File name:

setup.rar

Full analysis: https://app.any.run/tasks/d023e6a3-2b2b-49e8-889d-32ca517d59ff
Verdict: Malicious activity
Analysis date: July 25, 2024, 20:21:37
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

0524037A5D3227003AED8466C8378895

SHA1:

ED94257DECCC7A63F0FA8C0917A6B01B17CA4B96

SHA256:

3C7AE3DFDD28DE85D57D0DDBDA47C93EF689B3C280D3C9969BD2747AF908D57D

SSDEEP:

98304:T+hNk4bnlu5YmEqMRxpUxOoDNARHM9nfe795dEN11TFU4HwIKkpWwG7er/gvJEof:Q6p06K3/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 5564)
      • Setup.exe (PID: 6344)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 5564)

    • Starts application with an unusual extension

      • Setup.exe (PID: 6344)
      • Setup.exe (PID: 4544)

    • Executable content was dropped or overwritten

      • Setup.exe (PID: 6344)

  • INFO

    • Checks supported languages

      • Setup.exe (PID: 6344)
      • StrCmp.exe (PID: 6860)
      • Setup.exe (PID: 4544)
      • more.com (PID: 6296)
      • StrCmp.exe (PID: 6036)
      • more.com (PID: 3384)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 5564)

    • Creates files in the program directory

      • Setup.exe (PID: 6344)
      • Setup.exe (PID: 4544)

    • Creates files or folders in the user directory

      • Setup.exe (PID: 6344)

    • Reads the computer name

      • StrCmp.exe (PID: 6860)
      • Setup.exe (PID: 6344)
      • more.com (PID: 6296)
      • Setup.exe (PID: 4544)
      • StrCmp.exe (PID: 6036)
      • more.com (PID: 3384)

    • Manual execution by a user

      • Setup.exe (PID: 6344)
      • Setup.exe (PID: 4544)

    • Create files in a temporary directory

      • Setup.exe (PID: 6344)
      • more.com (PID: 6296)
      • Setup.exe (PID: 4544)
      • more.com (PID: 3384)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
146
Monitored processes
13
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe slui.exe no specs rundll32.exe no specs setup.exe strcmp.exe no specs more.com no specs conhost.exe no specs setup.exe no specs strcmp.exe no specs more.com no specs conhost.exe no specs searchindexer.exe no specs searchindexer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3384C:\WINDOWS\SysWOW64\more.comC:\Windows\SysWOW64\more.com—Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
More Utility
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\more.com
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\ulib.dll
4296C:\WINDOWS\SysWOW64\SearchIndexer.exeC:\Windows\SysWOW64\SearchIndexer.exe—more.com
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Windows Search Indexer
Version:
7.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\lgi
c:\windows\syswow64\searchindexer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
4544"C:\Users\admin\Desktop\setup\Setup.exe" C:\Users\admin\Desktop\setup\Setup.exe—explorer.exe
User:
admin
Company:
CANON INC.
Integrity Level:
MEDIUM
Description:
Universal Installer Windows
Exit code:
1
Version:
2.5.30.7
Modules
Images
c:\users\admin\desktop\setup\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
4552C:\WINDOWS\SysWOW64\SearchIndexer.exeC:\Windows\SysWOW64\SearchIndexer.exe—more.com
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Windows Search Indexer
Version:
7.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\dwhlaqaqmqb
5564"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\setup.rarC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
5648\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—more.com
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6036C:\Users\admin\AppData\Roaming\nloud\ZGJPUSRSRWGVPEFRDY\StrCmp.exeC:\Users\admin\AppData\Roaming\nloud\ZGJPUSRSRWGVPEFRDY\StrCmp.exe—Setup.exe
User:
admin
Company:
aaa
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.00
Modules
Images
c:\users\admin\appdata\roaming\nloud\zgjpusrsrwgvpefrdy\strcmp.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvbvm60.dll
c:\windows\syswow64\user32.dll
6296C:\WINDOWS\SysWOW64\more.comC:\Windows\SysWOW64\more.com—Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
More Utility
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\more.com
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6344"C:\Users\admin\Desktop\setup\Setup.exe" C:\Users\admin\Desktop\setup\Setup.exe
explorer.exe
User:
admin
Company:
CANON INC.
Integrity Level:
HIGH
Description:
Universal Installer Windows
Exit code:
1
Version:
2.5.30.7
Modules
Images
c:\users\admin\desktop\setup\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
6468C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
5 761
Read events
5 737
Write events
23
Delete events
1

Modification events

(PID) Process:(5564) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(5564) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(5564) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(5564) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\setup.rar
(PID) Process:(5564) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(5564) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(5564) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(5564) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(5564) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFE4FFFFFF78000000A403000061020000
(PID) Process:(5564) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\General
Operation:writeName:LastFolder
Value:
C:\Users\admin\AppData\Local\Temp
Executable files
13
Suspicious files
6
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
6296more.comC:\Users\admin\AppData\Local\Temp\lgi —
MD5:—
SHA256:—
3384more.comC:\Users\admin\AppData\Local\Temp\dwhlaqaqmqb —
MD5:—
SHA256:—
5564WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5564.22393\setup\plugins\Microsoft.VisualStudio.VsWebProtocolexecutable
MD5:91ACF072FE60B3EF9867FAEC1A7A8CB0
SHA256:1F49ADC807A564E7C1ECF32F58074A1230A6FE4764E8F54CE7FFA8C2E880DCCA
5564WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5564.22393\setup\libvlc.dllexecutable
MD5:96214B94B796BFFC48D63289854AE5A2
SHA256:528C416CFB4813EE5F1DA52743EF4ADB20043171230098B27E25D1DD90E3F288
5564WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5564.22393\setup\libvlccore.dllexecutable
MD5:E25413BB41C2F239FFDD3569F76E74B0
SHA256:9126D9ABF91585456000FFFD9336478E91B9EA07ED2A25806A4E2E0437F96D29
5564WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5564.22393\setup\plugins\lang-1049.dllexecutable
MD5:0AC98A4BFC717523E344010A42C2F4BA
SHA256:68546336232AA2BE277711AFA7C1F08ECD5FCC92CC182F90459F0C61FB39507F
5564WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5564.22393\setup\plugins\NvStWizexecutable
MD5:9E82E3B658393BED3F7E4F090DF1FBE7
SHA256:C2AD5BD189DF04B39BE18DEC5CD251CF79B066010706AD26D99DF7E49FD07762
5564WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5564.22393\setup\UIxMarketPlugin.dllexecutable
MD5:4C96E767E3DB9A540C65FE5BED7A408E
SHA256:37E11B7B717FE7E8C1F74DCC5BA80CD3BB0DA196B33D548EB3E2A2FBAC5B779C
6344Setup.exeC:\Users\admin\AppData\Roaming\nloud\relay.dllexecutable
MD5:7D2F87123E63950159FB2C724E55BDAB
SHA256:B3483BB771948ED8D3F76FAAA3606C8EF72E3D2D355EAA652877E21E0651AA9A
5564WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5564.22393\setup\plugins\StartupHelperexecutable
MD5:14934CACA84D5FE0288F27EFB31DCBF8
SHA256:7FA86147035627BAE39576BCBE619D045E94A48C4DB8CA131968C20BB4DE4A36
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
45
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5272
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5368
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5272
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1568
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
5552
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4516
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6012
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4360
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
104.126.37.177:443
—
Akamai International B.V.
DE
unknown
4204
svchost.exe
4.209.33.156:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
3952
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4516
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4468
slui.exe
20.83.72.98:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 4.231.128.59
  • 51.124.78.146
whitelisted
google.com
  • 142.250.185.110
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted
www.bing.com
  • 104.126.37.128
  • 104.126.37.137
  • 104.126.37.153
  • 104.126.37.129
  • 104.126.37.131
  • 104.126.37.144
  • 104.126.37.136
  • 104.126.37.145
  • 104.126.37.139
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.160.22
  • 40.126.32.138
  • 20.190.160.14
  • 40.126.32.72
  • 40.126.32.76
  • 20.190.160.20
  • 40.126.32.74
  • 40.126.32.68
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
fd.api.iris.microsoft.com
  • 20.24.121.134
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
setup.rar