File name:

hidusbf.zip

Full analysis: https://app.any.run/tasks/2c458770-487e-4dc9-83c3-32e3ca40c0fc
Verdict: Malicious activity
Analysis date: January 15, 2024, 17:13:37
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

1F6A405C16895D7927B22C3800365988

SHA1:

249F272FE2D77652C5D2866F8EB101EF7C4D0362

SHA256:

7DDD90B75A88D932846AD1A691834B335F8084FCBAC4855644E78FE52D42095F

SSDEEP:

12288:iK3uG6O+oo1+oocIH5iAMXrLcBlrMZcHnuHyKdd:fuG6O+oo1+ooriAMXrLcBlrMZcHuHTdd

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 2044)

    • Creates a writable file in the system directory

      • InfDefaultInstall.exe (PID: 584)
      • InfDefaultInstall.exe (PID: 1808)

  • SUSPICIOUS

    • Drops a system driver (possible attempt to evade defenses)

      • WinRAR.exe (PID: 2044)
      • InfDefaultInstall.exe (PID: 584)
      • InfDefaultInstall.exe (PID: 1808)

    • Reads the Internet Settings

      • Setup.exe (PID: 268)
      • runonce.exe (PID: 1836)
      • runonce.exe (PID: 1796)

    • Executable content was dropped or overwritten

      • InfDefaultInstall.exe (PID: 584)
      • InfDefaultInstall.exe (PID: 1808)

  • INFO

    • Checks supported languages

      • Setup.exe (PID: 268)

    • Reads the computer name

      • Setup.exe (PID: 268)

    • Drops the executable file immediately after the start

      • InfDefaultInstall.exe (PID: 584)
      • InfDefaultInstall.exe (PID: 1808)

    • Creates files in the driver directory

      • InfDefaultInstall.exe (PID: 584)
      • InfDefaultInstall.exe (PID: 1808)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2044)

    • Reads the time zone

      • runonce.exe (PID: 1836)
      • runonce.exe (PID: 1796)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2008:04:15 15:30:18
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: DRIVER/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
46
Monitored processes
9
Malicious processes
1
Suspicious processes
3

Behavior graph

Click at the process to see the details
start winrar.exe setup.exe no specs setup.exe infdefaultinstall.exe runonce.exe no specs grpconv.exe no specs infdefaultinstall.exe runonce.exe no specs grpconv.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
268"C:\Users\admin\AppData\Local\Temp\Rar$EXa2044.32369\DRIVER\Setup.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2044.32369\DRIVER\Setup.exe
WinRAR.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2044.32369\driver\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
584"C:\Windows\System32\InfDefaultInstall.exe" "C:\Users\admin\AppData\Local\Temp\Rar$EXa2044.32369\DRIVER\HIDUSBF.INF"C:\Windows\System32\InfDefaultInstall.exe
Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
INF Default Install
Exit code:
0
Version:
5.2.3668.0
Modules
Images
c:\windows\system32\infdefaultinstall.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
764"C:\Windows\System32\grpconv.exe" -oC:\Windows\System32\grpconv.exe—runonce.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Progman Group Converter
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\grpconv.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
844"C:\Windows\System32\grpconv.exe" -oC:\Windows\System32\grpconv.exe—runonce.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Progman Group Converter
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\grpconv.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1308"C:\Users\admin\AppData\Local\Temp\Rar$EXa2044.32369\DRIVER\Setup.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2044.32369\DRIVER\Setup.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2044.32369\driver\setup.exe
c:\windows\system32\ntdll.dll
1796"C:\Windows\system32\runonce.exe" -rC:\Windows\System32\runonce.exe—InfDefaultInstall.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Run Once Wrapper
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\runonce.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1808"C:\Windows\System32\InfDefaultInstall.exe" "C:\Users\admin\AppData\Local\Temp\Rar$EXa2044.32369\DRIVER\HIDUSBF.INF"C:\Windows\System32\InfDefaultInstall.exe
Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
INF Default Install
Exit code:
0
Version:
5.2.3668.0
Modules
Images
c:\windows\system32\infdefaultinstall.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1836"C:\Windows\system32\runonce.exe" -rC:\Windows\System32\runonce.exe—InfDefaultInstall.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Run Once Wrapper
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\runonce.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2044"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\hidusbf.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
Total events
2 036
Read events
1 987
Write events
47
Delete events
2

Modification events

(PID) Process:(2044) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
19
Suspicious files
3
Text files
7
Unknown types
1

Dropped files

PID
Process
Filename
Type
2044WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2044.32369\DRIVER\98ME\hidusbf.sysexecutable
MD5:315ADD8888A8AD79EF5B9F6E53C60C3D
SHA256:4F5FCF093E28657B99511954F9289DBDA78AC60897C2E1C3013BE648E3459F3C
2044WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2044.32369\DRIVER\AMD64\1khz\hidusbf.sysexecutable
MD5:C0C8BDFA88BFAF4552B1C50BEDB2E20D
SHA256:EC97D9C203B6FC47605027DE2E65891C63C8088230F5F8B59E705F40E0BD860A
2044WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2044.32369\DRIVER\AMD64\nopatch\hidusbf.sysexecutable
MD5:846D9A8DE2927AB31C1A9DE2892EA8B9
SHA256:6A85DF7738F2A04BA9576A7690D1AD67D385D0F6957ADF16027B804F485EEF04
2044WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2044.32369\DRIVER\AMD64\4khz-8khz\hidusbf.sysexecutable
MD5:DFE3AEEA9E6C889698FE12F5308C810F
SHA256:889241E792A3E58673EB98D4D1815C8073A6BCFA0ABC6C3AF060C5C6E7B94302
2044WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2044.32369\DRIVER\AMD64\hidusbf.sysexecutable
MD5:C0C8BDFA88BFAF4552B1C50BEDB2E20D
SHA256:EC97D9C203B6FC47605027DE2E65891C63C8088230F5F8B59E705F40E0BD860A
2044WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2044.32369\DRIVER\HIDUSBF.INFbinary
MD5:8EAD6929CA01C948532FC16CEF6B8591
SHA256:9F98870BA3CBF2B992C848BC7447685B70C0A06D2DD31975CBD8CE3E8235E5A5
2044WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2044.32369\DRIVER\1kHz.cmdtext
MD5:D0CCF933DCF67F48BDCAA6DCDBF276F0
SHA256:DC9EC769828679267F35B9A729E20E40BC46A0BA8C256F71D8B85DFE0934125C
2044WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2044.32369\DRIVER\2kHz-4kHz.cmdtext
MD5:DB005E533498D4CB39600FFCB51B7229
SHA256:18225218996A5D71C3FD9E31A09F2FF0A94936165719E235A57D8E14A674B682
2044WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2044.32369\DRIVER\sx64.exeexecutable
MD5:722C4801D445CB49477A6A60AFF8E6E8
SHA256:B0DF95C336A135B3F0D61DFB4914FAD4C0288EA4527D71F514FE7016ED331053
2044WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2044.32369\DRIVER\4kHz-8kHz.cmdtext
MD5:C891D08E5B0A9689E2D8945EA3F7BB81
SHA256:AF95BB8D0D6D2B35E31792FF21FF6763CB7DA374B5D1F7A888007CB4DA2D03D2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
hidusbf.zip