File name:

hwid pack.zip

Full analysis: https://app.any.run/tasks/59affc4e-86c1-4861-8b8a-6c93c17606db
Verdict: Malicious activity
Analysis date: January 20, 2024, 00:01:35
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

734C14A94F1778E506606804D3566594

SHA1:

8CBD6A9C512EDAAB288A0FD24C7C2D7D71C3999D

SHA256:

41CAEB1DAB6AB9DA4571B88CD0A0A2B3A21CE305909358E538A04F988D4A139F

SSDEEP:

196608:ELlI5+lEzBGc3CqWeo/X/Mbw4+OPexK4Ux:GNYBG1DXQwXBBq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 2036)
      • MacSetup.exe (PID: 956)

    • Creates a writable file in the system directory

      • MacSetup.exe (PID: 956)

    • Registers / Runs the DLL via REGSVR32.EXE

      • MacSetup.exe (PID: 956)

  • SUSPICIOUS

    • Drops a system driver (possible attempt to evade defenses)

      • WinRAR.exe (PID: 2036)

    • Process drops legitimate windows executable

      • MacSetup.exe (PID: 956)

    • Executable content was dropped or overwritten

      • MacSetup.exe (PID: 956)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2036)

    • Checks supported languages

      • HardDisk.exe (PID: 548)
      • MacSetup.exe (PID: 956)
      • AMIDEWIN.EXE (PID: 2836)
      • AMIDEWIN.EXE (PID: 952)

    • Manual execution by a user

      • HardDisk.exe (PID: 548)
      • MacSetup.exe (PID: 1040)
      • MacSetup.exe (PID: 956)
      • notepad.exe (PID: 2908)
      • AMIDEWIN.EXE (PID: 2836)
      • AMIDEWIN.EXE (PID: 952)

    • Reads the machine GUID from the registry

      • MacSetup.exe (PID: 956)

    • Create files in a temporary directory

      • MacSetup.exe (PID: 956)

    • Reads Microsoft Office registry keys

      • MacSetup.exe (PID: 956)

    • Reads mouse settings

      • MacSetup.exe (PID: 956)

    • Reads the computer name

      • MacSetup.exe (PID: 956)

    • Creates files in the program directory

      • MacSetup.exe (PID: 956)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2023:07:11 19:49:08
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: hwid pack/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
52
Monitored processes
10
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe harddisk.exe no specs macsetup.exe no specs macsetup.exe regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs notepad.exe no specs amidewin.exe no specs amidewin.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
548"C:\Users\admin\Desktop\hwid pack\HardDisk.exe" C:\Users\admin\Desktop\hwid pack\HardDisk.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\hwid pack\harddisk.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
844regsvr32 /s "C:\Windows\system32\MSCHRT20.OCX"C:\Windows\System32\regsvr32.exe—MacSetup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
952"C:\Users\admin\Desktop\hwid pack\serial changer\AMIDEWIN.EXE" C:\Users\admin\Desktop\hwid pack\serial changer\AMIDEWIN.EXE—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\hwid pack\serial changer\amidewin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
956"C:\Users\admin\Desktop\hwid pack\MacSetup.exe" C:\Users\admin\Desktop\hwid pack\MacSetup.exe
explorer.exe
User:
admin
Company:
Technitium
Integrity Level:
HIGH
Description:
Technitium Installer v4.4
Exit code:
0
Version:
4.04
Modules
Images
c:\users\admin\desktop\hwid pack\macsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1040"C:\Users\admin\Desktop\hwid pack\MacSetup.exe" C:\Users\admin\Desktop\hwid pack\MacSetup.exe—explorer.exe
User:
admin
Company:
Technitium
Integrity Level:
MEDIUM
Description:
Technitium Installer v4.4
Exit code:
3221226540
Version:
4.04
Modules
Images
c:\users\admin\desktop\hwid pack\macsetup.exe
c:\windows\system32\ntdll.dll
1736regsvr32 /s "C:\Windows\system32\TABCTL32.OCX"C:\Windows\System32\regsvr32.exe—MacSetup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1792regsvr32 /s "C:\Windows\system32\COMDLG32.OCX"C:\Windows\System32\regsvr32.exe—MacSetup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2036"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\hwid pack.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2836"C:\Users\admin\Desktop\hwid pack\serial changer\AMIDEWIN.EXE" C:\Users\admin\Desktop\hwid pack\serial changer\AMIDEWIN.EXE—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\hwid pack\serial changer\amidewin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2908"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\hwid pack\usb device serial\readme.txtC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
1 844
Read events
1 816
Write events
11
Delete events
17

Modification events

(PID) Process:(2036) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2036) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2036) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(2036) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2036) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(2036) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2036) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2036) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2036) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1792) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F9043C85-F6F2-101A-A3C9-08002B2F49FB}
Operation:delete keyName:(default)
Value:
Executable files
24
Suspicious files
16
Text files
60
Unknown types
0

Dropped files

PID
Process
Filename
Type
2036WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2036.39322\hwid pack\monitor serial\restart64.exeexecutable
MD5:297AA19BADE534A791D053CA190B74AD
SHA256:5F779BB822AEDAF5BD11693CDF73F6C7C3342F37371A78C07C2ACA1E15DBFD00
2036WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2036.39322\hwid pack\monitor serial\Info.txttext
MD5:DF95ACFBA3051D021EC94E47726BBD07
SHA256:61350CE9D700627A156845DFEE77C44703280B16FD30BC1C216BFFC1CC82C0A1
2036WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2036.39322\hwid pack\MacSetup.exeexecutable
MD5:A7C8CF1D50EBE630A7D0C47686A0ABBF
SHA256:A453B3EA8D8133531FAD26B18701C694C324CC201E3069D07E99F0E100908C1A
2036WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2036.39322\hwid pack\serial changer\AMIDEWIN.EXEexecutable
MD5:182EC3A59BD847FB1BC3E12A41D48FA6
SHA256:948DBD2BC128F8DC08267E110020FEE3FF5DE17CF4AAEF89372DE29623AF96FA
2036WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2036.39322\hwid pack\serial changer\AMIDEWINx64.EXEexecutable
MD5:6A6505B2413D2C7B16C6D059448DB9E5
SHA256:53E3B72F8EB13ACF3CB69D4CB124E8DC64FC541555C3C95CC8003B8046853955
2036WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2036.39322\hwid pack\serial changer\DMI16.EXEexecutable
MD5:2A89D4E479351022AB8BD604030A76F3
SHA256:28E6E1908F2996AF9B7A9930F13D4C770D6963425DF0869CE4BCDB1442A4A917
2036WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2036.39322\hwid pack\serial changer\UCOREDLL.DLLexecutable
MD5:8370F3114924ED6C53741DE7A253625A
SHA256:78A4D8E5E8C33793E5A2020325D3A49E92E4826167742E93179BDACBF167B409
2036WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2036.39322\hwid pack\serial changer\amifldrv64.sysexecutable
MD5:785045F8B25CD2E937DDC6B09DEBE01A
SHA256:37073E42FFA0322500F90CD7E3C8D02C4CDD695D31C77E81560ABEC20BFB68BA
2036WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2036.39322\hwid pack\serial changer\DMIEDIT.EXEexecutable
MD5:FBAF6262FD84F9966338518D4DE46FDD
SHA256:5D37E5E7CE01549965BF2166ADCBA33D1E2C4BD2C90711032F3987B58452CE49
2036WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2036.39322\hwid pack\monitor serial\restart.exeexecutable
MD5:8242CE426AD462EFF02EDAE1487A6949
SHA256:B68EE265308DC9DA7DBB521BB71238D27AC50A5EE816F21C13818393BE982D7A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
hwid pack.zip