File name:

Aspect Script Executor.zip

Full analysis: https://app.any.run/tasks/6bf47791-0be2-46c1-b510-b26bf2ff6940
Verdict: Malicious activity
Analysis date: April 17, 2025, 22:35:13
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract, compression method=store
MD5:

36459710B2CAA419CB5B4CBACBCF5D33

SHA1:

0417CD3D9B204B43B8D6B38B0594BC495DE9D561

SHA256:

739CA7027B9E0EED76B5382F2F0297A051E9DC8142483E190C88E63E739D8767

SSDEEP:

98304:F/b6EtxpzjVa0cc+O1wf62QyV0MUa6Am9Uo8qihOrnStI3/EQMLCHqZKIngLTG79:TyhDSIfkI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 7352)

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • Aspect Script Executor.exe (PID: 7736)
      • Aspect Script Executor.exe (PID: 2284)

    • Reads security settings of Internet Explorer

      • Aspect Script Executor.exe (PID: 7736)
      • WinRAR.exe (PID: 7352)
      • Aspect Script Executor.exe (PID: 2284)

    • Reads Internet Explorer settings

      • Aspect Script Executor.exe (PID: 7736)
      • Aspect Script Executor.exe (PID: 2284)

    • Executable content was dropped or overwritten

      • Aspect Script Executor.exe (PID: 7736)

    • Drops 7-zip archiver for unpacking

      • Aspect Script Executor.exe (PID: 7736)

  • INFO

    • The sample compiled with english language support

      • WinRAR.exe (PID: 7352)
      • Aspect Script Executor.exe (PID: 7736)

    • Checks supported languages

      • Aspect Script Executor.exe (PID: 7736)
      • Aspect Script Executor.exe (PID: 2284)

    • Reads the computer name

      • Aspect Script Executor.exe (PID: 7736)
      • Aspect Script Executor.exe (PID: 2284)

    • Checks proxy server information

      • Aspect Script Executor.exe (PID: 7736)
      • Aspect Script Executor.exe (PID: 2284)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 7352)

    • Creates files in the program directory

      • Aspect Script Executor.exe (PID: 7736)

    • The sample compiled with russian language support

      • Aspect Script Executor.exe (PID: 7736)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xpi | Mozilla Firefox browser extension (66.6)
.zip | ZIP compressed archive (33.3)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2025:04:17 22:34:42
ZipCRC: 0x55fb9f36
ZipCompressedSize: 3579880
ZipUncompressedSize: 3579880
ZipFileName: Aspect Script Executor.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
140
Monitored processes
7
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe no specs aspect script executor.exe no specs aspect script executor.exe aspect script executor.exe no specs aspect script executor.exe

Process information

PID
CMD
Path
Indicators
Parent process
2284"C:\Users\admin\AppData\Local\Temp\Rar$EXa7352.15183\Aspect Script Executor.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa7352.15183\Aspect Script Executor.exe
WinRAR.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
HIGH
Description:
WinRAR archiver
Exit code:
255
Version:
6.24.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa7352.15183\aspect script executor.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.3996_none_91a79472cc852ba0\gdiplus.dll
7232"C:\Users\admin\AppData\Local\Temp\Rar$EXa7352.15183\Aspect Script Executor.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa7352.15183\Aspect Script Executor.exe—WinRAR.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
3221226540
Version:
6.24.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa7352.15183\aspect script executor.exe
c:\windows\system32\ntdll.dll
7352"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Aspect Script Executor.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
7472C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7504"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7672"C:\Users\admin\AppData\Local\Temp\Rar$EXa7352.13735\Aspect Script Executor.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa7352.13735\Aspect Script Executor.exe—WinRAR.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
3221226540
Version:
6.24.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa7352.13735\aspect script executor.exe
c:\windows\system32\ntdll.dll
7736"C:\Users\admin\AppData\Local\Temp\Rar$EXa7352.13735\Aspect Script Executor.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa7352.13735\Aspect Script Executor.exe
WinRAR.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
HIGH
Description:
WinRAR archiver
Exit code:
9
Version:
6.24.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa7352.13735\aspect script executor.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
3 416
Read events
3 387
Write events
25
Delete events
4

Modification events

(PID) Process:(7352) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(7352) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(7352) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(7352) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Aspect Script Executor.zip
(PID) Process:(7352) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7352) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(7352) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(7352) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(7736) Aspect Script Executor.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7736) Aspect Script Executor.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
Executable files
15
Suspicious files
3
Text files
11
Unknown types
0

Dropped files

PID
Process
Filename
Type
7736Aspect Script Executor.exeC:\Program Files\WinRAR\Descript.iontext
MD5:3FB658E292A09D2303B6D84FAF079E0C
SHA256:FA7BFC756E502CA814F927130574CBB472FC8B9C608F98B470409E7D8D1AD30D
7352WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7352.13735\Aspect Script Executor.exeexecutable
MD5:15596B41DBA42CDCCE4F677FBBC86B6E
SHA256:377ABC9D367E61CB5C4761BF48DCFDF5BCD3822F303E0F972D7F4C8295A2EA79
7736Aspect Script Executor.exeC:\Program Files\WinRAR\Rar.exeexecutable
MD5:F7C0C38BDF23992FC92CA8A55AFA28F2
SHA256:A9CEC009503D067F241B5EDDAEA4E42C38EDCB0B57C1B46E946C5281B7F1EA21
7736Aspect Script Executor.exeC:\Program Files\WinRAR\WhatsNew.txttext
MD5:C78A76E698514A835452DE89025B7778
SHA256:BF30A7D667B61A90BC00908317D96599386C841759540BDB74CA249E28EC8624
7736Aspect Script Executor.exeC:\Program Files\WinRAR\ReadMe.txttext
MD5:00D0A57A6D64EE3DE8F4D5529D6C6447
SHA256:FCD13E1B97AF47B8B923BA97AE15E9731C66093609667C3171D5DD24A6F7F2E6
7736Aspect Script Executor.exeC:\Program Files\WinRAR\Rar.txttext
MD5:B689A0CB8C288849FEBFFAFC2144576B
SHA256:59334A8FFFF612755A64A912389BC23FBC35933CF209F845BDE34F055011B8A6
7736Aspect Script Executor.exeC:\Program Files\WinRAR\RarFiles.lsttext
MD5:08EA0309D72A874C182F08CBF9DA2CC3
SHA256:12787F8204EEDB0B8BDABF5D68D557334FDDB2D70B46E1422510713DDA5E6A01
7736Aspect Script Executor.exeC:\Program Files\WinRAR\Order.htmhtml
MD5:5C336DE3B3D794322AD9E5915E3A509F
SHA256:BCE29EF3B95306CB7B304FB8C3039BE7157356D9F9D4E7E1C6BFBF02A117F48F
7736Aspect Script Executor.exeC:\Program Files\WinRAR\Uninstall.exeexecutable
MD5:8E1A194CDB986B277E44AFBF419D0BD7
SHA256:FD934C3B663679041B82C12D60B14C51060D8D04742612ED5F9CFA82CCCF1D37
7736Aspect Script Executor.exeC:\Program Files\WinRAR\RarExtInstaller.exeexecutable
MD5:1E1CAC0725CF47E62EA96669EAC678FC
SHA256:48B44BD3342A68ECBBD40A485930A22E02FDF157B2939EE346C2B123F6D5E99C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
18
DNS requests
13
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
23.216.77.25:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4560
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4560
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.216.77.25:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6404
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2112
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.71:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
google.com
  • 142.250.185.78
whitelisted
crl.microsoft.com
  • 23.216.77.25
  • 23.216.77.22
  • 23.216.77.30
  • 23.216.77.18
  • 23.216.77.19
  • 23.216.77.37
  • 23.216.77.29
  • 23.216.77.28
  • 23.216.77.15
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.159.71
  • 40.126.31.3
  • 40.126.31.69
  • 40.126.31.2
  • 20.190.159.75
  • 20.190.159.129
  • 20.190.159.4
  • 40.126.31.129
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Aspect Script Executor.zip