File name:

MyMw.zip

Full analysis: https://app.any.run/tasks/31f11f63-ce0b-479f-96be-bb6a62760daf
Verdict: Malicious activity
Analysis date: December 31, 2024, 13:33:24
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
desktopboom
endermanch
arch-exec
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

D20309EAE3CDB8813D3562633663E936

SHA1:

28B34EC92C4788F7B3A477B7E0333B1C3D01DFC4

SHA256:

757B110744733CD80C6E6957F2DE5FFD628559A14BB5B1B22EE17C4F2D41BF6F

SSDEEP:

196608:AWfzLwt4tGTnLBbn+iuYr2aCn/Eh20W3gZm:rLwbTndbn+iuhn/cZWwU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • DESKTOPBOOM has been detected

      • WinRAR.exe (PID: 1744)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 1744)

    • Starts a Microsoft application from unusual location

      • Hydra.exe (PID: 188)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1744)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 1744)

    • Manual execution by a user

      • Windows 11.exe (PID: 7032)
      • Windows 11.exe (PID: 7084)
      • Vista.exe (PID: 5652)
      • Avoid.exe (PID: 5304)
      • Launcher.exe (PID: 4384)
      • Launcher.exe (PID: 936)
      • ScreenScrew.exe (PID: 4556)
      • ScreenScrew.exe (PID: 5640)
      • Melting.exe (PID: 3080)
      • WindowsUpdate.exe (PID: 4708)
      • Hydra.exe (PID: 188)

    • The process uses the downloaded file

      • WinRAR.exe (PID: 1744)

    • Checks supported languages

      • WindowsUpdate.exe (PID: 4708)
      • Vista.exe (PID: 5652)
      • Hydra.exe (PID: 188)
      • Launcher.exe (PID: 4384)
      • Launcher.exe (PID: 936)
      • ScreenScrew.exe (PID: 4556)
      • ScreenScrew.exe (PID: 5640)
      • Melting.exe (PID: 3080)
      • Avoid.exe (PID: 5304)

    • Reads Environment values

      • Vista.exe (PID: 5652)

    • Reads the computer name

      • WindowsUpdate.exe (PID: 4708)
      • Vista.exe (PID: 5652)
      • Hydra.exe (PID: 188)
      • Launcher.exe (PID: 936)
      • Melting.exe (PID: 3080)
      • Windows 11.exe (PID: 7084)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2024:08:06 20:06:30
ZipCRC: 0x4221f44d
ZipCompressedSize: 247497
ZipUncompressedSize: 253952
ZipFileName: Avoid.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
142
Monitored processes
12
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #DESKTOPBOOM winrar.exe windows 11.exe no specs windows 11.exe windowsupdate.exe no specs vista.exe no specs hydra.exe no specs avoid.exe no specs launcher.exe no specs launcher.exe no specs screenscrew.exe no specs screenscrew.exe no specs melting.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
188"C:\Users\admin\Desktop\Hydra.exe" C:\Users\admin\Desktop\Hydra.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Hydra
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\hydra.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
936"C:\Users\admin\Desktop\Launcher.exe" C:\Users\admin\Desktop\Launcher.exe—explorer.exe
User:
admin
Company:
RJL Software, Inc.
Integrity Level:
MEDIUM
Description:
Launches any program every X minutes
Version:
1.0.7.0
Modules
Images
c:\users\admin\desktop\launcher.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
1744"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\MyMw.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
3080"C:\Users\admin\Desktop\Melting.exe" C:\Users\admin\Desktop\Melting.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\melting.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
4384"C:\Users\admin\Desktop\Launcher.exe" C:\Users\admin\Desktop\Launcher.exe—explorer.exe
User:
admin
Company:
RJL Software, Inc.
Integrity Level:
MEDIUM
Description:
Launches any program every X minutes
Version:
1.0.7.0
Modules
Images
c:\users\admin\desktop\launcher.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
4556"C:\Users\admin\Desktop\ScreenScrew.exe" C:\Users\admin\Desktop\ScreenScrew.exe—explorer.exe
User:
admin
Company:
RJL Software, Inc.
Integrity Level:
MEDIUM
Description:
Screws with your screen :)
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\screenscrew.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4708"C:\Users\admin\Desktop\WindowsUpdate.exe" C:\Users\admin\Desktop\WindowsUpdate.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Windows 10 Update Center
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\windowsupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
5304"C:\Users\admin\Desktop\Avoid.exe" C:\Users\admin\Desktop\Avoid.exe—explorer.exe
User:
admin
Company:
RJL Software, Inc.
Integrity Level:
MEDIUM
Description:
Start Button avoids the mouse cursor.
Version:
1.0.1.0
Modules
Images
c:\users\admin\desktop\avoid.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
5640"C:\Users\admin\Desktop\ScreenScrew.exe" C:\Users\admin\Desktop\ScreenScrew.exe—explorer.exe
User:
admin
Company:
RJL Software, Inc.
Integrity Level:
MEDIUM
Description:
Screws with your screen :)
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\screenscrew.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
5652"C:\Users\admin\Desktop\Vista.exe" C:\Users\admin\Desktop\Vista.exe—explorer.exe
User:
admin
Company:
RJL Software, Inc.
Integrity Level:
MEDIUM
Description:
A gag that fakes a Windows Vista upgrade
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\vista.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
2 075
Read events
2 057
Write events
18
Delete events
0

Modification events

(PID) Process:(1744) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(1744) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(1744) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(1744) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\MyMw.zip
(PID) Process:(1744) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1744) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1744) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1744) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1744) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
(PID) Process:(1744) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:name
Value:
256
Executable files
29
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
1744WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1744.33202\ElfKernel.exeexecutable
MD5:1B69695082320798675574759AE6C12D
SHA256:8DD1C2C609F45DEDCA460740C568298DEC2E5E822C17587FC63F91DF48C545BB
1744WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1744.33202\CrazyNCS.exeexecutable
MD5:D043BA91E42E0D9A68C9866F002E8A21
SHA256:6820C71DF417E434C5AD26438C901C780FC5A80B28A466821B47D20B8424EF08
1744WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1744.33202\Joke.exeexecutable
MD5:7B821EC1D15CA5121A8A7032128CDE1C
SHA256:9DECD270CC489190FD307B2F2F868F79963E9FCFA722702FC26EF6D5CBDE5BFF
1744WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1744.33202\Curfun.exeexecutable
MD5:0B3B2DFF5503CB032ACD11D232A3AF55
SHA256:EF878461A149024F3065121FF4E165731ECABEF1B94B0B3ED2EDA010AD39202B
1744WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1744.33202\Render.exeexecutable
MD5:026992ED7C38FAE57E8839A6C0D883C8
SHA256:68CB1FE2EE7C3F69FE2D508D117B502ED19337BD332E722605E491A823F89645
1744WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1744.33202\Poncentran.exeexecutable
MD5:413A9DC8BB5F0DAF3247DFE869526B76
SHA256:425D7A283C2A6F60DD93004D7D0D8B50995F3E93632F1E8103825DB876FE0460
1744WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1744.33202\Melting.exeexecutable
MD5:833619A4C9E8C808F092BF477AF62618
SHA256:92A284981C7CA33F1AF45CE61738479FBCBB5A4111F5498E2CB54931C8A36C76
1744WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1744.33202\Avoid.exeexecutable
MD5:20D2C71D6D9DAF4499FFC4A5D164F1C3
SHA256:3AC8CC58DCBCEAEC3DAB046AEA050357E0E2248D30B0804C738C9A5B037C220D
1744WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1744.33202\Launcher.exeexecutable
MD5:7506EB94C661522AFF09A5C96D6F182B
SHA256:D5B962DFE37671B5134F0B741A662610B568C2B5374010EE92B5B7857D87872C
1744WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1744.33202\Flasher.exeexecutable
MD5:9254CA1DA9FF8AD492CA5FA06CA181C6
SHA256:30676AD5DC94C3FEC3D77D87439B2BF0A1AAA7F01900B68002A06F11CAEE9CE6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
31
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6432
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
5448
SIHClient.exe
GET
200
23.32.185.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.19.217.218:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5448
SIHClient.exe
GET
200
23.32.185.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1868
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
4712
MoUsoCoreWorker.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
2.19.217.218:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4008
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3976
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5064
SearchApp.exe
23.212.110.208:443
www.bing.com
Akamai International B.V.
CZ
whitelisted
5064
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 2.19.217.218
  • 23.32.185.131
whitelisted
google.com
  • 142.250.185.142
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
  • 4.231.128.59
whitelisted
www.bing.com
  • 23.212.110.208
  • 23.212.110.218
  • 23.212.110.137
  • 23.212.110.200
  • 23.212.110.217
  • 23.212.110.138
  • 23.212.110.209
  • 23.212.110.136
  • 23.212.110.211
unknown
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.32.136
  • 40.126.32.138
  • 40.126.32.68
  • 20.190.160.14
  • 40.126.32.133
  • 20.190.160.17
  • 40.126.32.76
  • 40.126.32.74
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
arc.msn.com
  • 20.223.36.55
whitelisted
fd.api.iris.microsoft.com
  • 20.223.36.55
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
MyMw.zip