File name:

hwid pack.zip

Full analysis: https://app.any.run/tasks/59affc4e-86c1-4861-8b8a-6c93c17606db
Verdict: Malicious activity
Analysis date: January 20, 2024, 00:01:35
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

734C14A94F1778E506606804D3566594

SHA1:

8CBD6A9C512EDAAB288A0FD24C7C2D7D71C3999D

SHA256:

41CAEB1DAB6AB9DA4571B88CD0A0A2B3A21CE305909358E538A04F988D4A139F

SSDEEP:

196608:ELlI5+lEzBGc3CqWeo/X/Mbw4+OPexK4Ux:GNYBG1DXQwXBBq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • MacSetup.exe (PID: 956)
      • WinRAR.exe (PID: 2036)

    • Registers / Runs the DLL via REGSVR32.EXE

      • MacSetup.exe (PID: 956)

    • Creates a writable file in the system directory

      • MacSetup.exe (PID: 956)

  • SUSPICIOUS

    • Drops a system driver (possible attempt to evade defenses)

      • WinRAR.exe (PID: 2036)

    • Executable content was dropped or overwritten

      • MacSetup.exe (PID: 956)

    • Process drops legitimate windows executable

      • MacSetup.exe (PID: 956)

  • INFO

    • Manual execution by a user

      • MacSetup.exe (PID: 956)
      • HardDisk.exe (PID: 548)
      • MacSetup.exe (PID: 1040)
      • notepad.exe (PID: 2908)
      • AMIDEWIN.EXE (PID: 2836)
      • AMIDEWIN.EXE (PID: 952)

    • Reads the machine GUID from the registry

      • MacSetup.exe (PID: 956)

    • Create files in a temporary directory

      • MacSetup.exe (PID: 956)

    • Checks supported languages

      • MacSetup.exe (PID: 956)
      • HardDisk.exe (PID: 548)
      • AMIDEWIN.EXE (PID: 952)
      • AMIDEWIN.EXE (PID: 2836)

    • Reads mouse settings

      • MacSetup.exe (PID: 956)

    • Reads Microsoft Office registry keys

      • MacSetup.exe (PID: 956)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2036)

    • Reads the computer name

      • MacSetup.exe (PID: 956)

    • Creates files in the program directory

      • MacSetup.exe (PID: 956)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2023:07:11 19:49:08
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: hwid pack/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
52
Monitored processes
10
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe harddisk.exe no specs macsetup.exe no specs macsetup.exe regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs notepad.exe no specs amidewin.exe no specs amidewin.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
548"C:\Users\admin\Desktop\hwid pack\HardDisk.exe" C:\Users\admin\Desktop\hwid pack\HardDisk.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\hwid pack\harddisk.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
844regsvr32 /s "C:\Windows\system32\MSCHRT20.OCX"C:\Windows\System32\regsvr32.exe—MacSetup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
952"C:\Users\admin\Desktop\hwid pack\serial changer\AMIDEWIN.EXE" C:\Users\admin\Desktop\hwid pack\serial changer\AMIDEWIN.EXE—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\hwid pack\serial changer\amidewin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
956"C:\Users\admin\Desktop\hwid pack\MacSetup.exe" C:\Users\admin\Desktop\hwid pack\MacSetup.exe
explorer.exe
User:
admin
Company:
Technitium
Integrity Level:
HIGH
Description:
Technitium Installer v4.4
Exit code:
0
Version:
4.04
Modules
Images
c:\users\admin\desktop\hwid pack\macsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1040"C:\Users\admin\Desktop\hwid pack\MacSetup.exe" C:\Users\admin\Desktop\hwid pack\MacSetup.exe—explorer.exe
User:
admin
Company:
Technitium
Integrity Level:
MEDIUM
Description:
Technitium Installer v4.4
Exit code:
3221226540
Version:
4.04
Modules
Images
c:\users\admin\desktop\hwid pack\macsetup.exe
c:\windows\system32\ntdll.dll
1736regsvr32 /s "C:\Windows\system32\TABCTL32.OCX"C:\Windows\System32\regsvr32.exe—MacSetup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1792regsvr32 /s "C:\Windows\system32\COMDLG32.OCX"C:\Windows\System32\regsvr32.exe—MacSetup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2036"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\hwid pack.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2836"C:\Users\admin\Desktop\hwid pack\serial changer\AMIDEWIN.EXE" C:\Users\admin\Desktop\hwid pack\serial changer\AMIDEWIN.EXE—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\hwid pack\serial changer\amidewin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2908"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\hwid pack\usb device serial\readme.txtC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
1 844
Read events
1 816
Write events
11
Delete events
17

Modification events

(PID) Process:(2036) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2036) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2036) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(2036) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2036) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(2036) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2036) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2036) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2036) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1792) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F9043C85-F6F2-101A-A3C9-08002B2F49FB}
Operation:delete keyName:(default)
Value:
Executable files
24
Suspicious files
16
Text files
60
Unknown types
0

Dropped files

PID
Process
Filename
Type
2036WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2036.39322\hwid pack\monitor serial\Info.txttext
MD5:DF95ACFBA3051D021EC94E47726BBD07
SHA256:61350CE9D700627A156845DFEE77C44703280B16FD30BC1C216BFFC1CC82C0A1
2036WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2036.39322\hwid pack\serial changer\amifldrv64.sysexecutable
MD5:785045F8B25CD2E937DDC6B09DEBE01A
SHA256:37073E42FFA0322500F90CD7E3C8D02C4CDD695D31C77E81560ABEC20BFB68BA
2036WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2036.39322\hwid pack\monitor serial\restart.exeexecutable
MD5:8242CE426AD462EFF02EDAE1487A6949
SHA256:B68EE265308DC9DA7DBB521BB71238D27AC50A5EE816F21C13818393BE982D7A
2036WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2036.39322\hwid pack\monitor serial\reset-all.exeexecutable
MD5:3D47586C62BF61DAC639D8CC1BF43EE7
SHA256:70639C195430AFB92799D711ED784406BFDFD04C648D5F3E4D9873DA0063660B
2036WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2036.39322\hwid pack\serial changer\README.txttext
MD5:0E28E605E0988892043002E8D6FA719B
SHA256:1541F150F12295D926578FC8920F2F398D046BDDA66BC3026BF2533BBA07666B
2036WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2036.39322\hwid pack\HardDisk.exeexecutable
MD5:C20E96D4E616CE333C19A1C15A1CC137
SHA256:2C141C06F7DF57F11EF2C62F2A96093484A65DF47065B1A475C53784AF0E2664
2036WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2036.39322\hwid pack\serial changer\UCORESYS.SYSexecutable
MD5:9555D36FB21B993E5C4B98C2FC2B3671
SHA256:FD6F56189CD723B32FC06392867FCD5128E63D8B5801E4F7A83523F820531981
2036WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2036.39322\hwid pack\uninstall\lang\arabic.initext
MD5:6371CB8DF44E5227A0038E79EA7719E9
SHA256:E434E5A76D2937EE9D05281454A51741C886AF67D04601D3B7145FE0134E75BF
2036WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2036.39322\hwid pack\MacSetup.exeexecutable
MD5:A7C8CF1D50EBE630A7D0C47686A0ABBF
SHA256:A453B3EA8D8133531FAD26B18701C694C324CC201E3069D07E99F0E100908C1A
2036WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2036.39322\hwid pack\serial changer\UCOREDLL.DLLexecutable
MD5:8370F3114924ED6C53741DE7A253625A
SHA256:78A4D8E5E8C33793E5A2020325D3A49E92E4826167742E93179BDACBF167B409
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
hwid pack.zip