File name:

x64__x32__installer (1).zip

Full analysis: https://app.any.run/tasks/9256f875-a1fc-4a48-887f-4e02b23c4197
Verdict: Malicious activity
Analysis date: May 01, 2024, 18:52:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

E5F53ECB931CEFEF3B66C8F08ED97B9A

SHA1:

D395E114E7A28FF8044C7552261D6D7DE49FAC26

SHA256:

53BFA98CB9BF49F55E670DAE62BC424D6910FAD1D85C48DA76E09148E64797E4

SSDEEP:

98304:F0Ih+J8ogLmnkDg7bjH+A+EvSCv/zLDf+71nc7jsQrvfqs8S2DC7Yi1vlvh4rHTU:YEfotEnjNUMyDb

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • msiexec.exe (PID: 2024)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 4064)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 2024)

  • INFO

    • Reads the computer name

      • msiexec.exe (PID: 2024)
      • msiexec.exe (PID: 692)
      • msiexec.exe (PID: 2284)
      • msiexec.exe (PID: 2204)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 4064)
      • msiexec.exe (PID: 2024)

    • Checks supported languages

      • msiexec.exe (PID: 2204)
      • msiexec.exe (PID: 2024)
      • msiexec.exe (PID: 692)
      • msiexec.exe (PID: 2284)

    • Manual execution by a user

      • WinRAR.exe (PID: 4064)
      • msiexec.exe (PID: 2036)
      • msiexec.exe (PID: 1060)
      • msiexec.exe (PID: 1852)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 4064)

    • Create files in a temporary directory

      • msiexec.exe (PID: 1060)
      • msiexec.exe (PID: 1852)
      • msiexec.exe (PID: 2036)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 2204)
      • msiexec.exe (PID: 692)
      • msiexec.exe (PID: 2284)
      • msiexec.exe (PID: 2024)

    • Application launched itself

      • msiexec.exe (PID: 2024)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2024:05:01 17:31:36
ZipCRC: 0xe45c29f2
ZipCompressedSize: 3255
ZipUncompressedSize: 976722
ZipFileName: password.jpg
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
9
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs winrar.exe msiexec.exe no specs msiexec.exe msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
692C:\Windows\system32\MsiExec.exe -Embedding 0ED417DF292476380E1B868E15B18ED9C:\Windows\System32\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1060"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\Desktop\setup.msi" C:\Windows\System32\msiexec.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
1603
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1852"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\Desktop\setup.msi" C:\Windows\System32\msiexec.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
1603
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2024C:\Windows\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2036"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\Desktop\setup.msi" C:\Windows\System32\msiexec.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
1603
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2204C:\Windows\system32\MsiExec.exe -Embedding C903C2DCB6A5C07DBBFCF522A771515FC:\Windows\System32\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2284C:\Windows\system32\MsiExec.exe -Embedding 4124712E560053911249DCD7CF178105C:\Windows\System32\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3976"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\x64__x32__installer (1).zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
4064"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\x64__x32___setup.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
Total events
14 377
Read events
14 321
Write events
44
Delete events
12

Modification events

(PID) Process:(3976) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3976) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3976) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3976) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3976) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3976) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(3976) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\x64__x32__installer (1).zip
(PID) Process:(3976) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3976) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3976) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
18
Suspicious files
1
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
4064WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb4064.37304\setup.msi —
MD5:—
SHA256:—
2024msiexec.exeC:\Windows\Installer\10d1aa.msi —
MD5:—
SHA256:—
2024msiexec.exeC:\Windows\Installer\10d1ab.msi —
MD5:—
SHA256:—
2024msiexec.exeC:\Windows\Installer\10d1ac.msi —
MD5:—
SHA256:—
4064WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb4064.37304\winmde\MMDevAPI.dllexecutable
MD5:8123FCED22F5424445BAA833E790ABE8
SHA256:0A5E682042A3DAD4BF67AB9A0E3542683A12B75C727EC4972820CF15E5CF59C2
4064WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb4064.37304\cdosys\cdosys.dllexecutable
MD5:4B32087670A6EC10C30F19B44B55FD81
SHA256:5BBDD7DFD38A030620F8FF5EA02AE4F045D733D9AF39655E168E18F48BC5FAFF
4064WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb4064.37304\iasnap\mprddm.dllexecutable
MD5:AA6C7B6257F5C9175979A36A29B66BE7
SHA256:6B7AAB5FC92181204E2FA92058C3D1A321377827580164C47973930F3D8335AC
4064WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb4064.37304\winmde\mi.dllexecutable
MD5:0987DB6E1D0563E9A91E8C8FBF266482
SHA256:5271E8C2759227B34A2E28C5172798B1D79E86F6EEB325979141D903B8F1F7AB
4064WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb4064.37304\winmde\winmde.dllexecutable
MD5:2F6EEC666FCF2A5A81DDD5D7C3CB69A1
SHA256:4256747504369F6D70E0051D1966952BF96E1AD178F9FFE6ECF369B9C3A088EC
2024msiexec.exeC:\Windows\Installer\MSI128.tmpexecutable
MD5:B158D8D605571EA47A238DF5AB43DFAA
SHA256:CA763693CC25D316F14A9EBAD80EBF00590329550C45ADB7E5205486533C2504
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
x64__x32__installer (1).zip