File name:

setup_nx1OhGbZ_MALICIOUS.zip

Full analysis: https://app.any.run/tasks/6a1b7f3c-0de7-44e2-ac97-1fbfd99b5cce
Verdict: Malicious activity
Analysis date: April 01, 2023, 00:38:15
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

7EAE0F42B76EA57FB7EA8F0DF7F0051A

SHA1:

051C0F3B0FDDD2AE8519A9C1E45055509F074CBB

SHA256:

4F85978A0B19F386CE2B1A4555C811A05BFC41101E06A76EC7F407E952AA9D68

SSDEEP:

196608:pKM5aUpAI6rSLKSu9gqUd09yHwP9ITXFiFA50ycJFhWwGZJhHEx:gWP8eBuCHI9CYyOcwybkx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • setup_nx1OhGbZ.exe (PID: 660)
      • setup_nx1OhGbZ.exe (PID: 3496)

    • Starts NET.EXE for service management

      • is-M8M6N.tmp (PID: 1592)
      • net.exe (PID: 3552)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • setup_nx1OhGbZ.exe (PID: 660)
      • is-M8M6N.tmp (PID: 1592)

    • Reads the Windows owner or organization settings

      • is-M8M6N.tmp (PID: 1592)

    • Reads the Internet Settings

      • IC331.exe (PID: 2452)

  • INFO

    • Manual execution by a user

      • setup_nx1OhGbZ.exe (PID: 660)
      • setup_nx1OhGbZ.exe (PID: 3496)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2064)

    • Create files in a temporary directory

      • setup_nx1OhGbZ.exe (PID: 660)
      • is-M8M6N.tmp (PID: 1592)
      • IC331.exe (PID: 2452)

    • Checks supported languages

      • setup_nx1OhGbZ.exe (PID: 660)
      • is-M8M6N.tmp (PID: 1592)
      • IC331.exe (PID: 2452)
      • IC331.exe (PID: 3592)

    • Reads the computer name

      • is-M8M6N.tmp (PID: 1592)
      • IC331.exe (PID: 2452)
      • IC331.exe (PID: 3592)

    • The process checks LSA protection

      • is-M8M6N.tmp (PID: 1592)
      • IC331.exe (PID: 2452)
      • IC331.exe (PID: 3592)

    • Application was dropped or rewritten from another process

      • is-M8M6N.tmp (PID: 1592)

    • Creates files in the program directory

      • is-M8M6N.tmp (PID: 1592)

    • Reads the machine GUID from the registry

      • IC331.exe (PID: 3592)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: .............exe
ZipUncompressedSize: 6120168
ZipCompressedSize: 5638711
ZipCRC: 0x2246b6f2
ZipModifyDate: 2019:11:07 00:30:48
ZipCompression: Deflated
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
51
Monitored processes
10
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winrar.exe setup_nx1ohgbz.exe no specs setup_nx1ohgbz.exe is-m8m6n.tmp net.exe no specs ic331.exe net1.exe no specs net.exe no specs ic331.exe net1.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
660"C:\Users\admin\Desktop\setup_nx1OhGbZ.exe" C:\Users\admin\Desktop\setup_nx1OhGbZ.exe
explorer.exe
User:
admin
Company:
Ride Software
Integrity Level:
HIGH
Description:
Image Comparer
Exit code:
0
Version:
0.0.3.29
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\desktop\setup_nx1ohgbz.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
1236"C:\Windows\system32\net.exe" helpmsg 25C:\Windows\System32\net.exe—is-M8M6N.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\netutils.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\browcli.dll
1592"C:\Users\admin\AppData\Local\Temp\is-EU987.tmp\is-M8M6N.tmp" /SL4 $60128 "C:\Users\admin\Desktop\setup_nx1OhGbZ.exe" 4598089 53248 C:\Users\admin\AppData\Local\Temp\is-EU987.tmp\is-M8M6N.tmp
setup_nx1OhGbZ.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.47.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-eu987.tmp\is-m8m6n.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
2064"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\setup_nx1OhGbZ_MALICIOUS.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\lpk.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\sechost.dll
2452"C:\Program Files\ImageComparer\IC331.exe"C:\Program Files\ImageComparer\IC331.exe
is-M8M6N.tmp
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
1.0.3.30
Modules
Images
c:\program files\imagecomparer\ic331.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2936C:\Windows\system32\net1 helpmsg 25C:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dsrole.dll
c:\windows\system32\netutils.dll
3496"C:\Users\admin\Desktop\setup_nx1OhGbZ.exe" C:\Users\admin\Desktop\setup_nx1OhGbZ.exe—explorer.exe
User:
admin
Company:
Ride Software
Integrity Level:
MEDIUM
Description:
Image Comparer
Exit code:
3221226540
Version:
0.0.3.29
Modules
Images
c:\users\admin\desktop\setup_nx1ohgbz.exe
c:\windows\system32\ntdll.dll
3552"C:\Windows\system32\net.exe" pause ImageComparer331C:\Windows\System32\net.exe—is-M8M6N.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\netutils.dll
c:\windows\system32\samcli.dll
3592"C:\Program Files\ImageComparer\IC331.exe" b63ae5a0ee4717297ebfa1fdb7f3c490C:\Program Files\ImageComparer\IC331.exe
is-M8M6N.tmp
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
1.0.3.30
Modules
Images
c:\program files\imagecomparer\ic331.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\version.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\sechost.dll
3864C:\Windows\system32\net1 pause ImageComparer331C:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
2
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dsrole.dll
c:\windows\system32\samcli.dll
Total events
4 388
Read events
4 350
Write events
38
Delete events
0

Modification events

(PID) Process:(2064) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2064) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2064) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2064) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(2064) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2064) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2064) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2064) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2064) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
(PID) Process:(2064) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\General
Operation:writeName:LastFolder
Value:
C:\Users\admin\Desktop
Executable files
24
Suspicious files
2
Text files
110
Unknown types
14

Dropped files

PID
Process
Filename
Type
1592is-M8M6N.tmpC:\Program Files\ImageComparer\is-F24JV.tmp —
MD5:—
SHA256:—
1592is-M8M6N.tmpC:\Program Files\ImageComparer\IC331.exe —
MD5:—
SHA256:—
2064WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2064.49842\setup_nx1OhGbZ.exeexecutable
MD5:—
SHA256:—
1592is-M8M6N.tmpC:\Program Files\ImageComparer\is-LT8IA.tmpexecutable
MD5:—
SHA256:—
1592is-M8M6N.tmpC:\Program Files\ImageComparer\is-E2C6G.tmptext
MD5:—
SHA256:—
1592is-M8M6N.tmpC:\Program Files\ImageComparer\unins000.exeexecutable
MD5:—
SHA256:—
1592is-M8M6N.tmpC:\Program Files\ImageComparer\license.rtftext
MD5:—
SHA256:—
1592is-M8M6N.tmpC:\Program Files\ImageComparer\order.urltext
MD5:—
SHA256:—
1592is-M8M6N.tmpC:\Users\admin\AppData\Local\Temp\is-DAPFQ.tmp\_isetup\_iscrypt.dllexecutable
MD5:A69559718AB506675E907FE49DEB71E9
SHA256:2F6294F9AA09F59A574B5DCD33BE54E16B39377984F3D5658CDA44950FA0F8FC
1592is-M8M6N.tmpC:\Users\admin\AppData\Local\Temp\is-DAPFQ.tmp\_isetup\_RegDLL.tmpexecutable
MD5:C594B792B9C556EA62A30DE541D2FB03
SHA256:5DCC1E0A197922907BCA2C4369F778BD07EE4B1BBBDF633E987A028A314D548E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
2
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3592
IC331.exe
POST
—
104.21.86.39:80
http://jorjfordmust.sbs/new/net_api
US
—
—
suspicious
2452
IC331.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?6456533434
US
compressed
61.1 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2452
IC331.exe
209.197.3.8:80
ctldl.windowsupdate.com
STACKPATH-CDN
US
whitelisted
—
—
104.21.86.39:80
jorjfordmust.sbs
CLOUDFLARENET
—
suspicious

DNS requests

Domain
IP
Reputation
ctldl.windowsupdate.com
  • 209.197.3.8
whitelisted
jorjfordmust.sbs
  • 104.21.86.39
  • 172.67.214.126
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
setup_nx1OhGbZ_MALICIOUS.zip