File name:

x64__x32__installer (1).zip

Full analysis: https://app.any.run/tasks/9256f875-a1fc-4a48-887f-4e02b23c4197
Verdict: Malicious activity
Analysis date: May 01, 2024, 18:52:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

E5F53ECB931CEFEF3B66C8F08ED97B9A

SHA1:

D395E114E7A28FF8044C7552261D6D7DE49FAC26

SHA256:

53BFA98CB9BF49F55E670DAE62BC424D6910FAD1D85C48DA76E09148E64797E4

SSDEEP:

98304:F0Ih+J8ogLmnkDg7bjH+A+EvSCv/zLDf+71nc7jsQrvfqs8S2DC7Yi1vlvh4rHTU:YEfotEnjNUMyDb

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • msiexec.exe (PID: 2024)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 4064)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 2024)

  • INFO

    • Manual execution by a user

      • WinRAR.exe (PID: 4064)
      • msiexec.exe (PID: 2036)
      • msiexec.exe (PID: 1060)
      • msiexec.exe (PID: 1852)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 4064)
      • msiexec.exe (PID: 2024)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 4064)

    • Checks supported languages

      • msiexec.exe (PID: 2024)
      • msiexec.exe (PID: 2204)
      • msiexec.exe (PID: 692)
      • msiexec.exe (PID: 2284)

    • Reads the computer name

      • msiexec.exe (PID: 2024)
      • msiexec.exe (PID: 2204)
      • msiexec.exe (PID: 692)
      • msiexec.exe (PID: 2284)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 2024)
      • msiexec.exe (PID: 2204)
      • msiexec.exe (PID: 692)
      • msiexec.exe (PID: 2284)

    • Application launched itself

      • msiexec.exe (PID: 2024)

    • Create files in a temporary directory

      • msiexec.exe (PID: 2036)
      • msiexec.exe (PID: 1852)
      • msiexec.exe (PID: 1060)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2024:05:01 17:31:36
ZipCRC: 0xe45c29f2
ZipCompressedSize: 3255
ZipUncompressedSize: 976722
ZipFileName: password.jpg
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
9
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs winrar.exe msiexec.exe no specs msiexec.exe msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
692C:\Windows\system32\MsiExec.exe -Embedding 0ED417DF292476380E1B868E15B18ED9C:\Windows\System32\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1060"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\Desktop\setup.msi" C:\Windows\System32\msiexec.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
1603
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1852"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\Desktop\setup.msi" C:\Windows\System32\msiexec.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
1603
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2024C:\Windows\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2036"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\Desktop\setup.msi" C:\Windows\System32\msiexec.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
1603
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2204C:\Windows\system32\MsiExec.exe -Embedding C903C2DCB6A5C07DBBFCF522A771515FC:\Windows\System32\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2284C:\Windows\system32\MsiExec.exe -Embedding 4124712E560053911249DCD7CF178105C:\Windows\System32\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3976"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\x64__x32__installer (1).zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
4064"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\x64__x32___setup.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
Total events
14 377
Read events
14 321
Write events
44
Delete events
12

Modification events

(PID) Process:(3976) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3976) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3976) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3976) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3976) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3976) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(3976) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\x64__x32__installer (1).zip
(PID) Process:(3976) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3976) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3976) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
18
Suspicious files
1
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
4064WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb4064.37304\setup.msi —
MD5:—
SHA256:—
2024msiexec.exeC:\Windows\Installer\10d1aa.msi —
MD5:—
SHA256:—
2024msiexec.exeC:\Windows\Installer\10d1ab.msi —
MD5:—
SHA256:—
2024msiexec.exeC:\Windows\Installer\10d1ac.msi —
MD5:—
SHA256:—
3976WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3976.35625\x64__x32___setup.zipcompressed
MD5:B0B4C4963C55CCC44AAF4AC9CF891662
SHA256:19C4AA78AA2D0B62A15DC3DFB6B289B8DAC22793DDCA068D568736B14258B659
4064WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb4064.37304\winmde\daxexec.dllexecutable
MD5:AA304599017322A35B85A25C05B2181C
SHA256:DB2FE02682D410DE2E4FA6E9435B9DC14B3739922FE1E6796E8B94942F711944
4064WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb4064.37304\iasnap\mfds.dllexecutable
MD5:2555CA538CFA951B193896509B847730
SHA256:8C965BAE549766B7FA4B9D9C7E56A729ABC5474484EFE94663B3C8BFD0429719
4064WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb4064.37304\cdosys\cdosys.dllexecutable
MD5:4B32087670A6EC10C30F19B44B55FD81
SHA256:5BBDD7DFD38A030620F8FF5EA02AE4F045D733D9AF39655E168E18F48BC5FAFF
4064WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb4064.37304\iasnap\iasnap.dllexecutable
MD5:9159148D50715F59A725A977967898B7
SHA256:7C1DFB2B669A3346DB1C72AA240AA0C8C11AE874F295957A4AE5225AEA5CE338
4064WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb4064.37304\srhelper\sppobjs.dllexecutable
MD5:BF28019CD8187341479BBB4EFECC45D6
SHA256:6B051B1D3E3E74201A97FED167AF3A10409237A275EFE514FDAD5EF4BFEA03F9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
x64__x32__installer (1).zip