File name:

Aspect Script Executor.zip

Full analysis: https://app.any.run/tasks/6bf47791-0be2-46c1-b510-b26bf2ff6940
Verdict: Malicious activity
Analysis date: April 17, 2025, 22:35:13
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract, compression method=store
MD5:

36459710B2CAA419CB5B4CBACBCF5D33

SHA1:

0417CD3D9B204B43B8D6B38B0594BC495DE9D561

SHA256:

739CA7027B9E0EED76B5382F2F0297A051E9DC8142483E190C88E63E739D8767

SSDEEP:

98304:F/b6EtxpzjVa0cc+O1wf62QyV0MUa6Am9Uo8qihOrnStI3/EQMLCHqZKIngLTG79:TyhDSIfkI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 7352)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 7352)
      • Aspect Script Executor.exe (PID: 7736)
      • Aspect Script Executor.exe (PID: 2284)

    • Reads Microsoft Outlook installation path

      • Aspect Script Executor.exe (PID: 7736)
      • Aspect Script Executor.exe (PID: 2284)

    • Reads Internet Explorer settings

      • Aspect Script Executor.exe (PID: 7736)
      • Aspect Script Executor.exe (PID: 2284)

    • Executable content was dropped or overwritten

      • Aspect Script Executor.exe (PID: 7736)

    • Drops 7-zip archiver for unpacking

      • Aspect Script Executor.exe (PID: 7736)

  • INFO

    • The sample compiled with english language support

      • WinRAR.exe (PID: 7352)
      • Aspect Script Executor.exe (PID: 7736)

    • Checks supported languages

      • Aspect Script Executor.exe (PID: 7736)
      • Aspect Script Executor.exe (PID: 2284)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 7352)

    • Reads the computer name

      • Aspect Script Executor.exe (PID: 7736)
      • Aspect Script Executor.exe (PID: 2284)

    • Checks proxy server information

      • Aspect Script Executor.exe (PID: 7736)
      • Aspect Script Executor.exe (PID: 2284)

    • Creates files in the program directory

      • Aspect Script Executor.exe (PID: 7736)

    • The sample compiled with russian language support

      • Aspect Script Executor.exe (PID: 7736)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xpi | Mozilla Firefox browser extension (66.6)
.zip | ZIP compressed archive (33.3)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2025:04:17 22:34:42
ZipCRC: 0x55fb9f36
ZipCompressedSize: 3579880
ZipUncompressedSize: 3579880
ZipFileName: Aspect Script Executor.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
140
Monitored processes
7
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe no specs aspect script executor.exe no specs aspect script executor.exe aspect script executor.exe no specs aspect script executor.exe

Process information

PID
CMD
Path
Indicators
Parent process
2284"C:\Users\admin\AppData\Local\Temp\Rar$EXa7352.15183\Aspect Script Executor.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa7352.15183\Aspect Script Executor.exe
WinRAR.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
HIGH
Description:
WinRAR archiver
Exit code:
255
Version:
6.24.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa7352.15183\aspect script executor.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.3996_none_91a79472cc852ba0\gdiplus.dll
7232"C:\Users\admin\AppData\Local\Temp\Rar$EXa7352.15183\Aspect Script Executor.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa7352.15183\Aspect Script Executor.exe—WinRAR.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
3221226540
Version:
6.24.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa7352.15183\aspect script executor.exe
c:\windows\system32\ntdll.dll
7352"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Aspect Script Executor.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
7472C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7504"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7672"C:\Users\admin\AppData\Local\Temp\Rar$EXa7352.13735\Aspect Script Executor.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa7352.13735\Aspect Script Executor.exe—WinRAR.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
3221226540
Version:
6.24.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa7352.13735\aspect script executor.exe
c:\windows\system32\ntdll.dll
7736"C:\Users\admin\AppData\Local\Temp\Rar$EXa7352.13735\Aspect Script Executor.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa7352.13735\Aspect Script Executor.exe
WinRAR.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
HIGH
Description:
WinRAR archiver
Exit code:
9
Version:
6.24.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa7352.13735\aspect script executor.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
3 416
Read events
3 387
Write events
25
Delete events
4

Modification events

(PID) Process:(7352) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(7352) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(7352) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(7352) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Aspect Script Executor.zip
(PID) Process:(7352) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7352) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(7352) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(7352) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(7736) Aspect Script Executor.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7736) Aspect Script Executor.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
Executable files
15
Suspicious files
3
Text files
11
Unknown types
0

Dropped files

PID
Process
Filename
Type
7736Aspect Script Executor.exeC:\Program Files\WinRAR\Rar.exeexecutable
MD5:F7C0C38BDF23992FC92CA8A55AFA28F2
SHA256:A9CEC009503D067F241B5EDDAEA4E42C38EDCB0B57C1B46E946C5281B7F1EA21
7352WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7352.13735\Aspect Script Executor.exeexecutable
MD5:15596B41DBA42CDCCE4F677FBBC86B6E
SHA256:377ABC9D367E61CB5C4761BF48DCFDF5BCD3822F303E0F972D7F4C8295A2EA79
7736Aspect Script Executor.exeC:\Program Files\WinRAR\RarFiles.lsttext
MD5:08EA0309D72A874C182F08CBF9DA2CC3
SHA256:12787F8204EEDB0B8BDABF5D68D557334FDDB2D70B46E1422510713DDA5E6A01
7736Aspect Script Executor.exeC:\Program Files\WinRAR\Uninstall.lsttext
MD5:D2098C2817A55B955B39D504B5A460D9
SHA256:2A0A49154CFF5F00F85A14DD2AC65050638D11E3B6C2177CE45ABE8E7DD92353
7736Aspect Script Executor.exeC:\Program Files\WinRAR\Order.htmhtml
MD5:5C336DE3B3D794322AD9E5915E3A509F
SHA256:BCE29EF3B95306CB7B304FB8C3039BE7157356D9F9D4E7E1C6BFBF02A117F48F
7736Aspect Script Executor.exeC:\Program Files\WinRAR\Rar.txttext
MD5:B689A0CB8C288849FEBFFAFC2144576B
SHA256:59334A8FFFF612755A64A912389BC23FBC35933CF209F845BDE34F055011B8A6
7736Aspect Script Executor.exeC:\Program Files\WinRAR\WhatsNew.txttext
MD5:C78A76E698514A835452DE89025B7778
SHA256:BF30A7D667B61A90BC00908317D96599386C841759540BDB74CA249E28EC8624
7736Aspect Script Executor.exeC:\Program Files\WinRAR\License.txttext
MD5:672064CF19DB0B083B981CF0BE7662B0
SHA256:9FC8AA33CCAFA04C1CE4C0A61047B341297D720ADAB1B77F67B5FE59F43BB59F
7736Aspect Script Executor.exeC:\Program Files\WinRAR\ReadMe.txttext
MD5:00D0A57A6D64EE3DE8F4D5529D6C6447
SHA256:FCD13E1B97AF47B8B923BA97AE15E9731C66093609667C3171D5DD24A6F7F2E6
7736Aspect Script Executor.exeC:\Program Files\WinRAR\RarExt.dllexecutable
MD5:D0F4632BE7031CC372FFDD2D9063FFB2
SHA256:5F21FD414A3767DF77F31BE26352FC2FE63ADBFFC75EE48AE4ADE06DEEF07B50
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
18
DNS requests
13
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
23.216.77.25:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4560
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4560
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.216.77.25:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6404
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2112
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.71:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
google.com
  • 142.250.185.78
whitelisted
crl.microsoft.com
  • 23.216.77.25
  • 23.216.77.22
  • 23.216.77.30
  • 23.216.77.18
  • 23.216.77.19
  • 23.216.77.37
  • 23.216.77.29
  • 23.216.77.28
  • 23.216.77.15
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.159.71
  • 40.126.31.3
  • 40.126.31.69
  • 40.126.31.2
  • 20.190.159.75
  • 20.190.159.129
  • 20.190.159.4
  • 40.126.31.129
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Aspect Script Executor.zip