File name:

hidusbf.zip

Full analysis: https://app.any.run/tasks/2c458770-487e-4dc9-83c3-32e3ca40c0fc
Verdict: Malicious activity
Analysis date: January 15, 2024, 17:13:37
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

1F6A405C16895D7927B22C3800365988

SHA1:

249F272FE2D77652C5D2866F8EB101EF7C4D0362

SHA256:

7DDD90B75A88D932846AD1A691834B335F8084FCBAC4855644E78FE52D42095F

SSDEEP:

12288:iK3uG6O+oo1+oocIH5iAMXrLcBlrMZcHnuHyKdd:fuG6O+oo1+ooriAMXrLcBlrMZcHuHTdd

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 2044)

    • Creates a writable file in the system directory

      • InfDefaultInstall.exe (PID: 584)
      • InfDefaultInstall.exe (PID: 1808)

  • SUSPICIOUS

    • Reads the Internet Settings

      • Setup.exe (PID: 268)
      • runonce.exe (PID: 1836)
      • runonce.exe (PID: 1796)

    • Drops a system driver (possible attempt to evade defenses)

      • InfDefaultInstall.exe (PID: 584)
      • InfDefaultInstall.exe (PID: 1808)
      • WinRAR.exe (PID: 2044)

    • Executable content was dropped or overwritten

      • InfDefaultInstall.exe (PID: 584)
      • InfDefaultInstall.exe (PID: 1808)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2044)

    • Checks supported languages

      • Setup.exe (PID: 268)

    • Reads the time zone

      • runonce.exe (PID: 1836)
      • runonce.exe (PID: 1796)

    • Reads the computer name

      • Setup.exe (PID: 268)

    • Drops the executable file immediately after the start

      • InfDefaultInstall.exe (PID: 584)
      • InfDefaultInstall.exe (PID: 1808)

    • Creates files in the driver directory

      • InfDefaultInstall.exe (PID: 1808)
      • InfDefaultInstall.exe (PID: 584)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2008:04:15 15:30:18
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: DRIVER/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
46
Monitored processes
9
Malicious processes
1
Suspicious processes
3

Behavior graph

Click at the process to see the details
start winrar.exe setup.exe no specs setup.exe infdefaultinstall.exe runonce.exe no specs grpconv.exe no specs infdefaultinstall.exe runonce.exe no specs grpconv.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
268"C:\Users\admin\AppData\Local\Temp\Rar$EXa2044.32369\DRIVER\Setup.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2044.32369\DRIVER\Setup.exe
WinRAR.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2044.32369\driver\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
584"C:\Windows\System32\InfDefaultInstall.exe" "C:\Users\admin\AppData\Local\Temp\Rar$EXa2044.32369\DRIVER\HIDUSBF.INF"C:\Windows\System32\InfDefaultInstall.exe
Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
INF Default Install
Exit code:
0
Version:
5.2.3668.0
Modules
Images
c:\windows\system32\infdefaultinstall.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
764"C:\Windows\System32\grpconv.exe" -oC:\Windows\System32\grpconv.exe—runonce.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Progman Group Converter
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\grpconv.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
844"C:\Windows\System32\grpconv.exe" -oC:\Windows\System32\grpconv.exe—runonce.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Progman Group Converter
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\grpconv.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1308"C:\Users\admin\AppData\Local\Temp\Rar$EXa2044.32369\DRIVER\Setup.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2044.32369\DRIVER\Setup.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2044.32369\driver\setup.exe
c:\windows\system32\ntdll.dll
1796"C:\Windows\system32\runonce.exe" -rC:\Windows\System32\runonce.exe—InfDefaultInstall.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Run Once Wrapper
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\runonce.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1808"C:\Windows\System32\InfDefaultInstall.exe" "C:\Users\admin\AppData\Local\Temp\Rar$EXa2044.32369\DRIVER\HIDUSBF.INF"C:\Windows\System32\InfDefaultInstall.exe
Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
INF Default Install
Exit code:
0
Version:
5.2.3668.0
Modules
Images
c:\windows\system32\infdefaultinstall.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1836"C:\Windows\system32\runonce.exe" -rC:\Windows\System32\runonce.exe—InfDefaultInstall.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Run Once Wrapper
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\runonce.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2044"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\hidusbf.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
Total events
2 036
Read events
1 987
Write events
47
Delete events
2

Modification events

(PID) Process:(2044) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
19
Suspicious files
3
Text files
7
Unknown types
1

Dropped files

PID
Process
Filename
Type
2044WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2044.32369\DRIVER\AMD64\4khz-8khz\hidusbf.sysexecutable
MD5:DFE3AEEA9E6C889698FE12F5308C810F
SHA256:889241E792A3E58673EB98D4D1815C8073A6BCFA0ABC6C3AF060C5C6E7B94302
2044WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2044.32369\DRIVER\NTX86\4khz-8khz\hidusbf.sysexecutable
MD5:E20703C1C2A2AA94E6D5EEB48BAB62FD
SHA256:377D2BBC879759260A66D937D3C80E2C2B4BAD08D6ED36A0CF93873B7B38A9CE
2044WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2044.32369\DRIVER\AMD64\nopatch\hidusbf.sysexecutable
MD5:846D9A8DE2927AB31C1A9DE2892EA8B9
SHA256:6A85DF7738F2A04BA9576A7690D1AD67D385D0F6957ADF16027B804F485EEF04
2044WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2044.32369\DRIVER\AMD64\1khz\hidusbf.sysexecutable
MD5:C0C8BDFA88BFAF4552B1C50BEDB2E20D
SHA256:EC97D9C203B6FC47605027DE2E65891C63C8088230F5F8B59E705F40E0BD860A
2044WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2044.32369\DRIVER\NTX86\hidusbf.sysexecutable
MD5:40047C4BBD53B7383134E92175F24296
SHA256:E753BF75D6D8AF04E409D6797DDDDDD287A952070A3779C6D6354623E71A2EEC
2044WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2044.32369\DRIVER\NTX86\nopatch\hidusbf.sysexecutable
MD5:2122564C266A79E73FA73A44523783DC
SHA256:A3CBA51DC28B10F7BE1A232BE0D6CEC6D734B6753AB7054169A04CE22335F7D8
2044WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2044.32369\DRIVER\NTX86\1khz\hidusbf.sysexecutable
MD5:40047C4BBD53B7383134E92175F24296
SHA256:E753BF75D6D8AF04E409D6797DDDDDD287A952070A3779C6D6354623E71A2EEC
2044WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2044.32369\DRIVER\NTX86\2khz-4khz\hidusbf.sysexecutable
MD5:2EAA8605C6F9F511BB28B16F3626C609
SHA256:3273A052E5A54F0270168CEE156B7B27B22B59E122B94922A801DD7CDB8BF6B5
2044WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2044.32369\DRIVER\HIDUSBF.INFbinary
MD5:8EAD6929CA01C948532FC16CEF6B8591
SHA256:9F98870BA3CBF2B992C848BC7447685B70C0A06D2DD31975CBD8CE3E8235E5A5
2044WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2044.32369\DRIVER\AMD64\2khz-4khz\hidusbf.sysexecutable
MD5:52A628ECC5B5D74F3F9F03FE6FD49C30
SHA256:841D8EC5B070D068B0BF97C8EA255CD3AE9360FCA4BE2FB61149411419DBE755
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
hidusbf.zip