File name:

da207db111111bd0c937fb784c29a81d5306a251adef5d1db094bdf01653835b.zip

Full analysis: https://app.any.run/tasks/b585f3a3-e4a2-4db3-91ea-d78eef951faa
Verdict: Malicious activity
Analysis date: April 29, 2025, 14:01:48
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
Indicators:
MIME: application/zip
File info: Zip archive data, at least v5.1 to extract, compression method=AES Encrypted
MD5:

0603223EB183E2A4050BA6D95808CCCC

SHA1:

0F27B60D9AFAAF60313C829101CA45297D91E9B6

SHA256:

3E66F59E37B70A839A20D0DF5BBF84A3942D4D281EA6A4FA1EB2F04572A76DD9

SSDEEP:

98304:foXnoL/m2qz6XeuqqEVODR7OnZSzxIPbWHu7DtqBUE/Gc4xpfbWL1DilWMXeBQ+H:mEjDlXcvmIbKWJfUEjnS5QbDEdmyWm

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Known privilege escalation attack

      • dllhost.exe (PID: 7420)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 7408)
      • WinRAR.exe (PID: 7692)

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 7408)
      • WinRAR.exe (PID: 7692)
      • Clus-Blue.exe (PID: 5384)

    • Application launched itself

      • WinRAR.exe (PID: 7408)

    • Executable content was dropped or overwritten

      • Clus-Blue.exe (PID: 5384)
      • Clus-Blue.exe (PID: 7572)
      • Clus-Blue.exe (PID: 2772)

    • The process drops C-runtime libraries

      • Clus-Blue.exe (PID: 5384)

    • Starts itself from another location

      • Clus-Blue.exe (PID: 5384)

    • Starts application with an unusual extension

      • Clus-Blue.exe (PID: 7572)

  • INFO

    • The sample compiled with english language support

      • WinRAR.exe (PID: 7408)
      • WinRAR.exe (PID: 7692)
      • Clus-Blue.exe (PID: 5384)

    • Checks supported languages

      • Clus-Blue.exe (PID: 5384)
      • 360Tray.exe (PID: 5756)
      • Clus-Blue.exe (PID: 7572)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 7692)

    • Reads the computer name

      • Clus-Blue.exe (PID: 5384)
      • 360Tray.exe (PID: 5756)
      • Clus-Blue.exe (PID: 7572)
      • ping.com (PID: 2236)
      • Clus-Blue.exe (PID: 2772)

    • Creates files in the program directory

      • Clus-Blue.exe (PID: 5384)
      • Clus-Blue.exe (PID: 2772)

    • The sample compiled with chinese language support

      • Clus-Blue.exe (PID: 2772)

    • Create files in a temporary directory

      • Clus-Blue.exe (PID: 2772)
      • Clus-Blue.exe (PID: 7572)

    • Reads the machine GUID from the registry

      • 360Tray.exe (PID: 5756)

    • Reads Microsoft Office registry keys

      • OpenWith.exe (PID: 2096)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 51
ZipBitFlag: 0x0003
ZipCompression: Unknown (99)
ZipModifyDate: 2025:04:29 14:01:22
ZipCRC: 0x7dbacfc1
ZipCompressedSize: 16175429
ZipUncompressedSize: 16212933
ZipFileName: da207db111111bd0c937fb784c29a81d5306a251adef5d1db094bdf01653835b.zip
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
143
Monitored processes
11
Malicious processes
1
Suspicious processes
3

Behavior graph

Click at the process to see the details
start winrar.exe no specs winrar.exe clus-blue.exe clus-blue.exe 360tray.exe no specs CMSTPLUA clus-blue.exe openwith.exe no specs ping.com no specs openwith.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2096C:\WINDOWS\system32\OpenWith.exe -EmbeddingC:\Windows\System32\OpenWith.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
2236C:\Users\admin\AppData\Local\Temp\47165984\ping.comC:\Users\admin\AppData\Local\Temp\47165984\ping.com—Clus-Blue.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\f75a0c2.tmp
c:\users\admin\appdata\local\temp\47165984\ping.com
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
2772C:\ProgramData\Fidl\Clus-Blue.exeC:\ProgramData\Fidl\Clus-Blue.exe
Clus-Blue.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\programdata\fidl\clus-blue.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
5384"C:\Users\admin\AppData\Local\Temp\Rar$EXa7692.15658\Clus-Blue.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa7692.15658\Clus-Blue.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa7692.15658\clus-blue.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
5756"C:\ProgramData\Fidl\360Tray.exe" "C:\ProgramData\Fidl\360Tray.exe" /onuiC:\ProgramData\Fidl\360Tray.exe—Clus-Blue.exe
User:
admin
Company:
360.cn
Integrity Level:
MEDIUM
Description:
360安全卫士 安全防护中心模块
Exit code:
0
Version:
12, 0, 0, 1761
Modules
Images
c:\windows\syswow64\input.dll
c:\programdata\fidl\360tray.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
6272C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7208C:\WINDOWS\system32\OpenWith.exe -EmbeddingC:\Windows\System32\OpenWith.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
7408"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\da207db111111bd0c937fb784c29a81d5306a251adef5d1db094bdf01653835b.zipC:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
7420C:\WINDOWS\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}C:\Windows\SysWOW64\dllhost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ucrtbase.dll
c:\windows\syswow64\combase.dll
7572"C:\ProgramData\Fidl\Clus-Blue.exe" C:\ProgramData\Fidl\Clus-Blue.exe
dllhost.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\programdata\fidl\clus-blue.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
Total events
5 852
Read events
5 834
Write events
18
Delete events
0

Modification events

(PID) Process:(7408) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(7408) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(7408) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(7408) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\da207db111111bd0c937fb784c29a81d5306a251adef5d1db094bdf01653835b.zip
(PID) Process:(7408) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7408) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(7408) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(7408) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(7408) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(7692) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\chromium_ext.zip
Executable files
28
Suspicious files
11
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
7692WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7692.15658\Lab.cumbinary
MD5:7CB269327E0287F8258AB2A1B4735207
SHA256:E297951C712D5E5845E7935766B1E975A459E43BC11022A978C1C4241219D0F3
7692WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7692.15658\Qt5Network.dllexecutable
MD5:D73AA4F8749269D1590541E567387489
SHA256:7BFDFED166846921DAB87D51CA9B338C1FDD7F96C117E3BA0EDC07ED06DD9CB1
7692WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7692.15658\Utility.dllexecutable
MD5:48B0445F21B92190B1E199AD31F89CBC
SHA256:90CF67BEE83E0180A11EEC82115E930CB1BEDA60790CFC17542FCADBEC25DF11
7692WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7692.15658\Qt5Widgets.dllexecutable
MD5:2BD07ACEF2FFD5AD8388B714D4F81995
SHA256:250C3717663E4AB3CE50E4A53BC532BF0C0850D2917773DD7E482E733081A1A1
7692WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7692.15658\Kingfrae.srzebinary
MD5:FA90A001C2F9BDC09DF22B6A8106FEA3
SHA256:F957352080219828DCBC012B60736C624D7340D6CEEE97AABB5C505B68F3694B
7692WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7692.15658\Qt5Core.dllexecutable
MD5:5AF1A8D3E720C2ECD7C835510429DA9F
SHA256:45A830C44F93ABA5658E5E9697DE42B3F3EB383BBBF174ADE65A78F9A6C7D8B2
7692WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7692.15658\Qt5Xml.dllexecutable
MD5:EFEE87118A310EDB82A7A6AEEBAEC1C1
SHA256:8A70F0C243E7C6EC5F60EC667D20BBC89DE53A1455D7CD4313DA337760030655
7408WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIb7408.14071\da207db111111bd0c937fb784c29a81d5306a251adef5d1db094bdf01653835b.zipcompressed
MD5:0C3F83B455AAFD1FA11B4FB436B36393
SHA256:DA207DB111111BD0C937FB784C29A81D5306A251ADEF5D1DB094BDF01653835B
5384Clus-Blue.exeC:\ProgramData\Fidl\Clus-Blue.exeexecutable
MD5:20BC61AA222AA74059F4D42872A76EB5
SHA256:1CC7879C59BDD6C0FB2CE28C89BB4A626396CC1C3801BCEDE2679DA5A6D7D5BC
5384Clus-Blue.exeC:\ProgramData\Fidl\Framework.dllexecutable
MD5:2207332818329E3CE4E5E020BA1B1F04
SHA256:C554A0BD610BA0B10D8D92BB588FC86893B59985E4ED9316D340781C482FCAA2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
21
DNS requests
12
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.32.238.34:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
8064
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
8064
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.32.238.34:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6544
svchost.exe
40.126.31.67:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
—
—
172.211.123.250:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
FR
unknown
5496
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
6404
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5304
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.174
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.32.238.34
  • 2.19.198.194
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
nexusrules.officeapps.live.com
  • 52.111.236.21
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
da207db111111bd0c937fb784c29a81d5306a251adef5d1db094bdf01653835b.zip