File name:

b2ef1469-5957-493e-970a-9165851c180b (1).zip

Full analysis: https://app.any.run/tasks/444c4f6c-1917-4fdd-8cdd-707e5cf5196d
Verdict: Malicious activity
Analysis date: January 10, 2025, 18:44:03
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
python
pyinstaller
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

3817E2A273413E59E033F408AA5B0F0F

SHA1:

A4A08F36ACF4E778899692EB3EFDAC5230D3F303

SHA256:

3E7CEFC43E542908A112C5528114677FEE4E456F62EDFF488B676505F1F43B0D

SSDEEP:

98304:M+fBJZu8nZleFMVnb2MdYemTX0U38mRlJplE9WGexpeAtIOGtJJxs61YpZtKn7bF:tJnUe5FII4cb8nvUS6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 6480)

  • SUSPICIOUS

    • The process drops C-runtime libraries

      • SPOILER_ytzgen.exe (PID: 6152)
      • SPOILER_ytzgen.exe (PID: 4672)

    • Process drops legitimate windows executable

      • SPOILER_ytzgen.exe (PID: 6152)
      • SPOILER_ytzgen.exe (PID: 4672)

    • Process drops python dynamic module

      • SPOILER_ytzgen.exe (PID: 4672)
      • SPOILER_ytzgen.exe (PID: 6152)

    • Loads Python modules

      • SPOILER_ytzgen.exe (PID: 5920)
      • SPOILER_ytzgen.exe (PID: 5460)

    • Starts CMD.EXE for commands execution

      • SPOILER_ytzgen.exe (PID: 5920)
      • SPOILER_ytzgen.exe (PID: 5460)

    • Application launched itself

      • SPOILER_ytzgen.exe (PID: 6152)
      • SPOILER_ytzgen.exe (PID: 4672)

    • Executable content was dropped or overwritten

      • SPOILER_ytzgen.exe (PID: 6152)
      • SPOILER_ytzgen.exe (PID: 4672)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6480)

    • PyInstaller has been detected (YARA)

      • SPOILER_ytzgen.exe (PID: 6152)

    • Manual execution by a user

      • SPOILER_ytzgen.exe (PID: 4672)
      • SPOILER_ytzgen.exe (PID: 6152)

    • The sample compiled with english language support

      • SPOILER_ytzgen.exe (PID: 6152)
      • SPOILER_ytzgen.exe (PID: 4672)

    • Create files in a temporary directory

      • SPOILER_ytzgen.exe (PID: 6152)
      • SPOILER_ytzgen.exe (PID: 4672)

    • Checks supported languages

      • SPOILER_ytzgen.exe (PID: 5460)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2024:08:17 16:45:02
ZipCRC: 0x50fd3ec5
ZipCompressedSize: 6356471
ZipUncompressedSize: 6527008
ZipFileName: SPOILER_ytzgen.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
133
Monitored processes
9
Malicious processes
0
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe spoiler_ytzgen.exe conhost.exe no specs spoiler_ytzgen.exe no specs cmd.exe no specs spoiler_ytzgen.exe conhost.exe no specs spoiler_ytzgen.exe no specs cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
6480"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\b2ef1469-5957-493e-970a-9165851c180b (1).zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
6152"C:\Users\admin\Desktop\SPOILER_ytzgen.exe" C:\Users\admin\Desktop\SPOILER_ytzgen.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\spoiler_ytzgen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2828\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SPOILER_ytzgen.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5920"C:\Users\admin\Desktop\SPOILER_ytzgen.exe" C:\Users\admin\Desktop\SPOILER_ytzgen.exe—SPOILER_ytzgen.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\spoiler_ytzgen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
6220C:\WINDOWS\system32\cmd.exe /c C:\Windows\System32\cmd.exe—SPOILER_ytzgen.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
4672"C:\Users\admin\Desktop\SPOILER_ytzgen.exe" C:\Users\admin\Desktop\SPOILER_ytzgen.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\spoiler_ytzgen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
3420\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SPOILER_ytzgen.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5460"C:\Users\admin\Desktop\SPOILER_ytzgen.exe" C:\Users\admin\Desktop\SPOILER_ytzgen.exe—SPOILER_ytzgen.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\spoiler_ytzgen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\users\admin\appdata\local\temp\_mei46722\python310.dll
4400C:\WINDOWS\system32\cmd.exe /c C:\Windows\System32\cmd.exe—SPOILER_ytzgen.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
Total events
1 814
Read events
1 806
Write events
8
Delete events
0

Modification events

(PID) Process:(6480) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6480) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6480) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6480) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\b2ef1469-5957-493e-970a-9165851c180b (1).zip
(PID) Process:(6480) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6480) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6480) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6480) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
31
Suspicious files
2
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
6152SPOILER_ytzgen.exeC:\Users\admin\AppData\Local\Temp\_MEI61522\VCRUNTIME140.dllexecutable
MD5:F34EB034AA4A9735218686590CBA2E8B
SHA256:9D2B40F0395CC5D1B4D5EA17B84970C29971D448C37104676DB577586D4AD1B1
4672SPOILER_ytzgen.exeC:\Users\admin\AppData\Local\Temp\_MEI46722\VCRUNTIME140.dllexecutable
MD5:F34EB034AA4A9735218686590CBA2E8B
SHA256:9D2B40F0395CC5D1B4D5EA17B84970C29971D448C37104676DB577586D4AD1B1
6152SPOILER_ytzgen.exeC:\Users\admin\AppData\Local\Temp\_MEI61522\_decimal.pydexecutable
MD5:8A2530A8D7E3B443D2A9409923EB1CBA
SHA256:4F1ECC777C30DF39CD70600CD0C9DC411ADB622AF86287B612F78BE2A23B352C
6152SPOILER_ytzgen.exeC:\Users\admin\AppData\Local\Temp\_MEI61522\libffi-7.dllexecutable
MD5:EEF7981412BE8EA459064D3090F4B3AA
SHA256:F60DD9F2FCBD495674DFC1555EFFB710EB081FC7D4CAE5FA58C438AB50405081
6152SPOILER_ytzgen.exeC:\Users\admin\AppData\Local\Temp\_MEI61522\_bz2.pydexecutable
MD5:D61719BF7F3D7CDEBDF6C846C32DDACA
SHA256:31DD9BFB64B1BEE8FAF925296028E2AF907E6D933A83DDC570EBC82D11C43CFB
6152SPOILER_ytzgen.exeC:\Users\admin\AppData\Local\Temp\_MEI61522\_ssl.pydexecutable
MD5:80F2475D92AD805439D92CBA6E657215
SHA256:41278E309382C79356C1A4DAF6DBB5819441D0C6E64981D031CDA077BB6F1F79
6152SPOILER_ytzgen.exeC:\Users\admin\AppData\Local\Temp\_MEI61522\_hashlib.pydexecutable
MD5:0D75220CF4691AF4F97EBCBD9A481C62
SHA256:9DA79ABFED52C7432A25A513F14134F3782C73EC7142E2D90223610EAEF54303
6152SPOILER_ytzgen.exeC:\Users\admin\AppData\Local\Temp\_MEI61522\_lzma.pydexecutable
MD5:AFFF5DB126034438405DEBADB4B38F08
SHA256:75D450E973CD1CCBD0F9A35BA0D7E6D644125EB311CC432BB424A299D9A52EE0
4672SPOILER_ytzgen.exeC:\Users\admin\AppData\Local\Temp\_MEI46722\_bz2.pydexecutable
MD5:D61719BF7F3D7CDEBDF6C846C32DDACA
SHA256:31DD9BFB64B1BEE8FAF925296028E2AF907E6D933A83DDC570EBC82D11C43CFB
6152SPOILER_ytzgen.exeC:\Users\admin\AppData\Local\Temp\_MEI61522\_socket.pydexecutable
MD5:F59DDB8B1EEAC111D6A003F60E45B389
SHA256:9558DDA6A3F6AD0C3091D643E2D3BF5BF20535904F691D2BDB2CE78EDF46C2DA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
30
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6244
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6244
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6352
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4712
MoUsoCoreWorker.exe
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
—
—
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5064
SearchApp.exe
2.23.227.215:443
www.bing.com
Ooredoo Q.S.C.
QA
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
6068
svchost.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1176
svchost.exe
20.190.160.17:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1176
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 2.16.164.49
  • 2.16.164.72
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
google.com
  • 216.58.206.46
whitelisted
www.bing.com
  • 2.23.227.215
  • 2.23.227.208
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.160.17
  • 20.190.160.20
  • 20.190.160.14
  • 40.126.32.140
  • 40.126.32.72
  • 40.126.32.76
  • 40.126.32.138
  • 40.126.32.68
whitelisted
go.microsoft.com
  • 2.23.242.9
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
arc.msn.com
  • 20.223.36.55
whitelisted
fd.api.iris.microsoft.com
  • 20.199.58.43
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
b2ef1469-5957-493e-970a-9165851c180b (1).zip