File name:

3dcb5e3575cdd7d544e2e4b95f87ad11d30ac7df9e8322134ca3533d7a6b9acf.zip

Full analysis: https://app.any.run/tasks/1f6514aa-41d1-42ae-8d90-5161686f799f
Verdict: Malicious activity
Analysis date: June 15, 2024, 17:40:15
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

AF69B92083813D541E38E2B750168A8F

SHA1:

16397C26380BFA8DD7FA27D271398A0090188EA1

SHA256:

3DCB5E3575CDD7D544E2E4B95F87AD11D30AC7DF9E8322134CA3533D7A6B9ACF

SSDEEP:

98304:9e1GSRkz61AC5/FM0gl8ICun3xUdQnvWqMHvIU0YG8knEVpwktWCtuuJxldgi7aE:QO3qxIw

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • Everything.exe (PID: 2084)
      • Последняя активность .exe (PID: 2312)
      • Последняя активность .exe (PID: 3196)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 5620)

  • SUSPICIOUS

    • Application launched itself

      • Everything.exe (PID: 3644)
      • Everything.exe (PID: 4424)

    • Reads the date of Windows installation

      • Everything.exe (PID: 3644)
      • Everything.exe (PID: 4424)

    • Reads security settings of Internet Explorer

      • Everything.exe (PID: 3644)
      • WinRAR.exe (PID: 5620)
      • Последняя активность .exe (PID: 2312)
      • Everything.exe (PID: 4424)
      • Everything.exe (PID: 2084)
      • Последняя активность .exe (PID: 3196)

    • Searches for installed software

      • Последняя активность .exe (PID: 2312)
      • Последняя активность .exe (PID: 3196)

    • Read disk information to detect sandboxing environments

      • История устройств.exe (PID: 708)

  • INFO

    • Reads the computer name

      • История устройств.exe (PID: 708)
      • Everything.exe (PID: 2084)
      • Everything.exe (PID: 3644)
      • Последняя активность .exe (PID: 2312)
      • Последняя активность .exe (PID: 3196)
      • Последние папки.exe (PID: 5528)
      • Everything.exe (PID: 4424)
      • Удаленные папки.exe (PID: 1120)
      • Everything.exe (PID: 472)

    • Checks supported languages

      • Everything.exe (PID: 2084)
      • Everything.exe (PID: 3644)
      • История устройств.exe (PID: 708)
      • Последняя активность .exe (PID: 2312)
      • Последняя активность .exe (PID: 3196)
      • Последние папки.exe (PID: 5528)
      • Удаленные папки.exe (PID: 1120)
      • Everything.exe (PID: 4424)
      • Everything.exe (PID: 472)

    • Process checks computer location settings

      • Everything.exe (PID: 3644)
      • Everything.exe (PID: 4424)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 5620)

    • NirSoft software is detected

      • История устройств.exe (PID: 708)
      • Последняя активность .exe (PID: 624)
      • Последняя активность .exe (PID: 3196)
      • Последние папки.exe (PID: 5528)
      • Последняя активность .exe (PID: 4936)
      • Последняя активность .exe (PID: 2312)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2023:05:26 10:10:00
ZipCRC: 0xac38ab53
ZipCompressedSize: 758008
ZipUncompressedSize: 1778184
ZipFileName: Everything.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
133
Monitored processes
14
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe everything.exe no specs everything.exe история устройств.exe no specs последние папки.exe no specs последняя активность .exe no specs последняя активность .exe последняя активность .exe no specs последняя активность .exe удаленные папки.exe no specs удаленные папки.exe everything.exe no specs everything.exe rundll32.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
472"C:\Users\admin\AppData\Local\Temp\Rar$EXa5620.7933\Everything.exe" -isrunas C:\Users\admin\AppData\Local\Temp\Rar$EXa5620.7933\Everything.exe
Everything.exe
User:
admin
Company:
voidtools
Integrity Level:
HIGH
Description:
Everything
Exit code:
0
Version:
1.4.1.1024
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa5620.7933\everything.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
624"C:\Users\admin\AppData\Local\Temp\Rar$EXa5620.7281\Последняя активность .exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa5620.7281\Последняя активность .exe—WinRAR.exe
User:
admin
Company:
NirSoft
Integrity Level:
MEDIUM
Description:
LastActivityView
Exit code:
3221226540
Version:
1.32
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa5620.7281\последняя активность .exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
708"C:\Users\admin\AppData\Local\Temp\Rar$EXa5620.4255\История устройств.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa5620.4255\История устройств.exe—WinRAR.exe
User:
admin
Company:
NirSoft
Integrity Level:
MEDIUM
Description:
Lists USB Devices
Version:
3.06
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa5620.4255\история устройств.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\ws2_32.dll
1120"C:\Users\admin\AppData\Local\Temp\Rar$EXa5620.7539\Удаленные папки.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa5620.7539\Удаленные папки.exe
WinRAR.exe
User:
admin
Company:
Goversoft LLC
Integrity Level:
HIGH
Description:
ShellBag AnalyZer & Cleaner
Version:
1.28.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa5620.7539\удаленные папки.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
1864C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
2084"C:\Users\admin\AppData\Local\Temp\Rar$EXa5620.4155\Everything.exe" -isrunas C:\Users\admin\AppData\Local\Temp\Rar$EXa5620.4155\Everything.exe
Everything.exe
User:
admin
Company:
voidtools
Integrity Level:
HIGH
Description:
Everything
Version:
1.4.1.1024
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa5620.4155\everything.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
2312"C:\Users\admin\AppData\Local\Temp\Rar$EXa5620.4939\Последняя активность .exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa5620.4939\Последняя активность .exe
WinRAR.exe
User:
admin
Company:
NirSoft
Integrity Level:
HIGH
Description:
LastActivityView
Version:
1.32
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa5620.4939\последняя активность .exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\user32.dll
3196"C:\Users\admin\AppData\Local\Temp\Rar$EXa5620.7281\Последняя активность .exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa5620.7281\Последняя активность .exe
WinRAR.exe
User:
admin
Company:
NirSoft
Integrity Level:
HIGH
Description:
LastActivityView
Version:
1.32
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa5620.7281\последняя активность .exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\user32.dll
3644"C:\Users\admin\AppData\Local\Temp\Rar$EXa5620.4155\Everything.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa5620.4155\Everything.exe—WinRAR.exe
User:
admin
Company:
voidtools
Integrity Level:
MEDIUM
Description:
Everything
Version:
1.4.1.1024
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa5620.4155\everything.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
4424"C:\Users\admin\AppData\Local\Temp\Rar$EXa5620.7933\Everything.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa5620.7933\Everything.exe—WinRAR.exe
User:
admin
Company:
voidtools
Integrity Level:
MEDIUM
Description:
Everything
Exit code:
0
Version:
1.4.1.1024
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa5620.7933\everything.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
Total events
25 308
Read events
25 275
Write events
33
Delete events
0

Modification events

(PID) Process:(5620) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(5620) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(5620) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(5620) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\3dcb5e3575cdd7d544e2e4b95f87ad11d30ac7df9e8322134ca3533d7a6b9acf.zip
(PID) Process:(5620) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(5620) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(5620) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(5620) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(5620) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\3c\52C64B7E
Operation:writeName:@C:\WINDOWS\System32\acppage.dll,-6002
Value:
Windows Batch File
(PID) Process:(5620) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
42
Suspicious files
14
Text files
42
Unknown types
0

Dropped files

PID
Process
Filename
Type
5620WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa5620.4155\Everything.lngbinary
MD5:BA118BDF7118802BEEA188727B155D5F
SHA256:270C2DBD55642543479C7E7E62F99EC11BBC65496010B1354A2BE9482269D471
5620WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa5620.4155\История устройств.exeexecutable
MD5:D0D19F2CCCACF70BC84846076ACC11C8
SHA256:63012EA9CE8ED335DB7BDD33FA7BB449AA1BA31755C6845C1E79C11CB60DC908
5620WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa5620.4155\История устройств.cfgtext
MD5:DEEF3031DC8749D779BC83E2E603AD1B
SHA256:DC91446502EDFE569227E5EB87EE544FC4E9B295C1BB728AE4EFC208C2AA0211
5620WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa5620.4255\Everything.lngbinary
MD5:BA118BDF7118802BEEA188727B155D5F
SHA256:270C2DBD55642543479C7E7E62F99EC11BBC65496010B1354A2BE9482269D471
5620WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa5620.4155\Последние запущенные.cfgtext
MD5:1E9E77443C463D23A8BCB4CEF89EF955
SHA256:F7A266A952AE664AFEBAABDFFAA4F89B4A5FF2682BF17D882FBB33AB52062298
5620WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa5620.4155\Everything.exeexecutable
MD5:A7067594451CAB167A4F463BE9D0209C
SHA256:D3A6ED07BD3B52C62411132D060560F9C0C88CE183851F16B632A99B4D4E7581
5620WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa5620.4155\Последняя активность .cfgtext
MD5:942D131E26674308ED06E419F0831EC4
SHA256:4CC9590D6E1ACEA97381E290459DC5818EB53B16D8791574D04A813F5FE52543
5620WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa5620.4255\Удаленные папки.exeexecutable
MD5:FAAFF4148DB8CDA4068234F5D5110C60
SHA256:58304B1ED9A66D44938F1E04767D1219194693BC918750388F259B1D0D251DC1
5620WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa5620.4255\Открыть appdata.battext
MD5:200AADBF80CEABC021F7AE98213CF3DE
SHA256:04FAC8CB5297EEA5CB8FB5F645D53682F429D5E4D86DB62D9FF4106E88AAEEE5
5620WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa5620.4255\История устройств.exeexecutable
MD5:D0D19F2CCCACF70BC84846076ACC11C8
SHA256:63012EA9CE8ED335DB7BDD33FA7BB449AA1BA31755C6845C1E79C11CB60DC908
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
21
DNS requests
6
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5960
RUXIMICS.exe
GET
200
92.123.236.192:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
5380
svchost.exe
GET
200
92.123.236.192:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
5960
RUXIMICS.exe
GET
200
23.200.213.221:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
5140
MoUsoCoreWorker.exe
GET
200
23.200.213.221:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
5380
svchost.exe
GET
200
23.200.213.221:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
—
—
POST
—
20.42.65.84:443
https://self.events.data.microsoft.com/OneCollector/1.0/
unknown
—
—
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5380
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
unknown
5960
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5140
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5960
RUXIMICS.exe
92.123.236.192:80
crl.microsoft.com
Akamai International B.V.
FR
unknown
5380
svchost.exe
92.123.236.192:80
crl.microsoft.com
Akamai International B.V.
FR
unknown
—
—
239.255.255.250:1900
—
—
—
unknown
5380
svchost.exe
23.200.213.221:80
www.microsoft.com
AKAMAI-AS
FR
unknown
5960
RUXIMICS.exe
23.200.213.221:80
www.microsoft.com
AKAMAI-AS
FR
unknown
5140
MoUsoCoreWorker.exe
23.200.213.221:80
www.microsoft.com
AKAMAI-AS
FR
unknown

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 92.123.236.192
  • 92.123.236.161
whitelisted
www.microsoft.com
  • 23.200.213.221
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
self.events.data.microsoft.com
  • 20.189.173.4
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
3dcb5e3575cdd7d544e2e4b95f87ad11d30ac7df9e8322134ca3533d7a6b9acf.zip