File name:

EA DLC Unlocker v2.7z

Full analysis: https://app.any.run/tasks/373de52b-61f9-4d62-bf25-b473e7d8880f
Verdict: Malicious activity
Analysis date: March 13, 2024, 10:40:55
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

9261761138CE9E19EC9CBF11B5EC9A71

SHA1:

492D3F8429D56B22785540485EC8D4069546514D

SHA256:

3F8034B5146391C534CD739B40A9A5ABC08351C3782538F3E9F3946A70EDC997

SSDEEP:

6144:3UHSRfbF7PCvlwLp5VIboCdX7i2+mVVE9t6eGloa:EH4fBPSlwfqbr9hVq0floa

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3668)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 3668)

    • Starts CMD.EXE for commands execution

      • WinRAR.exe (PID: 3668)
      • cmd.exe (PID: 3664)
      • cmd.exe (PID: 3664)
      • cmd.exe (PID: 3068)

    • Start notepad (likely ransomware note)

      • WinRAR.exe (PID: 3668)

    • Executing commands from a ".bat" file

      • WinRAR.exe (PID: 3668)

    • Application launched itself

      • cmd.exe (PID: 3664)
      • cmd.exe (PID: 3664)
      • cmd.exe (PID: 3068)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 3664)
      • cmd.exe (PID: 3068)
      • cmd.exe (PID: 3664)

    • Possibly malicious use of IEX has been detected

      • cmd.exe (PID: 3068)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 3068)

    • The process bypasses the loading of PowerShell profile settings

      • cmd.exe (PID: 3068)

  • INFO

    • Manual execution by a user

      • explorer.exe (PID: 2328)
      • WinRAR.exe (PID: 4012)
      • explorer.exe (PID: 680)
      • cmd.exe (PID: 3068)
      • cmd.exe (PID: 3664)
      • wmpnscfg.exe (PID: 712)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 4012)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 4012)

    • Checks supported languages

      • wmpnscfg.exe (PID: 712)

    • Reads the computer name

      • wmpnscfg.exe (PID: 712)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
73
Monitored processes
28
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe no specs notepad.exe no specs cmd.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs findstr.exe no specs cmd.exe no specs explorer.exe no specs explorer.exe no specs winrar.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs cmd.exe no specs findstr.exe no specs powershell.exe no specs wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
680"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
712"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1040C:\Windows\system32\cmd.exe /S /D /c" echo "C:\Users\admin\AppData\Local\Temp\EA DLC Unlocker v2\EA DLC Unlocker v2\" "C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1236findstr /C:"polo" C:\Windows\System32\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
1340powershell -noprofile "$_PSCommandPath = [Environment]::GetEnvironmentVariable('script_path', 'Process'); iex ((Get-Content -LiteralPath $_PSCommandPath) | out-string)"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
1844C:\Windows\system32\cmd.exe /S /D /c" echo "C:\Users\admin\Desktop\EA DLC Unlocker v2\" "C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2160findstr /V /C:"polo" C:\Windows\System32\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
2240findstr /V /C:"polo" C:\Windows\System32\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
2260findstr /V /C:"C:\Users\admin\AppData\Local\Temp" C:\Windows\System32\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
2328"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
9 637
Read events
9 596
Write events
41
Delete events
0

Modification events

(PID) Process:(3668) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3668) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3668) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3668) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3668) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3668) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(3668) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\EA DLC Unlocker v2.7z
(PID) Process:(3668) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3668) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3668) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
2
Suspicious files
2
Text files
24
Unknown types
1

Dropped files

PID
Process
Filename
Type
4012WinRAR.exeC:\Users\admin\AppData\Local\Temp\EA DLC Unlocker v2\EA DLC Unlocker v2\g_Dead Space 2023.initext
MD5:FC3F0C4D744A4310C775B2879399C468
SHA256:934211FE00D6151381796B7001D7AEF5BC883DAA9F1B1F68AF60A7AF93EB1835
3668WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa3668.45761\setup.battext
MD5:C6AB61944278E9498B1039722EB22BE1
SHA256:3717B38F792B68E4B8A0AFCEF29B58B2EB5D3BD4DF334217C185E2EF0E35AACC
3668WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa3668.45386\readme.txttext
MD5:40777E23043D467158E03BFDDF4FCD3E
SHA256:CEC5779E88C60EA8682029B47B3C992E9C4824653D53115BE09044F9BC7684CC
4012WinRAR.exeC:\Users\admin\AppData\Local\Temp\EA DLC Unlocker v2\EA DLC Unlocker v2\g_Dead Space 3.initext
MD5:19F5DEDA4368C463D16687109ABF543D
SHA256:8996053E41CE56F0822A2A3E9449F3960FF1D395C6587ACDDB608AB306A3E6EE
4012WinRAR.exeC:\Users\admin\AppData\Local\Temp\EA DLC Unlocker v2\EA DLC Unlocker v2\g_Need For Speed Heat.initext
MD5:C11C8268AA87FD021F691D4AE9529CCB
SHA256:FDA16758BDF3AA61BAA0B598BD419F1DAE695787D8F8DD9DA8FEA4629BF041D2
4012WinRAR.exeC:\Users\admin\AppData\Local\Temp\EA DLC Unlocker v2\EA DLC Unlocker v2\config.iniini
MD5:14CF4A3CE6A5F39790B2678EE0B0CFA0
SHA256:94699C9C6106C6C737820472E102B6D762A0268801DADB9C0E0272DB7D5ED3BF
4012WinRAR.exeC:\Users\admin\AppData\Local\Temp\EA DLC Unlocker v2\EA DLC Unlocker v2\g_My Time at Portia.initext
MD5:EDE7B7058E8C95575EF5517D36784FE2
SHA256:D7812CD7633CBC13521C9D7A862541EB13A93A8F42D1E56137D4BE8D7225F90A
4012WinRAR.exeC:\Users\admin\AppData\Local\Temp\EA DLC Unlocker v2\EA DLC Unlocker v2\g_F1 22.initext
MD5:FECE8042278EFC32B3F32A4109ADB50C
SHA256:F0435DC6ECF94DFCFE718EAC51293924617B7377C11DF5A9747EF60E83791F1D
4012WinRAR.exeC:\Users\admin\AppData\Local\Temp\EA DLC Unlocker v2\EA DLC Unlocker v2\g_Need For Speed Unbound.initext
MD5:46F6B4EE5074F335C8D9A42B9A2F2666
SHA256:41BA1AD959F94213E70F0AB58FF97D35A81BB1B9795926BEE9284D2BCAAFB7FA
4012WinRAR.exeC:\Users\admin\AppData\Local\Temp\EA DLC Unlocker v2\EA DLC Unlocker v2\g_Need For Speed Most Wanted.initext
MD5:53020D0FF8E79EE8305061D5D3964927
SHA256:070AC609263921F4C91061F8C8DDD78A3305038EC3F13F4FE265AE715F2C0B89
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
EA DLC Unlocker v2.7z