File name:

merda.zip

Full analysis: https://app.any.run/tasks/111877d6-1bfd-4f93-8305-1437c35c00d6
Verdict: Malicious activity
Analysis date: September 04, 2024, 15:12:24
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=store
MD5:

5C35BDB46B37348CBD8A2421928A40A4

SHA1:

C7663F39292D919BEA4FB5EE87CC83E22F2FE8E5

SHA256:

7ED1D5BF09F8DAACC317F3CD8DFF1B155D3052F3457CDD5354A02EECBCD0D641

SSDEEP:

24576:+c6mCxIOhlaTfFz3iRL9G9rwFlzaqSbl5gPhUWcvdA0WKoBar6riRAsAKifuXMw+:+c6DxIOhlaTfFz3iRL9G9rwFlzaqSbla

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts NET.EXE to view/add/change user profiles

      • cmd.exe (PID: 7152)
      • net.exe (PID: 360)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 5700)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 5476)
      • WinRAR.exe (PID: 5700)
      • cmd.exe (PID: 5464)
      • cmd.exe (PID: 6364)

    • Application launched itself

      • cmd.exe (PID: 5476)
      • cmd.exe (PID: 5464)
      • cmd.exe (PID: 6364)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 5476)

    • Process checks presence of unattended files

      • WinRAR.exe (PID: 5700)

    • Executing commands from ".cmd" file

      • WinRAR.exe (PID: 5700)

    • Uses WMIC.EXE to obtain memory chip information

      • cmd.exe (PID: 5464)
      • cmd.exe (PID: 6364)

    • Starts application with an unusual extension

      • cmd.exe (PID: 6364)

  • INFO

    • Reads Microsoft Office registry keys

      • WinRAR.exe (PID: 5700)

    • The process uses the downloaded file

      • WinRAR.exe (PID: 5700)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 5700)

    • Checks supported languages

      • MyOEM.exe (PID: 4732)
      • MyOEM.exe (PID: 6312)
      • tree.com (PID: 2520)

    • Reads the computer name

      • MyOEM.exe (PID: 4732)
      • MyOEM.exe (PID: 6312)

    • Reads the time zone

      • net1.exe (PID: 1780)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 1448)
      • WMIC.exe (PID: 5044)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2024:09:04 17:10:06
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: merda/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
168
Monitored processes
45
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe regedit.exe no specs regedit.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs myoem.exe no specs conhost.exe no specs myoem.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs net.exe no specs net1.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs wmic.exe no specs find.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs wmic.exe no specs find.exe no specs dism.exe no specs tree.com no specs find.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
360net user admin /active:yesC:\Windows\System32\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\mpr.dll
1440"regedit.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIa5700.6701\icons.reg"C:\Windows\regedit.exe
WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Editor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\regedit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\gdi32.dll
1440C:\WINDOWS\system32\cmd.exe /c reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RecoveryEnvironment" /v TargetOSC:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
1448wmic memorychip C:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
1780C:\WINDOWS\system32\net1 user admin /active:yesC:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\samcli.dll
c:\windows\system32\ucrtbase.dll
1992reg add HKEY_LOCAL_MACHINE\TEMPHIVE\Microsoft\Office\16.0\Common\OEM /v OOBE /t REG_SZ /d {9A9279D2-0358-4258-8D20-02ABD3159EF0} /f C:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll
2520reg add "HKEY_LOCAL_MACHINE\TEMPHIVE\Microsoft\WindowsUpdate\Orchestrator\UScheduler_Oobe\OfficeClickToRun " /f /t REG_SZ /v "startArg" /d "/update SCHEDULEDTASK triggeringUI=AprilForkExpressLane skipMoratorium=true displayLevel=none" C:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll
2520tree "ECHO is on.\Recovery\OEM\Backup\Drivers" /f C:\Windows\System32\tree.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Tree Walk Utility
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\tree.com
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
2572\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—MyOEM.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2588reg add HKEY_LOCAL_MACHINE\TEMPHIVE\Microsoft\Office\16.0\Common\OEM /v OOBEMode /t REG_SZ /d OEM /f C:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll
Total events
6 287
Read events
6 257
Write events
30
Delete events
0

Modification events

(PID) Process:(5700) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(5700) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\merda.zip
(PID) Process:(5700) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(5700) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(5700) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(5700) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(5700) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.reg\OpenWithProgids
Operation:writeName:regfile
Value:
(PID) Process:(1440) regedit.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel
Operation:writeName:{031E4825-7B94-4dc3-B131-E946B44C8DD5}
Value:
1
(PID) Process:(1440) regedit.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel
Operation:writeName:{208D2C60-3AEA-1069-A2D7-08002B30309D}
Value:
1
(PID) Process:(1440) regedit.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel
Operation:writeName:{20D04FE0-3AEA-1069-A2D8-08002B30309D}
Value:
0
Executable files
2
Suspicious files
7
Text files
47
Unknown types
1

Dropped files

PID
Process
Filename
Type
5700WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa5700.6701\icons.regtext
MD5:E0A6BDDAA6CB63D556804E74CAE81BC6
SHA256:CB6BBE77921317D8176D36CD297E7841C493C9992FB9646E3777C35687511E27
5700WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa5700.7522\merda\.DS_Storeds_store
MD5:06A134F1768B87C378A7471E832C1844
SHA256:4763D55C6D8D164626EDD8CEDB950A8204FBC280857160E82F8B02B1918DB627
5700WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa5700.7522\__MACOSX\merda\._.DS_Storead
MD5:B9A94CC8F4AAC450FB21641EAF065C6D
SHA256:2F380F4A3D05A8D90C2106F50DA75064E9CE57A598599DC5404F8F69A0223AA9
5476cmd.exeC:\Users\admin\AppData\Local\Temp\regsettings.txttext
MD5:7A09DDE9E7362931F7AA1A9611520331
SHA256:5D6643DBA0BDADD5029ACA927E24EE0B719EC4EE43399E6D17C0ECD184E4D61D
5700WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa5700.7165\oemsetupRecovery.cmdtext
MD5:FE725240A4BCE7639B7BE284A342B9B1
SHA256:1EC3C0691256E8D357559A5DE8172CD36BFE2B213EF6F17911EE0CE3847A7518
5700WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa5700.7522\merda\OEM\Scripts\BeforeImageApply.cmdtext
MD5:228738777A5537FEBC78ACBF45A97F76
SHA256:4915D2C27FDF13C6D358C98C6C19666B4EB0DABBCB46F4AA3D16BEB652DB312D
5700WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa5700.7522\merda\OEM\Scripts\BeforeImageApply.logtext
MD5:F347119069E0B6A8E408B35EA6EDF755
SHA256:58711E605007A3CEC4C15D67982D961E9AFD431FCDE2E3B946B3008D26FE7BA3
5700WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa5700.7522\merda\OEM\Backup\oemsetupRecovery.cmdtext
MD5:FE725240A4BCE7639B7BE284A342B9B1
SHA256:1EC3C0691256E8D357559A5DE8172CD36BFE2B213EF6F17911EE0CE3847A7518
5700WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa5700.7522\merda\OEM\Scripts\AfterImageApply.logtext
MD5:BABACAEC7519A58A2447AC6EBDB9DADB
SHA256:CFDF6B0B5F35E8B21C6B3D0E6E7D96CD29D32F8E6C1F963733608826F01E0451
5700WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa5700.7522\merda\OEM\Backup\Unattend.xmlxml
MD5:2C44B92FB9A6DEA94A1A8A43FA51625A
SHA256:8E63CE0B6DEF3BF5BEB3D9D68B1D38D2C54368F90B34A5702E87E70138412A53
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
28
DNS requests
13
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2120
MoUsoCoreWorker.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6460
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6120
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6460
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6224
svchost.exe
52.183.220.149:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
52.183.220.149:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2120
MoUsoCoreWorker.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
6120
svchost.exe
40.126.31.69:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3260
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 52.183.220.149
  • 51.124.78.146
whitelisted
google.com
  • 142.250.184.238
whitelisted
www.microsoft.com
  • 88.221.169.152
  • 23.35.229.160
whitelisted
login.live.com
  • 40.126.31.69
  • 40.126.31.71
  • 20.190.159.71
  • 20.190.159.64
  • 40.126.31.67
  • 20.190.159.23
  • 20.190.159.75
  • 20.190.159.68
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
slscr.update.microsoft.com
  • 13.85.23.86
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
merda.zip