Malware analysis e8cafd32f61d2f4dc1775b3b491c2ae67dc99eafab5e65d82228fc1d9cabbb9e.zip Malicious activity

Add for printing

File name:	e8cafd32f61d2f4dc1775b3b491c2ae67dc99eafab5e65d82228fc1d9cabbb9e.zip
Full analysis:	https://app.any.run/tasks/4bf6fc74-d4d8-4f39-85a9-9602c2f1d284
Verdict:	Malicious activity
Threats:	A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. Crypto mining malware is a resource-intensive threat that infiltrates computers with the purpose of mining cryptocurrencies. This type of threat can be deployed either on an infected machine or a compromised website. In both cases the miner will utilize the computing power of the device and its network bandwidth. Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying. Malware Trends Tracker >>>
Analysis date:	October 03, 2025, 17:29:58
OS:	Windows 10 Professional (build: 19044, 64 bit)
Tags:	arch-scr auto lcryx ransomware anti-evasion miner qrcode loader lcryptorx xmrig
Indicators:
MIME:	application/zip
File info:	Zip archive data, at least v5.1 to extract, compression method=AES Encrypted
MD5:	0384ED49668C0E156CB228EDDD8C0686
SHA1:	8DA856A80863D63FBB76283774FE9EAF4CC381C6
SHA256:	653071EDF14D02288D6E9FFAC3B498D8A99DF0E0A276724BC31C2972FB0526B4
SSDEEP:	192:XwF/JiHEOuBDdxQGbRxsEKM3J4kzVf/I5+lHbIxBCEJcamMCuNwT:sMuBJxQREK8JFlI8lEx8EKMCum

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 60 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: none
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (133.0.6943.127)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (133.0.3065.92)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (136.0)
Mozilla Maintenance Service (136.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- LCRYX has been found (auto)
  - WinRAR.exe (PID: 4284)
- Creates a new registry key or changes the value of an existing one (SCRIPT)
  - wscript.exe (PID: 2896)
- Changes the login/logoff helper path in the registry
  - wscript.exe (PID: 2896)
- UAC/LUA settings modification
  - wscript.exe (PID: 2896)
- Disables task manager
  - wscript.exe (PID: 2896)
- Disables the Run the Start menu
  - wscript.exe (PID: 2896)
- Changes image file execution options
  - wscript.exe (PID: 2896)
- Gets a file object corresponding to the file in a specified path (SCRIPT)
  - wscript.exe (PID: 2896)
- Changes Windows Defender settings
  - wscript.exe (PID: 2896)
- Changes settings for real-time protection
  - powershell.exe (PID: 4216)
- Accesses environment variables (SCRIPT)
  - wscript.exe (PID: 2896)
- Gets %appdata% folder path (SCRIPT)
  - wscript.exe (PID: 2896)
- Gets %windir% folder path (SCRIPT)
  - wscript.exe (PID: 2896)
- Gets path to any of the special folders (SCRIPT)
  - wscript.exe (PID: 2896)
- Gets startup folder path (SCRIPT)
  - wscript.exe (PID: 2896)
- Sends HTTP request (SCRIPT)
  - wscript.exe (PID: 2896)
  - wscript.exe (PID: 8836)
- Creates internet connection object (SCRIPT)
  - wscript.exe (PID: 2896)
  - wscript.exe (PID: 8836)
- Modifies registry startup key (SCRIPT)
  - wscript.exe (PID: 2896)
- Opens an HTTP connection (SCRIPT)
  - wscript.exe (PID: 2896)
  - wscript.exe (PID: 8836)
- Checks whether a specified folder exists (SCRIPT)
  - wscript.exe (PID: 2896)
- Queries network adapter information (Win32_NetworkAdapter) (SCRIPT)
  - wscript.exe (PID: 8836)
- Antivirus name has been found in the command line (generic signature)
  - taskkill.exe (PID: 9024)
  - taskkill.exe (PID: 9100)
  - taskkill.exe (PID: 9168)
  - taskkill.exe (PID: 8616)
  - taskkill.exe (PID: 8348)
  - taskkill.exe (PID: 8316)
  - taskkill.exe (PID: 8696)
  - taskkill.exe (PID: 8460)
  - taskkill.exe (PID: 8312)
  - taskkill.exe (PID: 8512)
  - taskkill.exe (PID: 7240)
  - taskkill.exe (PID: 8308)
  - taskkill.exe (PID: 9436)
  - taskkill.exe (PID: 9764)
  - taskkill.exe (PID: 9664)
  - taskkill.exe (PID: 9848)
  - taskkill.exe (PID: 9324)
  - taskkill.exe (PID: 9264)
  - taskkill.exe (PID: 9264)
  - taskkill.exe (PID: 7116)
- Uses TASKKILL.EXE to kill antiviruses
  - wscript.exe (PID: 8868)
- XMRig has been detected
  - WindowsUpdateService.exe (PID: 8644)
- Deletes shadow copies
  - cmd.exe (PID: 8648)
  - cmd.exe (PID: 8576)
- Deleting the backup catalog via wbadmin
  - cmd.exe (PID: 8576)
- Using BCDEDIT.EXE to modify recovery options
  - cmd.exe (PID: 6500)
  - cmd.exe (PID: 3268)
- Opens a text file (SCRIPT)
  - wscript.exe (PID: 2896)
- Deletes a file (SCRIPT)
  - wscript.exe (PID: 2896)
- LCRYPTORX has been detected
  - notepad.exe (PID: 8824)
  - notepad.exe (PID: 8572)
  - notepad.exe (PID: 5440)
  - wscript.exe (PID: 2896)
  - notepad.exe (PID: 8764)
  - notepad.exe (PID: 9160)
  - notepad.exe (PID: 8432)
  - notepad.exe (PID: 8520)
  - notepad.exe (PID: 9176)
  - notepad.exe (PID: 7036)
  - notepad.exe (PID: 8352)
  - notepad.exe (PID: 388)
  - notepad.exe (PID: 8776)
  - notepad.exe (PID: 384)
  - notepad.exe (PID: 9144)
  - notepad.exe (PID: 6380)
  - notepad.exe (PID: 9104)
  - notepad.exe (PID: 8312)
  - notepad.exe (PID: 8376)
  - notepad.exe (PID: 8488)
  - notepad.exe (PID: 7240)
  - notepad.exe (PID: 4384)
  - notepad.exe (PID: 9748)
  - notepad.exe (PID: 9660)
  - notepad.exe (PID: 9664)
  - notepad.exe (PID: 3708)
  - notepad.exe (PID: 9760)
  - notepad.exe (PID: 9816)
  - notepad.exe (PID: 7000)
  - notepad.exe (PID: 9924)
  - notepad.exe (PID: 9928)
  - notepad.exe (PID: 10004)
- Uses sleep, probably for evasion detection (SCRIPT)
  - wscript.exe (PID: 8940)
  - wscript.exe (PID: 8868)
SUSPICIOUS
- The process executes VB scripts
  - WinRAR.exe (PID: 4284)
  - wscript.exe (PID: 6720)
  - wscript.exe (PID: 2896)
- Application launched itself
  - wscript.exe (PID: 6720)
  - wscript.exe (PID: 2896)
- Uses WMI to retrieve WMI-managed resources (SCRIPT)
  - wscript.exe (PID: 2896)
  - wscript.exe (PID: 8904)
  - wscript.exe (PID: 8836)
  - wscript.exe (PID: 8940)
- Gets full path of the running script (SCRIPT)
  - wscript.exe (PID: 6720)
  - wscript.exe (PID: 2896)
  - wscript.exe (PID: 8904)
- Reads security settings of Internet Explorer
  - WinRAR.exe (PID: 4284)
- Runs shell command (SCRIPT)
  - wscript.exe (PID: 6720)
  - wscript.exe (PID: 2896)
  - wscript.exe (PID: 8836)
  - wscript.exe (PID: 8868)
- Executes WMI query (SCRIPT)
  - wscript.exe (PID: 2896)
  - wscript.exe (PID: 8836)
  - wscript.exe (PID: 8940)
- Script disables Windows Defender's real-time protection
  - wscript.exe (PID: 2896)
- Creates FileSystem object to access computer's file system (SCRIPT)
  - wscript.exe (PID: 2896)
  - wscript.exe (PID: 8904)
- Starts POWERSHELL.EXE for commands execution
  - wscript.exe (PID: 2896)
- Starts CMD.EXE for commands execution
  - wscript.exe (PID: 2896)
- Found strings related to reading or modifying Windows Defender settings
  - wscript.exe (PID: 2896)
- The process verifies whether the antivirus software is installed
  - cmd.exe (PID: 8452)
  - cmd.exe (PID: 8520)
- Uses NETSH.EXE to change the status of the firewall
  - cmd.exe (PID: 8588)
- Accesses current user name via WMI (SCRIPT)
  - wscript.exe (PID: 2896)
- Creates file in the systems drive root
  - wscript.exe (PID: 2896)
- Writes binary data to a Stream object (SCRIPT)
  - wscript.exe (PID: 2896)
- Changes the desktop background image
  - wscript.exe (PID: 2896)
- Creates a Stream, which may work with files, input/output devices, pipes, or TCP/IP sockets (SCRIPT)
  - wscript.exe (PID: 2896)
- Saves data to a binary file (SCRIPT)
  - wscript.exe (PID: 2896)
- Uses RUNDLL32.EXE to load library
  - wscript.exe (PID: 2896)
- Executing commands from a ".bat" file
  - wscript.exe (PID: 2896)
- Checks whether a specific file exists (SCRIPT)
  - wscript.exe (PID: 2896)
- Modifies hosts file to alter network resolution
  - wscript.exe (PID: 2896)
- Accesses default IP gateways via WMI (SCRIPT)
  - wscript.exe (PID: 8836)
- Uses TASKKILL.EXE to kill process
  - wscript.exe (PID: 8868)
- Hides command output
  - PING.EXE (PID: 9152)
  - PING.EXE (PID: 9168)
- Adds, changes, or deletes HTTP request header (SCRIPT)
  - wscript.exe (PID: 8836)
- Potential Corporate Privacy Violation
  - wscript.exe (PID: 2896)
- Executable content was dropped or overwritten
  - wscript.exe (PID: 2896)
- Crypto Currency Mining Activity Detected
  - wscript.exe (PID: 2896)
- Executes as Windows Service
  - wbengine.exe (PID: 8704)
  - vds.exe (PID: 9136)
- System recovery suppression via bcdedit.exe
  - wscript.exe (PID: 2896)
  - cmd.exe (PID: 3268)
- Uses REG/REGEDIT.EXE to modify registry
  - cmd.exe (PID: 8780)
- Reads data from a binary Stream object (SCRIPT)
  - wscript.exe (PID: 2896)
- Access the System.Security .NET namespace (SCRIPT)
  - wscript.exe (PID: 2896)
INFO
- Reads security settings of Internet Explorer
  - BackgroundTransferHost.exe (PID: 6176)
  - BackgroundTransferHost.exe (PID: 2276)
  - BackgroundTransferHost.exe (PID: 2164)
  - BackgroundTransferHost.exe (PID: 6080)
  - BackgroundTransferHost.exe (PID: 5636)
  - notepad.exe (PID: 8720)
  - notepad.exe (PID: 8572)
  - notepad.exe (PID: 8764)
  - notepad.exe (PID: 5440)
  - notepad.exe (PID: 8824)
  - notepad.exe (PID: 8432)
  - notepad.exe (PID: 8520)
  - notepad.exe (PID: 9160)
  - notepad.exe (PID: 9176)
  - notepad.exe (PID: 7036)
  - notepad.exe (PID: 8352)
  - notepad.exe (PID: 8776)
  - notepad.exe (PID: 388)
  - notepad.exe (PID: 384)
  - notepad.exe (PID: 9144)
  - notepad.exe (PID: 6380)
  - notepad.exe (PID: 8376)
  - notepad.exe (PID: 9104)
  - notepad.exe (PID: 8488)
  - notepad.exe (PID: 4384)
  - notepad.exe (PID: 7240)
  - notepad.exe (PID: 8312)
  - notepad.exe (PID: 9748)
  - notepad.exe (PID: 9660)
  - notepad.exe (PID: 9664)
  - notepad.exe (PID: 3708)
  - notepad.exe (PID: 7000)
  - notepad.exe (PID: 9760)
  - notepad.exe (PID: 9816)
  - notepad.exe (PID: 9924)
  - notepad.exe (PID: 9928)
  - notepad.exe (PID: 10004)
- Creates files or folders in the user directory
  - BackgroundTransferHost.exe (PID: 2276)
- Reads the software policy settings
  - BackgroundTransferHost.exe (PID: 2276)
- Checks proxy server information
  - BackgroundTransferHost.exe (PID: 2276)
- Reads Microsoft Office registry keys
  - WinRAR.exe (PID: 4284)
- Checks if a key exists in the options dictionary (POWERSHELL)
  - powershell.exe (PID: 4216)
- Script raised an exception (POWERSHELL)
  - powershell.exe (PID: 4216)
- Checks supported languages
  - WindowsUpdateService.exe (PID: 8644)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.zip	\|	ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion:	51
ZipBitFlag:	0x0003
ZipCompression:	Unknown (99)
ZipModifyDate:	2025:10:03 17:29:12
ZipCRC:	0x01a7529a
ZipCompressedSize:	6757
ZipUncompressedSize:	30847
ZipFileName:	e8cafd32f61d2f4dc1775b3b491c2ae67dc99eafab5e65d82228fc1d9cabbb9e.vbs

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

426

Monitored processes

256

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

380

"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} safeboot minimal

C:\Windows\System32\cmd.exe

—

wscript.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Windows Command Processor

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll

384

\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Console Window Host

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

384

"C:\Windows\System32\notepad.exe" "C:\Users\admin\Documents\chiefcup.rtf.lcryptx"

C:\Windows\System32\notepad.exe

wscript.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Notepad

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll

388

"C:\Windows\System32\notepad.exe" "C:\Users\admin\Desktop\tooclick.rtf.lcryptx"

C:\Windows\System32\notepad.exe

wscript.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Notepad

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll

520

\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

—

taskkill.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Console Window Host

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

992

\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

—

taskkill.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Console Window Host

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

1400

"C:\Windows\System32\taskkill.exe" /IM avguard.exe /F

C:\Windows\System32\taskkill.exe

—

wscript.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Terminates Processes

Exit code:

128

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll

1636

\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

—

taskkill.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Console Window Host

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

2164

"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1

C:\Windows\System32\BackgroundTransferHost.exe

—

svchost.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Download/Upload Host

Exit code:

Version:

10.0.19041.3636 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll

2164

\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

—

taskkill.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Console Window Host

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

Add for printing

Total events

36 380

Read events

36 251

Write events

108

Delete events

Modification events


(PID) Process:	(4284) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:	write	Name:	ShellExtBMP
Value:
(PID) Process:	(4284) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:	write	Name:	ShellExtIcon
Value:
(PID) Process:	(4284) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:	write	Name:	3
Value: C:\Users\admin\Desktop\preferences.zip
(PID) Process:	(4284) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:	write	Name:	2
Value: C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:	(4284) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:	write	Name:	1
Value: C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:	(4284) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:	write	Name:	0
Value: C:\Users\admin\Desktop\e8cafd32f61d2f4dc1775b3b491c2ae67dc99eafab5e65d82228fc1d9cabbb9e.zip
(PID) Process:	(4284) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	name
Value: 120
(PID) Process:	(4284) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	size
Value: 80
(PID) Process:	(4284) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	type
Value: 120
(PID) Process:	(4284) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	mtime
Value: 100

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
2276	BackgroundTransferHost.exe	C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\ea757f1d-89f1-4336-8d19-cbb53fcd1adb.down_data		—
		MD5:—	SHA256:—
2276	BackgroundTransferHost.exe	C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\ea757f1d-89f1-4336-8d19-cbb53fcd1adb.f08b23ac-5132-4203-a14b-c4b4a3bce972.down_meta		binary
		MD5:D68BC86FB53A536651DE1D73ECDDE877	SHA256:3538979EB6F2194B058D2558F61285319B802FED34C29EEB919AB6AA64004786
2276	BackgroundTransferHost.exe	C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\808b27ed-a863-4873-9737-4a2f617e001c.up_meta_secure		binary
		MD5:74365473A0053454AA6CF10FAADDE118	SHA256:14E36F7DCF3E37AC1BF60197D3B862BCBC7CA3DC70B5DEE04BDE4655186287E7
4284	WinRAR.exe	C:\Users\admin\AppData\Local\Temp\Rar$DIb4284.25767\e8cafd32f61d2f4dc1775b3b491c2ae67dc99eafab5e65d82228fc1d9cabbb9e.vbs		text
		MD5:BD9B33D87C168387B1D3532266C8CCE1	SHA256:E8CAFD32F61D2F4DC1775B3B491C2AE67DC99EAFAB5E65D82228FC1D9CABBB9E
4216	powershell.exe	C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_3ojkpsah.5re.psm1		text
		MD5:D17FE0A3F47BE24A6453E9EF58C94641	SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
4216	powershell.exe	C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_nn04ce53.qpy.ps1		text
		MD5:D17FE0A3F47BE24A6453E9EF58C94641	SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
2276	BackgroundTransferHost.exe	C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D		binary
		MD5:A2459D8C15651BB81784468BC907C939	SHA256:E6360479BE8038E7443DA1855F01EC552F1B602A656A2BF713C1CD760B7CB6C8
2276	BackgroundTransferHost.exe	C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D		binary
		MD5:AF8E2C3F30874418371099E11E9FB8B8	SHA256:2C3F71773DC6892CEF969EE60798AD2C4F65424D7E1ADD1C0EC9304B0FF6F4BE
2276	BackgroundTransferHost.exe	C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\808b27ed-a863-4873-9737-4a2f617e001c.f08b23ac-5132-4203-a14b-c4b4a3bce972.down_meta		binary
		MD5:D68BC86FB53A536651DE1D73ECDDE877	SHA256:3538979EB6F2194B058D2558F61285319B802FED34C29EEB919AB6AA64004786
2896	wscript.exe	C:\Users\admin\Downloads\PLEASEREADME.txt		text
		MD5:BDB08C40728C362E252ED25FD3A24F2B	SHA256:FE86632850D4A90FA22A0B1682D2923E3108049704063E827BC0ADC4F603614A

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
4928	svchost.exe	GET	200	162.159.142.9:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	binary	471 b	whitelisted
2884	backgroundTaskHost.exe	GET	200	162.159.142.9:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	binary	471 b	whitelisted
4976	backgroundTaskHost.exe	GET	200	162.159.142.9:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D	unknown	binary	313 b	whitelisted
4928	svchost.exe	GET	200	162.159.142.9:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	binary	471 b	whitelisted
1928	backgroundTaskHost.exe	GET	200	162.159.142.9:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	binary	471 b	whitelisted
2276	BackgroundTransferHost.exe	GET	200	162.159.142.9:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D	unknown	binary	313 b	whitelisted
2896	wscript.exe	GET	200	142.250.184.196:80	http://www.google.com/	US	html	30.9 Kb	whitelisted
2896	wscript.exe	GET	200	142.250.184.196:80	http://www.google.com/	US	html	30.9 Kb	whitelisted
2896	wscript.exe	GET	200	142.250.184.196:80	http://www.google.com/	US	html	30.9 Kb	whitelisted
2896	wscript.exe	GET	200	78.153.140.66:80	http://78.153.140.66/xmrig.exe	RU	executable	4.37 Mb	unknown

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:137	—	—	—	whitelisted
6016	MoUsoCoreWorker.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
6080	RUXIMICS.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
5224	SearchApp.exe	23.192.36.142:443	www.bing.com	AKAMAI-AS	US	whitelisted
4928	svchost.exe	20.190.160.128:443	login.live.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4928	svchost.exe	162.159.142.9:80	ocsp.digicert.com	CLOUDFLARENET	—	whitelisted
4976	backgroundTaskHost.exe	23.192.36.142:443	www.bing.com	AKAMAI-AS	US	whitelisted
3464	svchost.exe	172.211.123.248:443	client.wns.windows.com	MICROSOFT-CORP-MSN-AS-BLOCK	FR	whitelisted
4976	backgroundTaskHost.exe	162.159.142.9:80	ocsp.digicert.com	CLOUDFLARENET	—	whitelisted

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	4.231.128.59 20.73.194.208	whitelisted
google.com	142.250.185.206	whitelisted
www.bing.com	23.192.36.142 23.192.36.137	whitelisted
login.live.com	20.190.160.128 20.190.160.22 40.126.32.138 40.126.32.136 20.190.160.3 40.126.32.140 20.190.160.64 20.190.160.20	whitelisted
ocsp.digicert.com	162.159.142.9 172.66.2.5	whitelisted
client.wns.windows.com	172.211.123.248	whitelisted
arc.msn.com	20.223.35.26 20.103.156.88	whitelisted
fd.api.iris.microsoft.com	20.223.36.55	whitelisted
slscr.update.microsoft.com	135.233.95.144	whitelisted
fe3cr.delivery.mp.microsoft.com	40.69.42.241	whitelisted

Threats

PID	Process	Class	Message
2896	wscript.exe	Not Suspicious Traffic	INFO [ANY.RUN] Image hosting service ImgBB
2896	wscript.exe	Potentially Bad Traffic	ET INFO Executable Download from dotted-quad Host
2896	wscript.exe	Misc activity	ET INFO WinHttpRequest Downloading EXE
2896	wscript.exe	Misc Attack	ET DROP Spamhaus DROP Listed Traffic Inbound group 9
2896	wscript.exe	Potentially Bad Traffic	ET HUNTING Request for EXE via WinHTTP M1
2896	wscript.exe	Crypto Currency Mining Activity Detected	MINER [ANY.RUN] Request Coinminer Xmrig
2896	wscript.exe	Potential Corporate Privacy Violation	ET INFO PE EXE or DLL Windows file download HTTP
2896	wscript.exe	Potentially Bad Traffic	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response

Add for printing

Process	Message
wbadmin.exe	Invalid parameter passed to C runtime function.

General Info

e8cafd32f61d2f4dc1775b3b491c2ae67dc99eafab5e65d82228fc1d9cabbb9e.zip

0384ED49668C0E156CB228EDDD8C0686

8DA856A80863D63FBB76283774FE9EAF4CC381C6

653071EDF14D02288D6E9FFAC3B498D8A99DF0E0A276724BC31C2972FB0526B4

192:XwF/JiHEOuBDdxQGbRxsEKM3J4kzVf/I5+lHbIxBCEJcamMCuNwT:sMuBJxQREK8JFlI8lEx8EKMCum

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

LCRYX has been found (auto)

Creates a new registry key or changes the value of an existing one (SCRIPT)

Changes the login/logoff helper path in the registry

UAC/LUA settings modification

Disables task manager

Disables the Run the Start menu

Changes image file execution options

Gets a file object corresponding to the file in a specified path (SCRIPT)

Changes Windows Defender settings

Changes settings for real-time protection

Accesses environment variables (SCRIPT)

Gets %appdata% folder path (SCRIPT)

Gets %windir% folder path (SCRIPT)

Gets path to any of the special folders (SCRIPT)

Gets startup folder path (SCRIPT)

Sends HTTP request (SCRIPT)

Creates internet connection object (SCRIPT)

Modifies registry startup key (SCRIPT)

Opens an HTTP connection (SCRIPT)

Checks whether a specified folder exists (SCRIPT)

Queries network adapter information (Win32_NetworkAdapter) (SCRIPT)

Antivirus name has been found in the command line (generic signature)

Uses TASKKILL.EXE to kill antiviruses

XMRig has been detected

Deletes shadow copies

Deleting the backup catalog via wbadmin

Using BCDEDIT.EXE to modify recovery options

Opens a text file (SCRIPT)

Deletes a file (SCRIPT)

LCRYPTORX has been detected

Uses sleep, probably for evasion detection (SCRIPT)

SUSPICIOUS

The process executes VB scripts

Application launched itself

Uses WMI to retrieve WMI-managed resources (SCRIPT)

Gets full path of the running script (SCRIPT)

Reads security settings of Internet Explorer

Runs shell command (SCRIPT)

Executes WMI query (SCRIPT)

Script disables Windows Defender's real-time protection

Creates FileSystem object to access computer's file system (SCRIPT)

Starts POWERSHELL.EXE for commands execution

Starts CMD.EXE for commands execution

Found strings related to reading or modifying Windows Defender settings

The process verifies whether the antivirus software is installed

Uses NETSH.EXE to change the status of the firewall

Accesses current user name via WMI (SCRIPT)

Creates file in the systems drive root

Writes binary data to a Stream object (SCRIPT)

Changes the desktop background image

Creates a Stream, which may work with files, input/output devices, pipes, or TCP/IP sockets (SCRIPT)

Saves data to a binary file (SCRIPT)

Uses RUNDLL32.EXE to load library

Executing commands from a ".bat" file

Checks whether a specific file exists (SCRIPT)

Modifies hosts file to alter network resolution

Accesses default IP gateways via WMI (SCRIPT)

Uses TASKKILL.EXE to kill process

Hides command output

Adds, changes, or deletes HTTP request header (SCRIPT)

Potential Corporate Privacy Violation

Executable content was dropped or overwritten

Crypto Currency Mining Activity Detected

Executes as Windows Service

System recovery suppression via bcdedit.exe

Uses REG/REGEDIT.EXE to modify registry

Reads data from a binary Stream object (SCRIPT)

Access the System.Security .NET namespace (SCRIPT)