PID: 9008)
      • cmd.exe (PID: 8836)
      • cmd.exe (PID: 8988)
      • cmd.exe (PID: 8884)
      • cmd.exe (PID: 8924)
      • cmd.exe (PID: 8992)
      • cmd.exe (PID: 8344)
      • cmd.exe (PID: 8252)
      • cmd.exe (PID: 6028)
      • cmd.exe (PID: 5392)
      • cmd.exe (PID: 7228)
      • cmd.exe (PID: 8856)
      • cmd.exe (PID: 8144)
      • cmd.exe (PID: 8296)

    • Starts POWERSHELL.EXE for commands execution

      • wscript.exe (PID: 7960)

    • Write to the desktop.ini file (may be used to cloak folders)

      • ORNYAE.EXE (PID: 896)

    • Kill processes via PowerShell

      • powershell.exe (PID: 6708)
      • powershell.exe (PID: 7632)
      • powershell.exe (PID: 1328)
      • powershell.exe (PID: 7012)
      • powershell.exe (PID: 6264)

    • Likely accesses (executes) a file from the Public directory

      • attrib.exe (PID: 7556)
      • cmd.exe (PID: 5772)
      • cmd.exe (PID: 8496)

    • Accesses current user name via WMI (SCRIPT)

      • wscript.exe (PID: 7960)

    • Executes WMI query (SCRIPT)

      • wscript.exe (PID: 5156)

    • Application launched itself

      • cmd.exe (PID: 3008)
      • cmd.exe (PID: 3304)
      • cmd.exe (PID: 7428)
      • wscript.exe (PID: 8352)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 7816)
      • cmd.exe (PID: 1388)
      • cmd.exe (PID: 4932)
      • cmd.exe (PID: 7560)
      • cmd.exe (PID: 7428)

    • Accesses ComputerSystem(Win32_ComputerSystem) via WMI (SCRIPT)

      • wscript.exe (PID: 5156)

    • Uses NETSH.EXE to change the status of the firewall

      • cmd.exe (PID: 1228)

    • Uses WMI to retrieve WMI-managed resources (SCRIPT)

      • wscript.exe (PID: 5156)

    • Uses WMIC.EXE to obtain local storage devices information

      • cmd.exe (PID: 4608)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 7560)

    • Accesses computer name via WMI (SCRIPT)

      • wscript.exe (PID: 5156)

    • Uses WMIC.EXE to create a new process

      • cmd.exe (PID: 7636)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 7316)

    • Checks supported languages

      • 31529c7f5c2f38a57227b307bb77e2dc86d283bd8110cf0b8a38285f75b7f872.exe (PID: 7876)
      • MONOXIDEX86.HARMLESS.EXE (PID: 2140)
      • ORNYAE.EXE (PID: 896)

    • Reads the computer name

      • 31529c7f5c2f38a57227b307bb77e2dc86d283bd8110cf0b8a38285f75b7f872.exe (PID: 7876)
      • ORNYAE.EXE (PID: 896)

    • Reads Internet Explorer settings

      • mshta.exe (PID: 7988)
      • mshta.exe (PID: 8188)
      • mshta.exe (PID: 7244)
      • mshta.exe (PID: 4944)

    • The sample compiled with english language support

      • 31529c7f5c2f38a57227b307bb77e2dc86d283bd8110cf0b8a38285f75b7f872.exe (PID: 7876)
      • ORNYAE.EXE (PID: 896)

    • Create files in a temporary directory

      • 31529c7f5c2f38a57227b307bb77e2dc86d283bd8110cf0b8a38285f75b7f872.exe (PID: 7876)

    • Process checks computer location settings

      • 31529c7f5c2f38a57227b307bb77e2dc86d283bd8110cf0b8a38285f75b7f872.exe (PID: 7876)

    • Reads mouse settings

      • ORNYAE.EXE (PID: 896)

    • Reads the machine GUID from the registry

      • ORNYAE.EXE (PID: 896)

    • Creates files or folders in the user directory

      • ORNYAE.EXE (PID: 896)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 664)
      • WMIC.exe (PID: 8264)

    • Checks proxy server information

      • mshta.exe (PID: 7988)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 51
ZipBitFlag: 0x0003
ZipCompression: Unknown (99)
ZipModifyDate: 2025:05:14 12:21:26
ZipCRC: 0x7c8cec44
ZipCompressedSize: 1355362
ZipUncompressedSize: 1774080
ZipFileName: 31529c7f5c2f38a57227b307bb77e2dc86d283bd8110cf0b8a38285f75b7f872.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
686
Monitored processes
558
Malicious processes
30
Suspicious processes
11

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe no specs 31529c7f5c2f38a57227b307bb77e2dc86d283bd8110cf0b8a38285f75b7f872.exe wscript.exe no specs wscript.exe no specs mshta.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs wscript.exe no specs mshta.exe no specs cmd.exe no specs conhost.exe no specs wscript.exe no specs attrib.exe no specs monoxidex86.harmless.exe no specs ornyae.exe cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs attrib.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs mshta.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs net.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs powershell.exe no specs conhost.exe no specs attrib.exe no specs net1.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs attrib.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs attrib.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs rundll32.exe no specs attrib.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs netsh.exe no specs cipher.exe no specs mshta.exe no specs cmd.exe no specs attrib.exe no specs reg.exe attrib.exe no specs attrib.exe no specs reg.exe no specs reg.exe no specs attrib.exe no specs wscript.exe no specs taskkill.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs wscript.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs attrib.exe no specs taskkill.exe no specs wscript.exe no specs wscript.exe no specs attrib.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs attrib.exe no specs conhost.exe no specs conhost.exe no specs attrib.exe no specs attrib.exe no specs cmd.exe no specs conhost.exe no specs wscript.exe no specs attrib.exe no specs wscript.exe no specs attrib.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs attrib.exe no specs attrib.exe no specs wscript.exe no specs attrib.exe no specs attrib.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs wscript.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs mshta.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs attrib.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs attrib.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs attrib.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs attrib.exe no specs cmd.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs wscript.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs wscript.exe no specs cmd.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs wscript.exe no specs conhost.exe no specs cmd.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs wscript.exe no specs conhost.exe no specs wscript.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs attrib.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs mshta.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs attrib.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs mshta.exe no specs cmd.exe no specs conhost.exe no specs mshta.exe no specs cmd.exe no specs conhost.exe no specs mshta.exe no specs cmd.exe no specs conhost.exe no specs mshta.exe no specs cmd.exe no specs conhost.exe no specs mshta.exe no specs cmd.exe no specs conhost.exe no specs mshta.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
300\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
516"C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {current} safebootC:\Windows\SysWOW64\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
660attrib +h "C:\Users\admin\AppData\Roaming\Microsoft\Windows\winproc.vbs"C:\Windows\SysWOW64\attrib.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Attribute Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\attrib.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\ulib.dll
660\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
664wmic logicaldisk where "DriveType=2" get DeviceID /format:valueC:\Windows\SysWOW64\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\iphlpapi.dll
680"C:\Windows\System32\cmd.exe" /c start /B wininit.exe && mshta C:\Users\admin\AppData\Roaming\sys32.htaC:\Windows\SysWOW64\cmd.exe—mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
720attrib +h +s ""C:\ProgramData\Microsoft\Windows"\systemguard.bat"C:\Windows\SysWOW64\attrib.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Attribute Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\attrib.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\ulib.dll
728C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Roaming\Microsoft\Windows\winproc.bat" "C:\Windows\SysWOW64\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
896"C:\Users\admin\AppData\Local\Temp\ORNYAE.EXE" C:\Users\admin\AppData\Local\Temp\ORNYAE.EXE
31529c7f5c2f38a57227b307bb77e2dc86d283bd8110cf0b8a38285f75b7f872.exe
User:
admin
Integrity Level:
MEDIUM
Version:
3, 3, 8, 1
Modules
Images
c:\users\admin\appdata\local\temp\ornyae.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
920C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Roaming\Microsoft\Windows\winproc.bat" "C:\Windows\SysWOW64\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
Total events
61 368
Read events
61 306
Write events
62
Delete events
0

Modification events

(PID) Process:(7316) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(7316) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(7316) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(7316) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\shroom-boom.zip
(PID) Process:(7316) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7316) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(7316) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(7316) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(7316) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(7876) 31529c7f5c2f38a57227b307bb77e2dc86d283bd8110cf0b8a38285f75b7f872.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.js\OpenWithProgids
Operation:writeName:JSFile
Value:
Executable files
4
Suspicious files
84
Text files
44
Unknown types
0

Dropped files

PID
Process
Filename
Type
7316WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb7316.5377\31529c7f5c2f38a57227b307bb77e2dc86d283bd8110cf0b8a38285f75b7f872.exeexecutable
MD5:86DC4A2BA727DF70A0C289846852CEA3
SHA256:31529C7F5C2F38A57227B307BB77E2DC86D283BD8110CF0B8A38285F75B7F872
787631529c7f5c2f38a57227b307bb77e2dc86d283bd8110cf0b8a38285f75b7f872.exeC:\Users\admin\AppData\Local\Temp\INSTALLE10R.VBStext
MD5:7CC3B626518CF48DBFC1AFCC85D95F21
SHA256:5D3DB0D7702BC6B8CA3F8A644DD354203544E03E50E2745DD4540E95654C6296
787631529c7f5c2f38a57227b307bb77e2dc86d283bd8110cf0b8a38285f75b7f872.exeC:\Users\admin\AppData\Local\Temp\KVJ012A.BATtext
MD5:06BA6D36BE44C91A2344B0F27BAEC1E8
SHA256:E56B217717985D8AE33CEE12F9F76A439A85EC04F07A16254B02CD8A263E31E0
787631529c7f5c2f38a57227b307bb77e2dc86d283bd8110cf0b8a38285f75b7f872.exeC:\Users\admin\AppData\Local\Temp\EXECUTION.JStext
MD5:D0EF78B5BE1F57ED5D18E57DD6BD6D31
SHA256:FD819D9467ABA2D315BE6051EBE84B2D6E72571F1174CA7C49763303E065A1FA
787631529c7f5c2f38a57227b307bb77e2dc86d283bd8110cf0b8a38285f75b7f872.exeC:\Users\admin\AppData\Local\Temp\LOL.VBStext
MD5:8BB7D55904F0592B12912CD17A6226A2
SHA256:B363FBB1413DA760FDA389FBC481025B725DD281712542C32014BC6273EDDAC8
8056cmd.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\winhidden.vbstext
MD5:47D65D6905A58790BEC5DABCF90300A0
SHA256:20C0CA7197D010F994B859E304B0D317A54232A247F84D367D100E300CED6BCF
787631529c7f5c2f38a57227b307bb77e2dc86d283bd8110cf0b8a38285f75b7f872.exeC:\Users\admin\AppData\Local\Temp\INSTALL.BATtext
MD5:33B1DBCF0001EF830215EC58FB52F59B
SHA256:D2EFF3E7090B113664305AB77CD7C2883E302FE8F806D8C3E0BBF935298FE3D1
5156wscript.exeC:\Users\admin\AppData\Roaming\sys32.htatext
MD5:8BB7D55904F0592B12912CD17A6226A2
SHA256:B363FBB1413DA760FDA389FBC481025B725DD281712542C32014BC6273EDDAC8
787631529c7f5c2f38a57227b307bb77e2dc86d283bd8110cf0b8a38285f75b7f872.exeC:\Users\admin\AppData\Local\Temp\S409-A1.BATtext
MD5:EE918E07E5A8BFE4296619883DAEBE7A
SHA256:E6D41CDAFF236F5C6029E3BD4CE56B40FF3A46C1FB42B6698BD282B976414AD6
787631529c7f5c2f38a57227b307bb77e2dc86d283bd8110cf0b8a38285f75b7f872.exeC:\Users\admin\AppData\Local\Temp\HV23UR2.BATtext
MD5:56D31575090E9C578213B2A5297B537E
SHA256:15938AAA257893055D2D5EA2B738FAF5E56640477108CE861471C3B3BA5770C0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
19
DNS requests
14
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
14056
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
14056
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2112
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.75:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 20.73.194.208
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
google.com
  • 142.250.184.206
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 23.35.229.160
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 20.190.159.75
  • 40.126.31.131
  • 40.126.31.2
  • 40.126.31.129
  • 20.190.159.64
  • 20.190.159.2
  • 40.126.31.128
  • 20.190.159.4
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
shroom-boom.zip