File name:

b2ef1469-5957-493e-970a-9165851c180b (1).zip

Full analysis: https://app.any.run/tasks/444c4f6c-1917-4fdd-8cdd-707e5cf5196d
Verdict: Malicious activity
Analysis date: January 10, 2025, 18:44:03
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
python
pyinstaller
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

3817E2A273413E59E033F408AA5B0F0F

SHA1:

A4A08F36ACF4E778899692EB3EFDAC5230D3F303

SHA256:

3E7CEFC43E542908A112C5528114677FEE4E456F62EDFF488B676505F1F43B0D

SSDEEP:

98304:M+fBJZu8nZleFMVnb2MdYemTX0U38mRlJplE9WGexpeAtIOGtJJxs61YpZtKn7bF:tJnUe5FII4cb8nvUS6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 6480)

  • SUSPICIOUS

    • The process drops C-runtime libraries

      • SPOILER_ytzgen.exe (PID: 6152)
      • SPOILER_ytzgen.exe (PID: 4672)

    • Process drops python dynamic module

      • SPOILER_ytzgen.exe (PID: 4672)
      • SPOILER_ytzgen.exe (PID: 6152)

    • Process drops legitimate windows executable

      • SPOILER_ytzgen.exe (PID: 4672)
      • SPOILER_ytzgen.exe (PID: 6152)

    • Application launched itself

      • SPOILER_ytzgen.exe (PID: 6152)
      • SPOILER_ytzgen.exe (PID: 4672)

    • Loads Python modules

      • SPOILER_ytzgen.exe (PID: 5920)
      • SPOILER_ytzgen.exe (PID: 5460)

    • Executable content was dropped or overwritten

      • SPOILER_ytzgen.exe (PID: 4672)
      • SPOILER_ytzgen.exe (PID: 6152)

    • Starts CMD.EXE for commands execution

      • SPOILER_ytzgen.exe (PID: 5460)
      • SPOILER_ytzgen.exe (PID: 5920)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6480)

    • The sample compiled with english language support

      • SPOILER_ytzgen.exe (PID: 4672)
      • SPOILER_ytzgen.exe (PID: 6152)

    • Manual execution by a user

      • SPOILER_ytzgen.exe (PID: 4672)
      • SPOILER_ytzgen.exe (PID: 6152)

    • PyInstaller has been detected (YARA)

      • SPOILER_ytzgen.exe (PID: 6152)

    • Checks supported languages

      • SPOILER_ytzgen.exe (PID: 5460)

    • Create files in a temporary directory

      • SPOILER_ytzgen.exe (PID: 6152)
      • SPOILER_ytzgen.exe (PID: 4672)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2024:08:17 16:45:02
ZipCRC: 0x50fd3ec5
ZipCompressedSize: 6356471
ZipUncompressedSize: 6527008
ZipFileName: SPOILER_ytzgen.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
133
Monitored processes
9
Malicious processes
0
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe spoiler_ytzgen.exe conhost.exe no specs spoiler_ytzgen.exe no specs cmd.exe no specs spoiler_ytzgen.exe conhost.exe no specs spoiler_ytzgen.exe no specs cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2828\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SPOILER_ytzgen.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3420\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SPOILER_ytzgen.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4400C:\WINDOWS\system32\cmd.exe /c C:\Windows\System32\cmd.exe—SPOILER_ytzgen.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
4672"C:\Users\admin\Desktop\SPOILER_ytzgen.exe" C:\Users\admin\Desktop\SPOILER_ytzgen.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\spoiler_ytzgen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
5460"C:\Users\admin\Desktop\SPOILER_ytzgen.exe" C:\Users\admin\Desktop\SPOILER_ytzgen.exe—SPOILER_ytzgen.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\spoiler_ytzgen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\users\admin\appdata\local\temp\_mei46722\python310.dll
5920"C:\Users\admin\Desktop\SPOILER_ytzgen.exe" C:\Users\admin\Desktop\SPOILER_ytzgen.exe—SPOILER_ytzgen.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\spoiler_ytzgen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
6152"C:\Users\admin\Desktop\SPOILER_ytzgen.exe" C:\Users\admin\Desktop\SPOILER_ytzgen.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\spoiler_ytzgen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
6220C:\WINDOWS\system32\cmd.exe /c C:\Windows\System32\cmd.exe—SPOILER_ytzgen.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
6480"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\b2ef1469-5957-493e-970a-9165851c180b (1).zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
Total events
1 814
Read events
1 806
Write events
8
Delete events
0

Modification events

(PID) Process:(6480) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6480) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6480) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6480) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\b2ef1469-5957-493e-970a-9165851c180b (1).zip
(PID) Process:(6480) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6480) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6480) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6480) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
31
Suspicious files
2
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
6152SPOILER_ytzgen.exeC:\Users\admin\AppData\Local\Temp\_MEI61522\_ctypes.pydexecutable
MD5:3FC444A146F7D667169DCB4F48760F49
SHA256:B545DB2339AE74C523363B38835E8324799720F744C64E7142DDD48E4B619B68
6152SPOILER_ytzgen.exeC:\Users\admin\AppData\Local\Temp\_MEI61522\_lzma.pydexecutable
MD5:AFFF5DB126034438405DEBADB4B38F08
SHA256:75D450E973CD1CCBD0F9A35BA0D7E6D644125EB311CC432BB424A299D9A52EE0
6152SPOILER_ytzgen.exeC:\Users\admin\AppData\Local\Temp\_MEI61522\_bz2.pydexecutable
MD5:D61719BF7F3D7CDEBDF6C846C32DDACA
SHA256:31DD9BFB64B1BEE8FAF925296028E2AF907E6D933A83DDC570EBC82D11C43CFB
6152SPOILER_ytzgen.exeC:\Users\admin\AppData\Local\Temp\_MEI61522\_decimal.pydexecutable
MD5:8A2530A8D7E3B443D2A9409923EB1CBA
SHA256:4F1ECC777C30DF39CD70600CD0C9DC411ADB622AF86287B612F78BE2A23B352C
6480WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6480.46844\SPOILER_ytzgen.exeexecutable
MD5:CE6019D976A036B4D10664FCA449CF7F
SHA256:B43D0038293BE4D4EFD337AB9F925D0B6ED3FAE09DEA1A7AFE57D5FC4F5881D3
6152SPOILER_ytzgen.exeC:\Users\admin\AppData\Local\Temp\_MEI61522\libssl-1_1.dllexecutable
MD5:DE72697933D7673279FB85FD48D1A4DD
SHA256:ED1C8769F5096AFD000FC730A37B11177FCF90890345071AB7FBCEAC684D571F
6152SPOILER_ytzgen.exeC:\Users\admin\AppData\Local\Temp\_MEI61522\_queue.pydexecutable
MD5:C8A1F1DC297B6DD10C5F7BC64F907D38
SHA256:827A07B27121200ED9FB2E9EFD13CCBF57CA7D32D9D9D1619F1C303FB4D607B7
6152SPOILER_ytzgen.exeC:\Users\admin\AppData\Local\Temp\_MEI61522\_socket.pydexecutable
MD5:F59DDB8B1EEAC111D6A003F60E45B389
SHA256:9558DDA6A3F6AD0C3091D643E2D3BF5BF20535904F691D2BDB2CE78EDF46C2DA
6152SPOILER_ytzgen.exeC:\Users\admin\AppData\Local\Temp\_MEI61522\_ssl.pydexecutable
MD5:80F2475D92AD805439D92CBA6E657215
SHA256:41278E309382C79356C1A4DAF6DBB5819441D0C6E64981D031CDA077BB6F1F79
6152SPOILER_ytzgen.exeC:\Users\admin\AppData\Local\Temp\_MEI61522\libcrypto-1_1.dllexecutable
MD5:AB01C808BED8164133E5279595437D3D
SHA256:9C0A0A11629CCED6A064932E95A0158EE936739D75A56338702FED97CB0BAD55
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
30
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6352
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
6244
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6244
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4712
MoUsoCoreWorker.exe
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
—
—
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5064
SearchApp.exe
2.23.227.215:443
www.bing.com
Ooredoo Q.S.C.
QA
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
6068
svchost.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1176
svchost.exe
20.190.160.17:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1176
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 2.16.164.49
  • 2.16.164.72
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
google.com
  • 216.58.206.46
whitelisted
www.bing.com
  • 2.23.227.215
  • 2.23.227.208
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.160.17
  • 20.190.160.20
  • 20.190.160.14
  • 40.126.32.140
  • 40.126.32.72
  • 40.126.32.76
  • 40.126.32.138
  • 40.126.32.68
whitelisted
go.microsoft.com
  • 2.23.242.9
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
arc.msn.com
  • 20.223.36.55
whitelisted
fd.api.iris.microsoft.com
  • 20.199.58.43
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
b2ef1469-5957-493e-970a-9165851c180b (1).zip