File name:

Desktop.rar

Full analysis: https://app.any.run/tasks/f55f8455-e835-4595-91b8-93a26015838a
Verdict: Malicious activity
Analysis date: May 16, 2025, 16:07:07
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto
mydoom
arch-exec
arch-scr
arch-html
delphi
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

E7AA9408EE2577D70DEC6B7B8B45B234

SHA1:

D625011A040B62B7C91754344239E274CC2ED935

SHA256:

7CCFD9B52EA9C8F3FAF6AFAD17BABFF9C052B0B7561B912BCF4030EFB2E9EE78

SSDEEP:

98304:3Nm+xYOGxxZVEm+PcIPnjSduoiUILbRR9F3vfrgCyMSZdNx0kMmjP5YmTj3alrPK:4URHjy5

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • MYDOOM has been found (auto)

      • WinRAR.exe (PID: 1532)

    • Generic archive extractor

      • WinRAR.exe (PID: 1532)

    • Changes the autorun value in the registry

      • Yarner.a.exe (PID: 664)

    • Modifies registry startup key (SCRIPT)

      • wscript.exe (PID: 5892)

    • Creates a new registry key or changes the value of an existing one (SCRIPT)

      • wscript.exe (PID: 5892)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Yarner.a.exe (PID: 664)
      • Gruel.a.exe (PID: 5172)
      • Lacon.exe (PID: 3676)

    • Reads data from a binary Stream object (SCRIPT)

      • wscript.exe (PID: 5892)

    • Gets full path of the running script (SCRIPT)

      • wscript.exe (PID: 5892)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • wscript.exe (PID: 5892)

    • Writes binary data to a Stream object (SCRIPT)

      • wscript.exe (PID: 5892)

    • Executes application which crashes

      • Nyxem.E.exe (PID: 6668)
      • Xanax.exe (PID: 856)

    • Process drops legitimate windows executable

      • Yarner.a.exe (PID: 664)

    • Uses REG/REGEDIT.EXE to modify registry

      • Merkur.exe (PID: 1852)

    • There is functionality for taking screenshot (YARA)

      • Yarner.a.exe (PID: 664)

    • Creates file in the systems drive root

      • Merkur.exe (PID: 1852)

    • Uses RUNDLL32.EXE to load library

      • rundll32.exe (PID: 2084)

  • INFO

    • The sample compiled with korean language support

      • WinRAR.exe (PID: 1532)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 1532)
      • Yarner.a.exe (PID: 664)
      • Lacon.exe (PID: 3676)

    • The sample compiled with spanish language support

      • WinRAR.exe (PID: 1532)
      • Gruel.a.exe (PID: 5172)

    • The sample compiled with german language support

      • WinRAR.exe (PID: 1532)
      • Yarner.a.exe (PID: 664)

    • Manual execution by a user

      • Yarner.a.exe (PID: 6676)
      • Yarner.a.exe (PID: 664)
      • Xanax.exe (PID: 856)
      • wscript.exe (PID: 5892)
      • Nyxem.E.exe (PID: 6668)
      • Lacon.exe (PID: 208)
      • Gruel.a.exe (PID: 5172)
      • Lacon.exe (PID: 3676)
      • Gruel.a.exe (PID: 4944)
      • Gruel.a.exe (PID: 208)
      • Merkur.exe (PID: 1852)
      • Gruel.a.exe (PID: 5624)
      • Gruel.a.exe (PID: 3768)
      • Gruel.a.exe (PID: 3620)

    • Checks supported languages

      • Yarner.a.exe (PID: 664)
      • Xanax.exe (PID: 856)
      • Merkur.exe (PID: 1852)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1532)

    • Reads the bytes from the current stream and writes them to another stream(SCRIPT)

      • wscript.exe (PID: 5892)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 1188)
      • WerFault.exe (PID: 5452)

    • Reads the computer name

      • Yarner.a.exe (PID: 664)
      • Merkur.exe (PID: 1852)

    • Failed to create an executable file in Windows directory

      • Xanax.exe (PID: 856)
      • Merkur.exe (PID: 1852)

    • Compiled with Borland Delphi (YARA)

      • Yarner.a.exe (PID: 664)
      • OUTLOOK.EXE (PID: 1040)

    • Create files in a temporary directory

      • Merkur.exe (PID: 1852)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)

EXIF

ZIP

FileVersion: RAR v5
CompressedSize: 10108
UncompressedSize: 34304
OperatingSystem: Win32
ArchivedFileName: MyPics.a.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
178
Monitored processes
38
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start #MYDOOM winrar.exe sppextcomobj.exe no specs slui.exe yarner.a.exe no specs yarner.a.exe outlook.exe xanax.exe werfault.exe no specs wscript.exe no specs nyxem.e.exe outlook.exe no specs werfault.exe no specs merkur.exe no specs regedit.exe no specs lacon.exe no specs slui.exe no specs lacon.exe gruel.a.exe no specs gruel.a.exe gruel.a.exe no specs gruel.a.exe gruel.a.exe no specs gruel.a.exe rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs gruel.a.exe no specs rundll32.exe no specs gruel.a.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs explorer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
132"C:\Users\admin\Desktop\Gruel.a.exe" C:\Windows\System32\SystemPropertiesComputerName.exeC:\Users\admin\Desktop\Gruel.a.exe—rundll32.exe
User:
admin
Company:
Microsoft
Integrity Level:
HIGH
Version:
1.00
Modules
Images
c:\users\admin\desktop\gruel.a.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
208"C:\Users\admin\Desktop\Lacon.exe" C:\Users\admin\Desktop\Lacon.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Version:
1.00
Modules
Images
c:\users\admin\desktop\lacon.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
208"C:\Users\admin\Desktop\Gruel.a.exe" C:\Users\admin\Desktop\Lentin.c.exeC:\Users\admin\Desktop\Gruel.a.exe—explorer.exe
User:
admin
Company:
Microsoft
Integrity Level:
MEDIUM
Exit code:
3221226540
Version:
1.00
Modules
Images
c:\users\admin\desktop\gruel.a.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
208rundll32.exe shell32.dll,Control_RunDLL main.cpl @1C:\Windows\SysWOW64\rundll32.exe—Gruel.a.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
664"C:\Users\admin\Desktop\Yarner.a.exe" C:\Users\admin\Desktop\Yarner.a.exe
explorer.exe
User:
admin
Company:
trojaner-info.de
Integrity Level:
HIGH
Description:
YAW - Yet Another Warner
Version:
2.0.54.554
Modules
Images
c:\users\admin\desktop\yarner.a.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
856"C:\Users\admin\Desktop\Xanax.exe" C:\Users\admin\Desktop\Xanax.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\desktop\xanax.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1040"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" -EmbeddingC:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Outlook
Version:
16.0.16026.20146
Modules
Images
c:\program files\microsoft office\root\office16\outlook.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\program files\microsoft office\root\office16\vcruntime140_1.dll
c:\program files\microsoft office\root\office16\outlookservicing.dll
c:\windows\system32\advapi32.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
1188C:\WINDOWS\SysWOW64\WerFault.exe -u -p 856 -s 372C:\Windows\SysWOW64\WerFault.exe—Xanax.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
1328regedit /s c:\Windows\system32\regme.regC:\Windows\SysWOW64\regedit.exe—Merkur.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Editor
Exit code:
3221226540
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\regedit.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
1532"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\Desktop.rarC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
Total events
22 148
Read events
21 676
Write events
443
Delete events
29

Modification events

(PID) Process:(1532) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(1532) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(1532) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(1532) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Desktop.rar
(PID) Process:(1532) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1532) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1532) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1532) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1532) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
(PID) Process:(1532) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:name
Value:
256
Executable files
39
Suspicious files
8
Text files
13
Unknown types
0

Dropped files

PID
Process
Filename
Type
1532WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1532.104\MyPics.a.exeexecutable
MD5:94EC47428DABB492AF96756E7C95C644
SHA256:0AE040287546A70F8A2D5FC2DA45A83E253DA044BF10246AE77830AF971B3359
1532WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1532.104\White.a.exeexecutable
MD5:DFF252D337A54D73C67E38BDA06B72EC
SHA256:C0ACEBEFD398F733123173ADEBAAC32C9BE2C2D52FCB17F6AFF72BE04F3569C4
1532WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1532.104\San.htmlbinary
MD5:2E69F2FA1DFCF256549CCA809CC4C9D6
SHA256:49151419F15B1BF00DC4D5B1D988D9C2669D1E4E46C62CF2B0DB3C89CD0293E7
1532WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1532.104\Nyxem.E.exeexecutable
MD5:A0BDCE2F937FFBB7BA548845B24749C0
SHA256:62F8364C46300BCE2E75C4CC65039DE3F060B854764DD90F0FA656EFAF31BEA9
1532WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1532.104\NakedWife.exeexecutable
MD5:DA9DBA70DE70DC43D6535F2975CEC68D
SHA256:29CEEB3D763D307A0DD7068FA1B2009F2B0D85CA6D2AA5867B12C595BA96762A
1532WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1532.104\Trood.a.exeexecutable
MD5:47D1F48A127736E63AAD709DDC9D81D0
SHA256:24DD269B4D5EDEB591AD992DB33553D90F1848F58C06C9DD9FB3CDB4EAF812F5
1532WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1532.104\NewLove.vbstext
MD5:D2B8EA4A267C69040C7D3AD80F64F8BA
SHA256:AA14A4BFB1E6DE52750CC89B91CACBE8BD318634CCB54FA835F5E2C5D1D2F633
1532WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1532.104\Funsoul.exeexecutable
MD5:A13A4DB860D743A088EF7AB9BACB4DDA
SHA256:69EE59CEE5A1D39739D935701CFA917F75787B29E0B9BDA9ADA9E2642ADE434C
1532WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1532.104\Lentin.c.exeexecutable
MD5:04EE0EFF07A7E545F7052031CA0D8133
SHA256:50D60CD841A18B05E00AB4691FC1E30F6A099A65A58BA51080304205FBB0D666
1532WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1532.104\Xanax.exeexecutable
MD5:DF24E1CCCEB3C75DADA950A1C1ABCA4D
SHA256:910C03D210381F0443BFCEFE682717F28378DCFE5415071DD127A9837A97B0A6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
51
DNS requests
25
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.128:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2112
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4896
SIHClient.exe
20.109.210.53:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4896
SIHClient.exe
40.69.42.241:443
fe3cr.delivery.mp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
20.190.160.65:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 51.124.78.146
whitelisted
google.com
  • 142.250.185.78
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.160.128
  • 20.190.160.5
  • 40.126.32.138
  • 20.190.160.66
  • 20.190.160.22
  • 20.190.160.130
  • 20.190.160.132
  • 40.126.32.72
  • 20.190.160.65
  • 20.190.160.2
  • 40.126.32.76
  • 40.126.32.134
  • 20.190.160.14
  • 20.190.160.20
  • 20.190.160.131
  • 40.126.32.74
  • 40.126.32.68
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
  • 2a01:111:f100:a000::4134:4847
whitelisted
241.42.69.40.in-addr.arpa
  • —
unknown
7.4.8.4.4.3.1.4.0.0.0.0.0.0.0.0.0.0.0.a.0.0.1.f.1.1.1.0.1.0.a.2.ip6.arpa
  • —
unknown
arc.msn.com
  • 20.223.35.26
whitelisted
fd.api.iris.microsoft.com
  • 20.223.36.55
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Desktop.rar