File name:

build.rar

Full analysis: https://app.any.run/tasks/35a2f5e1-c987-43c7-a2ea-5529cd544605
Verdict: Malicious activity
Analysis date: June 15, 2025, 19:32:47
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
kprocesshacker-sys
vuln-driver
arch-exec
arch-doc
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

646C74E14EE2681928ADA0054C41A608

SHA1:

26DE912D20D2FDC714993BFB76DF86256BEB4E3E

SHA256:

58289AE3A3B3A83E8DE66109389261C62AE6F058387B91F3731F6016E36A295A

SSDEEP:

98304:aE48SS7Djy0tUQD1Xvx4Q6wUukhScEAj3W/8ncAA44gy+SSx93aLQ7e//B/N9eTi:N9Mu

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Vulnerable driver has been detected

      • WinRAR.exe (PID: 3888)

  • SUSPICIOUS

    • Drops a system driver (possible attempt to evade defenses)

      • WinRAR.exe (PID: 3888)

    • Reads security settings of Internet Explorer

      • ProcessHacker.exe (PID: 416)

    • The process creates files with name similar to system file names

      • WinRAR.exe (PID: 3888)

  • INFO

    • The sample compiled with english language support

      • WinRAR.exe (PID: 3888)

    • Reads the software policy settings

      • ProcessHacker.exe (PID: 416)
      • slui.exe (PID: 2428)

    • Manual execution by a user

      • usermode.exe (PID: 4836)
      • ProcessHacker.exe (PID: 416)
      • mapper.exe (PID: 4040)
      • mapper.exe (PID: 3800)
      • usermode.exe (PID: 3836)

    • Checks supported languages

      • mapper.exe (PID: 3800)
      • usermode.exe (PID: 3836)
      • ProcessHacker.exe (PID: 416)

    • Checks proxy server information

      • ProcessHacker.exe (PID: 416)
      • slui.exe (PID: 2428)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3888)

    • Reads Environment values

      • ProcessHacker.exe (PID: 416)

    • Reads the computer name

      • ProcessHacker.exe (PID: 416)

    • Reads the machine GUID from the registry

      • ProcessHacker.exe (PID: 416)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)

EXIF

ZIP

FileVersion: RAR v5
CompressedSize: 1673
UncompressedSize: 6144
OperatingSystem: Win32
ArchivedFileName: ghost.sys
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
144
Monitored processes
9
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start THREAT winrar.exe processhacker.exe usermode.exe no specs usermode.exe conhost.exe no specs slui.exe mapper.exe no specs mapper.exe conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
416"C:\Users\admin\Desktop\ProcessHacker.exe" C:\Users\admin\Desktop\ProcessHacker.exe
explorer.exe
User:
admin
Company:
wj32
Integrity Level:
MEDIUM
Description:
Process Hacker
Version:
2.39.0.124
Modules
Images
c:\users\admin\desktop\processhacker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\winsta.dll
c:\windows\system32\user32.dll
c:\windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.3636_none_60b6a03d71f818d5\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\win32u.dll
2280\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—usermode.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2428C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
3800"C:\Users\admin\Desktop\mapper.exe" C:\Users\admin\Desktop\mapper.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
3221225786
Modules
Images
c:\users\admin\desktop\mapper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
3836"C:\Users\admin\Desktop\usermode.exe" C:\Users\admin\Desktop\usermode.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\desktop\usermode.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\vcruntime140_1.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\msvcp140.dll
3888"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\build.rarC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4040"C:\Users\admin\Desktop\mapper.exe" C:\Users\admin\Desktop\mapper.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\mapper.exe
c:\windows\system32\ntdll.dll
4380\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—mapper.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4836"C:\Users\admin\Desktop\usermode.exe" C:\Users\admin\Desktop\usermode.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\usermode.exe
c:\windows\system32\ntdll.dll
Total events
7 800
Read events
7 776
Write events
11
Delete events
13

Modification events

(PID) Process:(3888) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(3888) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(3888) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(3888) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\build.rar
(PID) Process:(3888) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3888) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3888) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3888) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3888) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:15
Value:
(PID) Process:(3888) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:14
Value:
Executable files
21
Suspicious files
2
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
3888WinRAR.exeC:\Users\admin\Desktop\mapper.exeexecutable
MD5:47C0DA514335ECC53CC777594E1A66A4
SHA256:B0BEB6EF92E8A051F9C0E28EBE95DAC66FFC0FA4194DCA1688DC5478FCFA83D4
3888WinRAR.exeC:\Users\admin\Desktop\usermode.exeexecutable
MD5:B08094770BA83197CEF2907EBDB0E3B2
SHA256:1BCFEF3AB4BCEF9D9EFB7BB66C188B0AD44B194CC191F1D91DFA13AA2F61F969
3888WinRAR.exeC:\Users\admin\Desktop\ghost.sysexecutable
MD5:37F647ABCB7270309A00F25DE8B29139
SHA256:6F4B0A628323B06D35B8C4889FDE2BEE5CFB12B8CC88F8F4EC5D40088D563A4B
3888WinRAR.exeC:\Users\admin\Desktop\x86\plugins\DotNetTools.dllexecutable
MD5:15AB3740703138ED5C091EA7736620F4
SHA256:0D7240D074BA544C90DF72D5E339978AA2EDC19F4A02C0A302718D851B11C384
3888WinRAR.exeC:\Users\admin\Desktop\x86\ProcessHacker.exeexecutable
MD5:68F9B52895F4D34E74112F3129B3B00D
SHA256:D4A0FE56316A2C45B9BA9AC1005363309A3EDC7ACF9E4DF64D326A0FF273E80F
3888WinRAR.exeC:\Users\admin\Desktop\CHANGELOG.txttext
MD5:B13DE4E8531AF294F87FFDDCCB08D7CE
SHA256:69E38F590A9A25F656E7507AF76229A3A6678A8C57B4E879FF8CE7E52FD704FF
3888WinRAR.exeC:\Users\admin\Desktop\LICENSE.txttext
MD5:EB59E0A5D01D0A5B02DA0C9E7786969F
SHA256:C38E811F6F83428921D0CECD998A44B717149B577B4C1A63B66064F03C34E4E7
3888WinRAR.exeC:\Users\admin\Desktop\peview.exeexecutable
MD5:DDE1F44789CD50C1F034042D337DEAE3
SHA256:4259E53D48A3FED947F561FF04C7F94446BEDD64C87F52400B2CB47A77666AAA
3888WinRAR.exeC:\Users\admin\Desktop\ProcessHacker.exeexecutable
MD5:B365AF317AE730A67C936F21432B9C71
SHA256:BD2C2CF0631D881ED382817AFCCE2B093F4E412FFB170A719E2762F250ABFEA4
3888WinRAR.exeC:\Users\admin\Desktop\plugins\DotNetTools.dllexecutable
MD5:B16CE8BA8E7F0EE83EC1D49F2D0AF0A7
SHA256:B4CC0280E2CAA0335361172CB7D673F745DEFC78299DED808426FFBC2458E4D9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
28
DNS requests
20
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
2.16.168.124:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1356
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2940
svchost.exe
GET
200
2.19.105.127:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
416
ProcessHacker.exe
GET
301
104.18.12.149:80
http://processhacker.sourceforge.net/update.php
unknown
—
—
whitelisted
1356
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1380
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1268
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3964
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
2.16.168.124:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
1268
svchost.exe
2.16.253.202:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
5944
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1356
SIHClient.exe
20.109.210.53:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
1356
SIHClient.exe
23.219.150.101:80
www.microsoft.com
AKAMAI-AS
CL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
whitelisted
google.com
  • 142.250.185.174
whitelisted
crl.microsoft.com
  • 2.16.168.124
  • 2.16.168.114
whitelisted
www.microsoft.com
  • 2.16.253.202
  • 23.219.150.101
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
wj32.org
  • 162.243.25.33
whitelisted
login.live.com
  • 20.190.160.3
  • 20.190.160.20
  • 20.190.160.130
  • 40.126.32.68
  • 40.126.32.74
  • 40.126.32.136
  • 20.190.160.2
  • 20.190.160.4
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
build.rar