File name:

hwi_772.zip

Full analysis: https://app.any.run/tasks/0e0a2d33-6ebe-4f2d-aeb7-476a3917981e
Verdict: Malicious activity
Analysis date: March 08, 2024, 11:42:19
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

DA51113A7BE83E97B601D359D74F7B79

SHA1:

35BDCFEFBB3FBFBCCA362228C65CB258C32845A6

SHA256:

5DB2364E372FA2B9A1D81A66A9FB4B4298F74915EDA7EEA7F9BB0F6F8E1DE6CD

SSDEEP:

98304:l/ktAAvgIKJKRZMPeYc4ASeg0y+tbDNDXV5yA3Zq3JcXcwiv8OGj5pI980zWJ4q4:iXPOmOJ/Hjq9tf3Ka/aQGXpi4/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3972)
      • HWiNFO32.exe (PID: 116)
      • cpuz_x32.exe (PID: 1020)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • HWiNFO32.exe (PID: 116)
      • cpuz_x32.exe (PID: 1020)

    • Drops a system driver (possible attempt to evade defenses)

      • HWiNFO32.exe (PID: 116)
      • cpuz_x32.exe (PID: 1020)

    • Checks Windows Trust Settings

      • HWiNFO32.exe (PID: 116)
      • cpuz_x32.exe (PID: 1020)

    • Reads security settings of Internet Explorer

      • HWiNFO32.exe (PID: 116)
      • cpuz_x32.exe (PID: 1020)

    • Reads settings of System Certificates

      • HWiNFO32.exe (PID: 116)
      • cpuz_x32.exe (PID: 1020)

    • Reads the BIOS version

      • HWiNFO32.exe (PID: 116)

    • Reads the Internet Settings

      • HWiNFO32.exe (PID: 116)
      • cpuz_x32.exe (PID: 1020)

    • Adds/modifies Windows certificates

      • cpuz_x32.exe (PID: 1020)

  • INFO

    • Checks supported languages

      • HWiNFO32.exe (PID: 116)
      • cpuz_x32.exe (PID: 1020)
      • wmpnscfg.exe (PID: 392)

    • Reads the computer name

      • HWiNFO32.exe (PID: 116)
      • wmpnscfg.exe (PID: 392)
      • cpuz_x32.exe (PID: 1020)

    • Manual execution by a user

      • HWiNFO32.exe (PID: 116)
      • cpuz_x32.exe (PID: 1484)
      • WinRAR.exe (PID: 3984)
      • cpuz_x32.exe (PID: 1020)
      • wmpnscfg.exe (PID: 392)

    • Create files in a temporary directory

      • HWiNFO32.exe (PID: 116)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3972)
      • WinRAR.exe (PID: 3984)

    • Reads the machine GUID from the registry

      • HWiNFO32.exe (PID: 116)
      • cpuz_x32.exe (PID: 1020)

    • Reads the software policy settings

      • HWiNFO32.exe (PID: 116)
      • cpuz_x32.exe (PID: 1020)

    • Reads CPU info

      • HWiNFO32.exe (PID: 116)

    • Checks proxy server information

      • HWiNFO32.exe (PID: 116)
      • cpuz_x32.exe (PID: 1020)

    • Creates files or folders in the user directory

      • HWiNFO32.exe (PID: 116)
      • cpuz_x32.exe (PID: 1020)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3984)

    • Reads Environment values

      • cpuz_x32.exe (PID: 1020)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2024:02:05 09:30:34
ZipCRC: 0x54d74552
ZipCompressedSize: 3039788
ZipUncompressedSize: 3101664
ZipFileName: HWiNFO32.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
57
Monitored processes
6
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe hwinfo32.exe winrar.exe cpuz_x32.exe no specs cpuz_x32.exe wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
116"C:\Users\admin\Desktop\HWiNFO32.exe" C:\Users\admin\Desktop\HWiNFO32.exe
explorer.exe
User:
admin
Company:
REALiX s.r.o.
Integrity Level:
HIGH
Description:
HWiNFO32
Exit code:
0
Version:
7.72-5355
Modules
Images
c:\users\admin\desktop\hwinfo32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
392"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1020"C:\Users\admin\Desktop\cpu-z_2.09-en\cpuz_x32.exe" C:\Users\admin\Desktop\cpu-z_2.09-en\cpuz_x32.exe
explorer.exe
User:
admin
Company:
CPUID
Integrity Level:
HIGH
Description:
CPU-Z Application
Exit code:
0
Version:
2, 0, 9, 0
Modules
Images
c:\users\admin\desktop\cpu-z_2.09-en\cpuz_x32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1484"C:\Users\admin\Desktop\cpu-z_2.09-en\cpuz_x32.exe" C:\Users\admin\Desktop\cpu-z_2.09-en\cpuz_x32.exe—explorer.exe
User:
admin
Company:
CPUID
Integrity Level:
MEDIUM
Description:
CPU-Z Application
Exit code:
3221226540
Version:
2, 0, 9, 0
Modules
Images
c:\users\admin\desktop\cpu-z_2.09-en\cpuz_x32.exe
c:\windows\system32\ntdll.dll
3972"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\hwi_772.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3984"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Desktop\cpu-z_2.09-en.zip" C:\Users\admin\Desktop\cpu-z_2.09-en\C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
Total events
14 031
Read events
13 870
Write events
137
Delete events
24

Modification events

(PID) Process:(3972) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3972) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3972) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3972) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3972) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3972) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(3972) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\hwi_772.zip
(PID) Process:(3972) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3972) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3972) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
5
Suspicious files
6
Text files
6
Unknown types
3

Dropped files

PID
Process
Filename
Type
1020cpuz_x32.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\cpuid[1].vertext
MD5:DC2707C8036C831472755CF619C453A7
SHA256:BE2EA0898C5840311CF665059A7DCC16A42838D60ED81AF01A8E9BA47BD923C1
1020cpuz_x32.exeC:\Windows\temp\cpuz_driver_1020.logtext
MD5:5331A892B196C460F69966D30B4B56E1
SHA256:C88717244A7B9CAD9BF4DF03B38337527AC4B4B84F048100382FCBC1FDF8FC3F
1020cpuz_x32.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751der
MD5:822467B728B7A66B081C91795373789A
SHA256:AF2343382B88335EEA72251AD84949E244FF54B6995063E24459A7216E9576B9
1020cpuz_x32.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EEEE07515B5603D91BD193C0D397F01Cbinary
MD5:13908B5776221CFDC2216F54DCAC71E4
SHA256:8EA50BDACA896EECD56A13FD9E5A38830EA9BAA15504F2C3F6F3CF754F587197
1020cpuz_x32.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EEEE07515B5603D91BD193C0D397F01Cbinary
MD5:FDCFBBEEC942B7656915E65CE0E4506F
SHA256:1B4B5F8FE42954C5AEBB9BD544758253ED90C9FF7AF8322D968E306A358EBFA5
116HWiNFO32.exeC:\Users\admin\AppData\Local\Temp\HWiNFO32_191.SYSexecutable
MD5:6B8909A66EDD2AB656D15B625BA6F6DE
SHA256:FC98ADFA2B94D5ABCF11655807E7FDCA1028C7142C97B7C3B5435E0421FEBFAE
116HWiNFO32.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:352649F70048A56EB54D4F4C082B7B38
SHA256:862FE2EE2984C826D4EBCA4BAF6B57EF1CB637F05E2962FECF0C447A93B2A66F
116HWiNFO32.exeC:\Windows\INF\setupapi.app.logini
MD5:EDF6BF91746D13B4581CD37298FB7B1B
SHA256:F0207BD080649D51A402A11EE06D14DC4A7C40FF243FFA38AD76877914CA6CD1
3972WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3972.14593\HWiNFO32.exeexecutable
MD5:A216E798230D9C7B8AB3C965BEB44EDD
SHA256:140C4203A7F2E9A379B5293EFBE38E74A779044B226B3E3E90DA28D74C9F672E
116HWiNFO32.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:D8C5D912E303DBABD4CA465DCFBE6A73
SHA256:22ACA1668B4FECF851A70991EC7EE5E8F46872AFB1E28A8FDB40AA809150B279
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
11
DNS requests
7
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
116
HWiNFO32.exe
GET
304
23.53.42.59:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?53c50ebd11a047c3
unknown
—
—
unknown
116
HWiNFO32.exe
GET
200
142.250.185.195:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
binary
1.41 Kb
unknown
116
HWiNFO32.exe
GET
200
142.250.185.195:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFCjJ1PwkYAi7fE%3D
unknown
binary
724 b
unknown
1020
cpuz_x32.exe
GET
200
2.19.217.103:80
http://x1.c.lencr.org/
unknown
binary
717 b
unknown
1080
svchost.exe
GET
200
23.53.41.243:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?89bca2e7018c82c0
unknown
compressed
67.5 Kb
unknown
1020
cpuz_x32.exe
GET
200
195.138.255.18:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgQy%2BbCaB9oPhwT%2BuDTXjawRlg%3D%3D
unknown
binary
503 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
unknown
116
HWiNFO32.exe
172.67.205.235:443
www.hwinfo.com
CLOUDFLARENET
US
unknown
116
HWiNFO32.exe
23.53.42.59:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
116
HWiNFO32.exe
142.250.185.195:80
ocsp.pki.goog
GOOGLE
US
whitelisted
1080
svchost.exe
23.53.41.243:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
1020
cpuz_x32.exe
195.154.81.43:443
download.cpuid.com
Online S.a.s.
FR
unknown
1020
cpuz_x32.exe
2.19.217.103:80
x1.c.lencr.org
Akamai International B.V.
NL
unknown
1020
cpuz_x32.exe
195.138.255.18:80
r3.o.lencr.org
AS33891 Netzbetrieb GmbH
DE
unknown

DNS requests

Domain
IP
Reputation
www.hwinfo.com
  • 172.67.205.235
  • 104.21.22.164
whitelisted
ctldl.windowsupdate.com
  • 23.53.42.59
  • 23.53.41.249
  • 23.53.42.64
  • 23.53.42.66
  • 23.53.42.65
  • 23.53.41.250
  • 23.53.41.251
  • 23.53.41.248
  • 23.53.42.67
  • 23.53.41.243
  • 23.53.42.25
  • 23.53.41.242
  • 23.53.42.16
  • 23.53.42.58
whitelisted
ocsp.pki.goog
  • 142.250.185.195
whitelisted
download.cpuid.com
  • 195.154.81.43
whitelisted
x1.c.lencr.org
  • 2.19.217.103
whitelisted
r3.o.lencr.org
  • 195.138.255.18
shared

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
hwi_772.zip