We're sorry but any.run reports doesn't work properly without JavaScript enabled. Please enable it to continue.
Analysis result
Behavior activities
Threats
Find similar analyses in TI Lookup
Analysis date (UTC):
4 June 2024, 13:03
Analysis environment:
Windows 7 Pro, build 7601, x86
https://github.com/InitD4rkN0de/Sims4-DLC-Unlocker/releases/download/Releases/Sims.4.DLC.Unlocker.zip
MD5:
C750AF4ED5BB0EB6A1EE336CF9C0CC66
SHA1:
68D64C79982D1835CE86AB9E5A2C62B06A908D7A
SHA256:
62025C47516CF6E38DE0AA2F794329EBBD7720B2BDC22784F55335D4A77AEAE5
Analysis result
Threat level:
Malicious activity
Full analysis:
Analysis https://github.com/InitD4rkN0de/Sims4-DLC-Unlocker/releases/download/Releases/Sims.4.DLC.Unlocker.zip Malicious activity - Interactive analysis ANY.RUN
Behavior activities
MALICIOUS
Adds path to the Windows Defender exclusion list
Sims 4 DLC Unlocker.exe (PID: 3180)
Run PowerShell with an invisible window
powershell.exe (PID: 3860)
SUSPICIOUS
Reads security settings of Internet Explorer
WinRAR.exe (PID: 3048)
Reads the Internet Settings
Sims 4 DLC Unlocker.exe (PID: 3180)
powershell.exe (PID: 3860)
Reads the BIOS version
Sims 4 DLC Unlocker.exe (PID: 3180)
The process checks if it is being run in the virtual environment
Sims 4 DLC Unlocker.exe (PID: 3180)
Script adds exclusion path to Windows Defender
Sims 4 DLC Unlocker.exe (PID: 3180)
The process hide an interactive prompt from the user
Sims 4 DLC Unlocker.exe (PID: 3180)
Starts POWERSHELL.EXE for commands execution
Sims 4 DLC Unlocker.exe (PID: 3180)
Using PowerShell to operate with local accounts
powershell.exe (PID: 3860)
INFO
Reads the computer name
wmpnscfg.exe (PID: 2940)
Sims 4 DLC Unlocker.exe (PID: 3180)
Application launched itself
firefox.exe (PID: 3992)
firefox.exe (PID: 3976)
Checks supported languages
wmpnscfg.exe (PID: 2940)
Sims 4 DLC Unlocker.exe (PID: 3180)
Manual execution by a user
wmpnscfg.exe (PID: 2940)
WinRAR.exe (PID: 3048)
The process uses the downloaded file
firefox.exe (PID: 3992)
WinRAR.exe (PID: 3048)
Drops the executable file immediately after the start
WinRAR.exe (PID: 3048)
Executable content was dropped or overwritten
WinRAR.exe (PID: 3048)
Reads the machine GUID from the registry
Sims 4 DLC Unlocker.exe (PID: 3180)
Disables trace logs
Sims 4 DLC Unlocker.exe (PID: 3180)
Reads Environment values
Sims 4 DLC Unlocker.exe (PID: 3180)
Threats
No threats detected