File name:

x64__x32__installer (1).zip

Full analysis: https://app.any.run/tasks/9256f875-a1fc-4a48-887f-4e02b23c4197
Verdict: Malicious activity
Analysis date: May 01, 2024, 18:52:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

E5F53ECB931CEFEF3B66C8F08ED97B9A

SHA1:

D395E114E7A28FF8044C7552261D6D7DE49FAC26

SHA256:

53BFA98CB9BF49F55E670DAE62BC424D6910FAD1D85C48DA76E09148E64797E4

SSDEEP:

98304:F0Ih+J8ogLmnkDg7bjH+A+EvSCv/zLDf+71nc7jsQrvfqs8S2DC7Yi1vlvh4rHTU:YEfotEnjNUMyDb

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • msiexec.exe (PID: 2024)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 4064)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 2024)

  • INFO

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 4064)

    • Manual execution by a user

      • msiexec.exe (PID: 2036)
      • WinRAR.exe (PID: 4064)
      • msiexec.exe (PID: 1060)
      • msiexec.exe (PID: 1852)

    • Checks supported languages

      • msiexec.exe (PID: 2024)
      • msiexec.exe (PID: 2204)
      • msiexec.exe (PID: 692)
      • msiexec.exe (PID: 2284)

    • Reads the computer name

      • msiexec.exe (PID: 2024)
      • msiexec.exe (PID: 2204)
      • msiexec.exe (PID: 692)
      • msiexec.exe (PID: 2284)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 4064)
      • msiexec.exe (PID: 2024)

    • Application launched itself

      • msiexec.exe (PID: 2024)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 2024)
      • msiexec.exe (PID: 2204)
      • msiexec.exe (PID: 692)
      • msiexec.exe (PID: 2284)

    • Create files in a temporary directory

      • msiexec.exe (PID: 2036)
      • msiexec.exe (PID: 1852)
      • msiexec.exe (PID: 1060)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2024:05:01 17:31:36
ZipCRC: 0xe45c29f2
ZipCompressedSize: 3255
ZipUncompressedSize: 976722
ZipFileName: password.jpg
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
9
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs winrar.exe msiexec.exe no specs msiexec.exe msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
692C:\Windows\system32\MsiExec.exe -Embedding 0ED417DF292476380E1B868E15B18ED9C:\Windows\System32\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1060"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\Desktop\setup.msi" C:\Windows\System32\msiexec.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
1603
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1852"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\Desktop\setup.msi" C:\Windows\System32\msiexec.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
1603
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2024C:\Windows\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2036"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\Desktop\setup.msi" C:\Windows\System32\msiexec.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
1603
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2204C:\Windows\system32\MsiExec.exe -Embedding C903C2DCB6A5C07DBBFCF522A771515FC:\Windows\System32\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2284C:\Windows\system32\MsiExec.exe -Embedding 4124712E560053911249DCD7CF178105C:\Windows\System32\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3976"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\x64__x32__installer (1).zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
4064"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\x64__x32___setup.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
Total events
14 377
Read events
14 321
Write events
44
Delete events
12

Modification events

(PID) Process:(3976) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3976) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3976) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3976) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3976) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3976) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(3976) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\x64__x32__installer (1).zip
(PID) Process:(3976) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3976) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3976) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
18
Suspicious files
1
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
4064WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb4064.37304\setup.msi —
MD5:—
SHA256:—
2024msiexec.exeC:\Windows\Installer\10d1aa.msi —
MD5:—
SHA256:—
2024msiexec.exeC:\Windows\Installer\10d1ab.msi —
MD5:—
SHA256:—
2024msiexec.exeC:\Windows\Installer\10d1ac.msi —
MD5:—
SHA256:—
3976WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3976.35625\x64__x32___setup.zipcompressed
MD5:B0B4C4963C55CCC44AAF4AC9CF891662
SHA256:19C4AA78AA2D0B62A15DC3DFB6B289B8DAC22793DDCA068D568736B14258B659
4064WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb4064.37304\srhelper\PortableDeviceApi.dllexecutable
MD5:E20900A32781F84278E98273C9318CEA
SHA256:153D94801C538EB820D2F721B80FB93C054E4A143B8544AD3EF6AC2EA794C1AA
4064WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb4064.37304\winmde\Windows.Graphics.dllexecutable
MD5:29BBE29EAEFBC1FD7DF09E5730619AF0
SHA256:81252237CEFBC6058842C1DB98067D5BD1D7819B18367BE889F6F6DD326C64CD
4064WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb4064.37304\winmde\MMDevAPI.dllexecutable
MD5:8123FCED22F5424445BAA833E790ABE8
SHA256:0A5E682042A3DAD4BF67AB9A0E3542683A12B75C727EC4972820CF15E5CF59C2
4064WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb4064.37304\winmde\winmde.dllexecutable
MD5:2F6EEC666FCF2A5A81DDD5D7C3CB69A1
SHA256:4256747504369F6D70E0051D1966952BF96E1AD178F9FFE6ECF369B9C3A088EC
4064WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb4064.37304\winmde\mi.dllexecutable
MD5:0987DB6E1D0563E9A91E8C8FBF266482
SHA256:5271E8C2759227B34A2E28C5172798B1D79E86F6EEB325979141D903B8F1F7AB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
x64__x32__installer (1).zip