File name:

Lua-Bytecode-Deobfuscator-master.zip

Full analysis: https://app.any.run/tasks/0fa66ddc-4c06-40a8-bd23-66de0414a89a
Verdict: Malicious activity
Analysis date: December 05, 2022, 19:36:04
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

05CB18FA5D288A7C99300812340657DB

SHA1:

4611AF5AED4D47A27CD6D3FC0ACE2D0D27875B2C

SHA256:

7226AA010F27586FE20C623B6C2F78CBA6A887E897EEA5FC4927A27FDED1D2C4

SSDEEP:

196608:cj71AoQc3sVmzvrPDOvBn8cAuutXP9njdbL:OxSisVuvi18IsXP9hf

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 2588)
  • SUSPICIOUS

    No suspicious indicators.
  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1880)
    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 1880)
    • Drops a file that was compiled in debug mode

      • WinRAR.exe (PID: 1880)
    • Manual execution by a user

      • notepad++.exe (PID: 2608)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe searchprotocolhost.exe no specs notepad++.exe

Process information

PID
CMD
Path
Indicators
Parent process
1880"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Lua-Bytecode-Deobfuscator-master.zip"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2588"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\system32\SearchProtocolHost.exeSearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Version:
7.00.7601.24542 (win7sp1_ldr_escrow.191209-2211)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2608"C:\Program Files\Notepad++\notepad++.exe" "C:\Users\admin\Desktop\Lua-Bytecode-Deobfuscator-master\Lua_Byte_Deobfuscator.sln"C:\Program Files\Notepad++\notepad++.exe
Explorer.EXE
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Notepad++ : a free (GNU) source code editor
Exit code:
0
Version:
7.91
Modules
Images
c:\program files\notepad++\notepad++.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
1 841
Read events
1 801
Write events
40
Delete events
0

Modification events

(PID) Process:(1880) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1880) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1880) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1880) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(1880) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(1880) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Lua-Bytecode-Deobfuscator-master.zip
(PID) Process:(1880) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1880) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1880) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1880) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
13
Suspicious files
3
Text files
37
Unknown types
13

Dropped files

PID
Process
Filename
Type
1880WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1880.46076\Lua-Bytecode-Deobfuscator-master\Lua_Byte_Deobfuscator\App.configxml
MD5:9DBAD5517B46F41DBB0D8780B20AB87E
SHA256:47E5A0F101AF4151D7F13D2D6BFA9B847D5B5E4A98D1F4674B7C015772746CDF
1880WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1880.46076\Lua-Bytecode-Deobfuscator-master\.github\FUNDING.ymltext
MD5:158356FBFCAC635B2B5F2B38390890E0
SHA256:E211C805958995457866233C292CD74595647A921668701B3FE94EE0C0783F67
1880WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1880.46076\Lua-Bytecode-Deobfuscator-master\Lua_Byte_Deobfuscator.slntext
MD5:B9CC73B8A57C5B6DC203FF4E643985F5
SHA256:5FD3C0FECB1E3D0639032708D6F92B0C7189946BD55421962FEBBEDE9E010833
1880WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1880.46076\Lua-Bytecode-Deobfuscator-master\Lua_Byte_Deobfuscator\ILMergeOrder.txttext
MD5:4039488988564A2E97333B547669484B
SHA256:3B3BA224A8BB02DF99E564B6EF0E3DB3C532CD4C5A2ABE6343EA9B87672AF1D7
1880WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1880.46076\Lua-Bytecode-Deobfuscator-master\Lua_Byte_Deobfuscator\Program.cstext
MD5:4527E6E99A32C654A4A32611ED57D04C
SHA256:96AB546541212DCEF16D7DBFD35BEB5E31E7EE97FEC08E9BFE5BD9C2B6F78AD0
1880WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1880.46076\Lua-Bytecode-Deobfuscator-master\Lua_Byte_Deobfuscator\ILMerge.propsxml
MD5:108BA230E8B5A32D0C88A5CAABB91A5C
SHA256:6597EB4CE26D7631925B7855D878358F882BFC2DA225D728C2B2139F29D93C6D
1880WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1880.46076\Lua-Bytecode-Deobfuscator-master\Lua_Byte_Deobfuscator\Lua_Byte_Deobfuscator.csprojxml
MD5:2DE2C725A4D6D8366A4E0B9E2F47B80E
SHA256:D66308959F1F671B2BF4D0C4D3F37248477162BDB0E90148496BDCE0EAD886ED
1880WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1880.46076\Lua-Bytecode-Deobfuscator-master\Lua_Byte_Deobfuscator\Properties\AssemblyInfo.cstext
MD5:6D1FD4A6CDF8B7236065E28AB6B79FD0
SHA256:B5927DFBB413765CDF9536695D18E78752EE8B70355977855622989F550C4669
1880WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1880.46076\Lua-Bytecode-Deobfuscator-master\Lua_Byte_Deobfuscator\bin\Debug\Lua_Byte_Deobfuscator.exe.configxml
MD5:9DBAD5517B46F41DBB0D8780B20AB87E
SHA256:47E5A0F101AF4151D7F13D2D6BFA9B847D5B5E4A98D1F4674B7C015772746CDF
1880WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1880.46076\Lua-Bytecode-Deobfuscator-master\Lua_Byte_Deobfuscator\bin\Debug\main.luatext
MD5:2C7BB39DFB7E876B543B52E97EC7C616
SHA256:89B9B1D1F8306E02E9CB71DEA80E4C124807200FDEE61B3695EF53F06FF0E549
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
Process
Message
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\updater\gup.exe
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\plugins\Config\nppPluginList.dll
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\updater\gup.exe