File name:

b2ef1469-5957-493e-970a-9165851c180b (1).zip

Full analysis: https://app.any.run/tasks/444c4f6c-1917-4fdd-8cdd-707e5cf5196d
Verdict: Malicious activity
Analysis date: January 10, 2025, 18:44:03
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
python
pyinstaller
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

3817E2A273413E59E033F408AA5B0F0F

SHA1:

A4A08F36ACF4E778899692EB3EFDAC5230D3F303

SHA256:

3E7CEFC43E542908A112C5528114677FEE4E456F62EDFF488B676505F1F43B0D

SSDEEP:

98304:M+fBJZu8nZleFMVnb2MdYemTX0U38mRlJplE9WGexpeAtIOGtJJxs61YpZtKn7bF:tJnUe5FII4cb8nvUS6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 6480)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • SPOILER_ytzgen.exe (PID: 6152)
      • SPOILER_ytzgen.exe (PID: 4672)

    • Process drops legitimate windows executable

      • SPOILER_ytzgen.exe (PID: 6152)
      • SPOILER_ytzgen.exe (PID: 4672)

    • The process drops C-runtime libraries

      • SPOILER_ytzgen.exe (PID: 6152)
      • SPOILER_ytzgen.exe (PID: 4672)

    • Process drops python dynamic module

      • SPOILER_ytzgen.exe (PID: 6152)
      • SPOILER_ytzgen.exe (PID: 4672)

    • Application launched itself

      • SPOILER_ytzgen.exe (PID: 6152)
      • SPOILER_ytzgen.exe (PID: 4672)

    • Loads Python modules

      • SPOILER_ytzgen.exe (PID: 5920)
      • SPOILER_ytzgen.exe (PID: 5460)

    • Starts CMD.EXE for commands execution

      • SPOILER_ytzgen.exe (PID: 5920)
      • SPOILER_ytzgen.exe (PID: 5460)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6480)

    • Manual execution by a user

      • SPOILER_ytzgen.exe (PID: 6152)
      • SPOILER_ytzgen.exe (PID: 4672)

    • The sample compiled with english language support

      • SPOILER_ytzgen.exe (PID: 6152)
      • SPOILER_ytzgen.exe (PID: 4672)

    • PyInstaller has been detected (YARA)

      • SPOILER_ytzgen.exe (PID: 6152)

    • Create files in a temporary directory

      • SPOILER_ytzgen.exe (PID: 6152)
      • SPOILER_ytzgen.exe (PID: 4672)

    • Checks supported languages

      • SPOILER_ytzgen.exe (PID: 5460)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: SPOILER_ytzgen.exe
ZipUncompressedSize: 6527008
ZipCompressedSize: 6356471
ZipCRC: 0x50fd3ec5
ZipModifyDate: 2024:08:17 16:45:02
ZipCompression: Deflated
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
133
Monitored processes
9
Malicious processes
0
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe spoiler_ytzgen.exe conhost.exe no specs spoiler_ytzgen.exe no specs cmd.exe no specs spoiler_ytzgen.exe conhost.exe no specs spoiler_ytzgen.exe no specs cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
6480"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\b2ef1469-5957-493e-970a-9165851c180b (1).zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
6152"C:\Users\admin\Desktop\SPOILER_ytzgen.exe" C:\Users\admin\Desktop\SPOILER_ytzgen.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\spoiler_ytzgen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2828\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SPOILER_ytzgen.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5920"C:\Users\admin\Desktop\SPOILER_ytzgen.exe" C:\Users\admin\Desktop\SPOILER_ytzgen.exe—SPOILER_ytzgen.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\spoiler_ytzgen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
6220C:\WINDOWS\system32\cmd.exe /c C:\Windows\System32\cmd.exe—SPOILER_ytzgen.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
4672"C:\Users\admin\Desktop\SPOILER_ytzgen.exe" C:\Users\admin\Desktop\SPOILER_ytzgen.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\spoiler_ytzgen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
3420\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SPOILER_ytzgen.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5460"C:\Users\admin\Desktop\SPOILER_ytzgen.exe" C:\Users\admin\Desktop\SPOILER_ytzgen.exe—SPOILER_ytzgen.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\spoiler_ytzgen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\users\admin\appdata\local\temp\_mei46722\python310.dll
4400C:\WINDOWS\system32\cmd.exe /c C:\Windows\System32\cmd.exe—SPOILER_ytzgen.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
Total events
1 814
Read events
1 806
Write events
8
Delete events
0

Modification events

(PID) Process:(6480) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6480) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6480) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6480) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\b2ef1469-5957-493e-970a-9165851c180b (1).zip
(PID) Process:(6480) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6480) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6480) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6480) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
31
Suspicious files
2
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
6480WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6480.46844\SPOILER_ytzgen.exeexecutable
MD5:CE6019D976A036B4D10664FCA449CF7F
SHA256:B43D0038293BE4D4EFD337AB9F925D0B6ED3FAE09DEA1A7AFE57D5FC4F5881D3
6152SPOILER_ytzgen.exeC:\Users\admin\AppData\Local\Temp\_MEI61522\_queue.pydexecutable
MD5:C8A1F1DC297B6DD10C5F7BC64F907D38
SHA256:827A07B27121200ED9FB2E9EFD13CCBF57CA7D32D9D9D1619F1C303FB4D607B7
6152SPOILER_ytzgen.exeC:\Users\admin\AppData\Local\Temp\_MEI61522\_lzma.pydexecutable
MD5:AFFF5DB126034438405DEBADB4B38F08
SHA256:75D450E973CD1CCBD0F9A35BA0D7E6D644125EB311CC432BB424A299D9A52EE0
6152SPOILER_ytzgen.exeC:\Users\admin\AppData\Local\Temp\_MEI61522\_hashlib.pydexecutable
MD5:0D75220CF4691AF4F97EBCBD9A481C62
SHA256:9DA79ABFED52C7432A25A513F14134F3782C73EC7142E2D90223610EAEF54303
6152SPOILER_ytzgen.exeC:\Users\admin\AppData\Local\Temp\_MEI61522\libcrypto-1_1.dllexecutable
MD5:AB01C808BED8164133E5279595437D3D
SHA256:9C0A0A11629CCED6A064932E95A0158EE936739D75A56338702FED97CB0BAD55
6152SPOILER_ytzgen.exeC:\Users\admin\AppData\Local\Temp\_MEI61522\_ssl.pydexecutable
MD5:80F2475D92AD805439D92CBA6E657215
SHA256:41278E309382C79356C1A4DAF6DBB5819441D0C6E64981D031CDA077BB6F1F79
4672SPOILER_ytzgen.exeC:\Users\admin\AppData\Local\Temp\_MEI46722\_bz2.pydexecutable
MD5:D61719BF7F3D7CDEBDF6C846C32DDACA
SHA256:31DD9BFB64B1BEE8FAF925296028E2AF907E6D933A83DDC570EBC82D11C43CFB
6152SPOILER_ytzgen.exeC:\Users\admin\AppData\Local\Temp\_MEI61522\unicodedata.pydexecutable
MD5:C01A5CE36DD1C822749D8ADE8A5E68CA
SHA256:0F27F26D1FAA4F76D4B9D79AD572A3D4F3BBE8020E2208D2F3B9046E815B578A
6152SPOILER_ytzgen.exeC:\Users\admin\AppData\Local\Temp\_MEI61522\certifi\cacert.pemtext
MD5:B18E918767D99291F8771414B76A8E65
SHA256:A59FDE883A0EF9D74AB9DAD009689E00173D28595B57416C98B2EE83280C6E4C
6152SPOILER_ytzgen.exeC:\Users\admin\AppData\Local\Temp\_MEI61522\VCRUNTIME140.dllexecutable
MD5:F34EB034AA4A9735218686590CBA2E8B
SHA256:9D2B40F0395CC5D1B4D5EA17B84970C29971D448C37104676DB577586D4AD1B1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
30
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6352
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6244
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6244
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4712
MoUsoCoreWorker.exe
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
—
—
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5064
SearchApp.exe
2.23.227.215:443
www.bing.com
Ooredoo Q.S.C.
QA
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
6068
svchost.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1176
svchost.exe
20.190.160.17:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1176
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 2.16.164.49
  • 2.16.164.72
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
google.com
  • 216.58.206.46
whitelisted
www.bing.com
  • 2.23.227.215
  • 2.23.227.208
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.160.17
  • 20.190.160.20
  • 20.190.160.14
  • 40.126.32.140
  • 40.126.32.72
  • 40.126.32.76
  • 40.126.32.138
  • 40.126.32.68
whitelisted
go.microsoft.com
  • 2.23.242.9
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
arc.msn.com
  • 20.223.36.55
whitelisted
fd.api.iris.microsoft.com
  • 20.199.58.43
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
b2ef1469-5957-493e-970a-9165851c180b (1).zip