| File name: | Site-Hunter.zip |
| Full analysis: | https://app.any.run/tasks/34c5cff2-66d5-486a-9886-cf146dd22c13 |
| Verdict: | Malicious activity |
| Threats: | Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security. |
| Analysis date: | March 11, 2025, 21:26:09 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v1.0 to extract, compression method=store |
| MD5: | 4345CC36B16907DC26DEF09AC37A7621 |
| SHA1: | 8A7F3B4E435AA37AEC1D23475A0636DC05A113D1 |
| SHA256: | 4A1B9093CD2DE94DDCE04F6534ACD0C78DBD79876F66F7E1313A78A8440DC741 |
| SSDEEP: | 98304:exVyC590+qgCFJ/Jn8Ln0tmoYRfxifMnPl61tYnAMV/:w |
MALICIOUS
Create files in the Startup directory
- Site Hunter.exe (PID: 7896)
SUSPICIOUS
Reads security settings of Internet Explorer
- WinRAR.exe (PID: 6244)
Executable content was dropped or overwritten
- Site Hunter.exe (PID: 7896)
Generic archive extractor
- WinRAR.exe (PID: 6244)
Access to an unwanted program domain was detected
- wupdater.exe (PID: 8004)
Starts application with an unusual extension
- Site Hunter.exe (PID: 7896)
INFO
Executable content was dropped or overwritten
- WinRAR.exe (PID: 6244)
The sample compiled with english language support
- Site Hunter.exe (PID: 7896)
- WinRAR.exe (PID: 6244)
Creates files or folders in the user directory
- Site Hunter.exe (PID: 7896)
- BackgroundTransferHost.exe (PID: 5512)
Checks supported languages
- wscsvc.exe (PID: 7984)
- Site Hunter.exe (PID: 7896)
- lib.cfg (PID: 7992)
- wupdater.exe (PID: 8004)
Reads the computer name
- lib.cfg (PID: 7992)
- wupdater.exe (PID: 8004)
Reads the software policy settings
- wupdater.exe (PID: 8004)
Reads the machine GUID from the registry
- lib.cfg (PID: 7992)
Create files in a temporary directory
- lib.cfg (PID: 7992)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .zip | | | ZIP compressed archive (100) |
|---|
EXIF
ZIP
| ZipRequiredVersion: | 10 |
|---|---|
| ZipBitFlag: | - |
| ZipCompression: | None |
| ZipModifyDate: | 2025:02:10 19:59:58 |
| ZipCRC: | 0x00000000 |
| ZipCompressedSize: | - |
| ZipUncompressedSize: | - |
| ZipFileName: | Site-Hunter/ |
Total processes
145
Monitored processes
14
Malicious processes
1
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2196 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5512 | "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 | C:\Windows\System32\BackgroundTransferHost.exe | svchost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Download/Upload Host Exit code: 1 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6244 | "C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\Site-Hunter.zip | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.91.0 Modules
| |||||||||||||||
| 6388 | "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 | C:\Windows\System32\BackgroundTransferHost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Download/Upload Host Exit code: 1 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7216 | C:\WINDOWS\system32\SppExtComObj.exe -Embedding | C:\Windows\System32\SppExtComObj.Exe | — | svchost.exe | |||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: KMS Connection Broker Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7248 | "C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEvent | C:\Windows\System32\slui.exe | — | SppExtComObj.Exe | |||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows Activation Client Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7564 | "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 | C:\Windows\System32\BackgroundTransferHost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Download/Upload Host Exit code: 1 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7780 | "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 | C:\Windows\System32\BackgroundTransferHost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Download/Upload Host Exit code: 1 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7896 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa6244.19298\Site-Hunter\Site Hunter.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa6244.19298\Site-Hunter\Site Hunter.exe | WinRAR.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Version: 4.1.0.1 Modules
| |||||||||||||||
| 7908 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | Site Hunter.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
6 296
Read events
6 259
Write events
37
Delete events
0
Modification events
| (PID) Process: | (6244) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 3 |
Value: C:\Users\admin\Desktop\preferences.zip | |||
| (PID) Process: | (6244) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\chromium_ext.zip | |||
| (PID) Process: | (6244) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\omni_23_10_2024_.zip | |||
| (PID) Process: | (6244) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\Site-Hunter.zip | |||
| (PID) Process: | (6244) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (6244) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (6244) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (6244) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (8096) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (8096) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
Executable files
7
Suspicious files
12
Text files
2
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 5512 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\bbc4576e-09b8-4489-8663-87cdc7cdb3b5.down_data | — | |
MD5:— | SHA256:— | |||
| 6244 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa6244.19298\Site-Hunter\.vs\Site Hunter\v15\.suo | binary | |
MD5:79E8B6D32794E1596108C72F46B12490 | SHA256:B8BE49283675663D727F814EF52FE4E29A2A6E7E57DDA86F3D44B0E83C7CB6F0 | |||
| 6244 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa6244.19298\Site-Hunter\lib.cfg | executable | |
MD5:5292ED53BC6BE1CB21E888359158228F | SHA256:EE3B6C2BDD55F07621B741AA2081B1D554D2F9FB47E02FBCA768B366F9F3D98C | |||
| 6244 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa6244.19298\Site-Hunter\ucrtbase.dll | executable | |
MD5:26F56121184843056F1D6E6DB3F9844B | SHA256:3AD26E1C16B6F49C6136C0C1C02C5943437349A310A6BCC5A8A0F4924A6F4AE4 | |||
| 6244 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa6244.19298\Site-Hunter\Output.txt | text | |
MD5:549F0BB7E1DE8EAE161A6B8AB646789B | SHA256:3589A4C0FBA5FE3A71E9984648032CDD282915FE8E9170D27A4AE400D77C4DAC | |||
| 6244 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa6244.19298\Site-Hunter\xNet.dll | executable | |
MD5:3DF8D87A482EFAD957D83819ADB3020F | SHA256:2AC175B4D44245EE8E7AEE9CC36DF86925EF903D8516F20A2C51D84E35F23DA4 | |||
| 7896 | Site Hunter.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wscsvc.lnk | binary | |
MD5:03653DE9BE0FE78EE7400BC89D5F1A47 | SHA256:D134F096B181EA0BF39524519187FCFD4B0C095F09083CEDCF56CFBF179C8E5C | |||
| 5512 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D | binary | |
MD5:FE238D3B2E60FAA5CE04315F8BD956FC | SHA256:995DBAF6AF478841EEE386F8740C6773AC5418828E6B7B13F4DA919679FA5294 | |||
| 7896 | Site Hunter.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wupdater.lnk | binary | |
MD5:770BC9B7E007809F3A47F5A375D78C4E | SHA256:31753A4A8F220291D7528E5281272656C370D17C16E258A2625D756AB81EE891 | |||
| 6244 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa6244.19298\Site-Hunter\Input.txt | text | |
MD5:65B515EEF73D10E7EFE338FBF9E967BC | SHA256:3F5CBC96B213D85635070EF4DD9413F73F609C7D676EFB994BF38DF58BC468B6 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
113
DNS requests
81
Threats
5
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5512 | BackgroundTransferHost.exe | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
7992 | lib.cfg | GET | 301 | 104.26.9.151:80 | http://minecraft.novaskin.me/gallery/tag/kisame?next=Cj0KFAoHaG90bmVzcxIJISAMPPce7HpAEiFqDHN-c2tpbmVkaXRvcnIRCxIEU2tpbhiAgJDtqJ2YCQwYACAB' | unknown | — | — | whitelisted |
7992 | lib.cfg | GET | 301 | 104.26.9.151:80 | http://minecraft.novaskin.me/search?q=mousy' | unknown | — | — | whitelisted |
7992 | lib.cfg | GET | — | 185.94.140.20:80 | http://www.scoop.it/topic/game-mod-culture?page=29' | unknown | — | — | whitelisted |
7992 | lib.cfg | GET | 200 | 8.218.73.169:80 | http://www.dinochen.com/?distype=normal' | unknown | — | — | unknown |
7992 | lib.cfg | GET | 301 | 185.186.143.7:80 | http://salda.ws/video.php?id=j9DhvpQitsI' | unknown | — | — | whitelisted |
— | — | GET | 200 | 88.221.169.152:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
7992 | lib.cfg | GET | 301 | 2.19.126.77:80 | http://www.tiktok.com/tag/minecraftletsplay?referer_video_id=6826869327124319493' | unknown | — | — | whitelisted |
7992 | lib.cfg | GET | 301 | 2.19.126.77:80 | http://www.tiktok.com/tag/2020moment?referer_video_id=6778664958050831617' | unknown | — | — | whitelisted |
— | — | GET | 200 | 88.221.169.152:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
2104 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
3216 | svchost.exe | 40.113.110.67:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 40.126.31.131:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6544 | svchost.exe | 2.23.77.188:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
2112 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
7324 | backgroundTaskHost.exe | 20.223.35.26:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
7324 | backgroundTaskHost.exe | 2.23.77.188:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
arc.msn.com |
| whitelisted |
stlaip74566.ddnsgeek.com |
| unknown |
stlaep34621.ddnsgeek.com |
| unknown |
www.bing.com |
| whitelisted |
www.periyaruniversity.ac.in |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2196 | svchost.exe | Potentially Bad Traffic | ET DYN_DNS DYNAMIC_DNS Query to a *.ddnsgeek .com Domain |
2196 | svchost.exe | Potentially Bad Traffic | ET DYN_DNS DYNAMIC_DNS Query to a *.ddnsgeek .com Domain |
8004 | wupdater.exe | Potentially Bad Traffic | ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.ddnsgeek .com Domain |
8004 | wupdater.exe | Possibly Unwanted Program Detected | ET ADWARE_PUP User-Agent (Mozilla) - Possible Spyware Related |
2196 | svchost.exe | Potentially Bad Traffic | ET DNS Query for .to TLD |