File name:

IDM_Internet_Download_Manager_6.41.15.zip

Full analysis: https://app.any.run/tasks/2a508e60-16b7-49e4-b439-93a6bf1c4a22
Verdict: Malicious activity
Analysis date: April 09, 2024, 15:13:51
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

7FB595779FE077CFD365F9ADF0CA6BF8

SHA1:

1404659A1C3299BE54E13DC68CF6D38B849AF325

SHA256:

80CB63A22CED20C7DFD25EAE76355D196774F7571D871337FE123FB1A4D3A478

SSDEEP:

98304:EwTPbw0q5i173PEdLBfQmOA38QSV1Du9KK8F9wllFUYc2LBIWSRFH2uWByifDbLg:CvbXsR3DpQkM2KUVljjJeAzb4NE5

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 2120)
      • IDM-6.4x-Crack-v18.1-Ali.Dbg.exe (PID: 1340)
      • wscript.exe (PID: 2260)

    • Accesses environment variables (SCRIPT)

      • wscript.exe (PID: 2260)
      • wscript.exe (PID: 2504)
      • wscript.exe (PID: 1784)

    • Copies file to a new location (SCRIPT)

      • wscript.exe (PID: 2260)

    • Deletes a file (SCRIPT)

      • wscript.exe (PID: 2260)
      • wscript.exe (PID: 2504)
      • wscript.exe (PID: 1784)

    • Creates internet connection object (SCRIPT)

      • wscript.exe (PID: 2504)
      • wscript.exe (PID: 1784)

    • Gets a file object corresponding to the file in a specified path (SCRIPT)

      • wscript.exe (PID: 2260)

    • Sends HTTP request (SCRIPT)

      • wscript.exe (PID: 2504)
      • wscript.exe (PID: 1784)

    • Opens an HTTP connection (SCRIPT)

      • wscript.exe (PID: 1784)
      • wscript.exe (PID: 2504)

    • Unusual connection from system programs

      • wscript.exe (PID: 1784)
      • wscript.exe (PID: 2504)

  • SUSPICIOUS

    • Starts application with an unusual extension

      • idman641build15.exe (PID: 848)

    • The process creates files with name similar to system file names

      • IDM1.tmp (PID: 2168)

    • Creates a software uninstall entry

      • IDM1.tmp (PID: 2168)

    • Searches for installed software

      • IDM-6.4x-Crack-v18.1-Ali.Dbg.exe (PID: 1340)

    • The process executes VB scripts

      • IDM-6.4x-Crack-v18.1-Ali.Dbg.exe (PID: 1340)

    • Executable content was dropped or overwritten

      • IDM-6.4x-Crack-v18.1-Ali.Dbg.exe (PID: 1340)
      • wscript.exe (PID: 2260)

    • Checks whether a specific file exists (SCRIPT)

      • wscript.exe (PID: 2260)

    • Gets full path of the running script (SCRIPT)

      • wscript.exe (PID: 2260)
      • wscript.exe (PID: 2504)
      • wscript.exe (PID: 1784)

    • Reads the Internet Settings

      • wscript.exe (PID: 2504)
      • wscript.exe (PID: 1784)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • wscript.exe (PID: 2504)
      • wscript.exe (PID: 2260)
      • wscript.exe (PID: 1784)

    • Adds, changes, or deletes HTTP request header (SCRIPT)

      • wscript.exe (PID: 2504)
      • wscript.exe (PID: 1784)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2120)

    • Checks supported languages

      • idman641build15.exe (PID: 848)
      • IDM1.tmp (PID: 2168)
      • IDM-6.4x-Crack-v18.1-Ali.Dbg.exe (PID: 1340)

    • Manual execution by a user

      • idman641build15.exe (PID: 4044)
      • idman641build15.exe (PID: 848)
      • IDM-6.4x-Crack-v18.1-Ali.Dbg.exe (PID: 2832)
      • IDM-6.4x-Crack-v18.1-Ali.Dbg.exe (PID: 1340)

    • Create files in a temporary directory

      • IDM1.tmp (PID: 2168)
      • idman641build15.exe (PID: 848)
      • IDM-6.4x-Crack-v18.1-Ali.Dbg.exe (PID: 1340)

    • Reads the machine GUID from the registry

      • IDM1.tmp (PID: 2168)

    • Creates files in the program directory

      • IDM1.tmp (PID: 2168)
      • wscript.exe (PID: 2260)

    • Reads the computer name

      • IDM1.tmp (PID: 2168)

    • Creates files or folders in the user directory

      • IDM1.tmp (PID: 2168)

    • Checks proxy server information

      • wscript.exe (PID: 2504)
      • wscript.exe (PID: 1784)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2022:04:15 11:57:32
ZipCRC: 0x5884956f
ZipCompressedSize: 32149
ZipUncompressedSize: 76288
ZipFileName: IDM-6.4x-Crack-v18.1-Ali.Dbg.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
54
Monitored processes
9
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe idman641build15.exe no specs idman641build15.exe idm1.tmp no specs idm-6.4x-crack-v18.1-ali.dbg.exe no specs idm-6.4x-crack-v18.1-ali.dbg.exe wscript.exe wscript.exe wscript.exe

Process information

PID
CMD
Path
Indicators
Parent process
848"C:\Users\admin\AppData\Local\Temp\IDM_Internet_Download_Manager_6.41.15\idman641build15.exe" C:\Users\admin\AppData\Local\Temp\IDM_Internet_Download_Manager_6.41.15\idman641build15.exe
explorer.exe
User:
admin
Company:
Tonec Inc.
Integrity Level:
HIGH
Description:
Internet Download Manager installer
Exit code:
0
Version:
6, 41, 15, 1
Modules
Images
c:\users\admin\appdata\local\temp\idm_internet_download_manager_6.41.15\idman641build15.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
1340"C:\Users\admin\AppData\Local\Temp\IDM_Internet_Download_Manager_6.41.15\IDM-6.4x-Crack-v18.1-Ali.Dbg.exe" C:\Users\admin\AppData\Local\Temp\IDM_Internet_Download_Manager_6.41.15\IDM-6.4x-Crack-v18.1-Ali.Dbg.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\idm_internet_download_manager_6.41.15\idm-6.4x-crack-v18.1-ali.dbg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1784wscript.exe "C:\Users\admin\AppData\Local\Temp\\UPDT.vbs" /browser:"C:\Program Files\Google\Chrome\Application\chrome.exe" /crkver:"18.1"C:\Windows\System32\wscript.exe
IDM-6.4x-Crack-v18.1-Ali.Dbg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2120"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\IDM_Internet_Download_Manager_6.41.15.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2168"C:\Users\admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp" -d "C:\Users\admin\AppData\Local\Temp\IDM_Setup_Temp\"C:\Users\admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp—idman641build15.exe
User:
admin
Company:
Tonec Inc.
Integrity Level:
HIGH
Description:
Internet Download Manager installer
Version:
6, 41, 9, 1
Modules
Images
c:\users\admin\appdata\local\temp\idm_setup_temp\idm1.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2260wscript.exe "C:\Users\admin\AppData\Local\Temp\IDM_BAK.vbs" /idmdir:"C:\Program Files\Internet Download Manager\"C:\Windows\System32\wscript.exe
IDM-6.4x-Crack-v18.1-Ali.Dbg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2504wscript.exe "C:\Users\admin\AppData\Local\Temp\\UPDT.vbs" /browser:"C:\Program Files\Google\Chrome\Application\chrome.exe" /crkver:"18.1"C:\Windows\System32\wscript.exe
IDM-6.4x-Crack-v18.1-Ali.Dbg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2832"C:\Users\admin\AppData\Local\Temp\IDM_Internet_Download_Manager_6.41.15\IDM-6.4x-Crack-v18.1-Ali.Dbg.exe" C:\Users\admin\AppData\Local\Temp\IDM_Internet_Download_Manager_6.41.15\IDM-6.4x-Crack-v18.1-Ali.Dbg.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\idm_internet_download_manager_6.41.15\idm-6.4x-crack-v18.1-ali.dbg.exe
c:\windows\system32\ntdll.dll
4044"C:\Users\admin\AppData\Local\Temp\IDM_Internet_Download_Manager_6.41.15\idman641build15.exe" C:\Users\admin\AppData\Local\Temp\IDM_Internet_Download_Manager_6.41.15\idman641build15.exe—explorer.exe
User:
admin
Company:
Tonec Inc.
Integrity Level:
MEDIUM
Description:
Internet Download Manager installer
Exit code:
3221226540
Version:
6, 41, 15, 1
Modules
Images
c:\users\admin\appdata\local\temp\idm_internet_download_manager_6.41.15\idman641build15.exe
c:\windows\system32\ntdll.dll
Total events
15 079
Read events
14 918
Write events
142
Delete events
19

Modification events

(PID) Process:(2120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2120) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(2120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(2120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\IDM_Internet_Download_Manager_6.41.15.zip
(PID) Process:(2120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
4
Suspicious files
17
Text files
3
Unknown types
2

Dropped files

PID
Process
Filename
Type
2120WinRAR.exeC:\Users\admin\AppData\Local\Temp\IDM_Internet_Download_Manager_6.41.15\IDM-6.4x-Crack-v18.1-Ali.Dbg.exeexecutable
MD5:—
SHA256:—
2120WinRAR.exeC:\Users\admin\AppData\Local\Temp\IDM_Internet_Download_Manager_6.41.15\idman641build15.exeexecutable
MD5:—
SHA256:—
2168IDM1.tmpC:\Users\admin\AppData\Local\Temp\IDM_Setup_Temp\IDMSetup2.logbinary
MD5:—
SHA256:—
2168IDM1.tmpC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Download Manager\Uninstall IDM.lnkbinary
MD5:—
SHA256:—
2168IDM1.tmpC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Download Manager\Uninstall IDM.lnklnk
MD5:—
SHA256:—
2168IDM1.tmpC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Download Manager\license.lnkbinary
MD5:—
SHA256:—
2168IDM1.tmpC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Download Manager\license.lnkbinary
MD5:—
SHA256:—
2168IDM1.tmpC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Download Manager\IDM Help.lnkbinary
MD5:—
SHA256:—
2168IDM1.tmpC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Download Manager\IDM Help.lnkbinary
MD5:—
SHA256:—
2168IDM1.tmpC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Download Manager\Internet Download Manager.lnklnk
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
9
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2504
wscript.exe
GET
—
104.110.191.158:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?6e5b653400f9c322
unknown
—
—
unknown
1784
wscript.exe
GET
304
104.110.191.139:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?c851e7346fecb774
unknown
—
—
unknown
2504
wscript.exe
GET
200
142.250.184.227:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFCjJ1PwkYAi7fE%3D
unknown
—
—
unknown
2504
wscript.exe
GET
200
142.250.184.227:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
unknown
—
—
224.0.0.252:5355
—
—
—
unknown
2504
wscript.exe
172.67.164.61:443
idm.ckk.ir
CLOUDFLARENET
US
unknown
2504
wscript.exe
104.110.191.158:80
ctldl.windowsupdate.com
Akamai International B.V.
NL
unknown
2504
wscript.exe
142.250.184.227:80
ocsp.pki.goog
GOOGLE
US
whitelisted
1784
wscript.exe
172.67.164.61:443
idm.ckk.ir
CLOUDFLARENET
US
unknown
1784
wscript.exe
104.110.191.139:80
ctldl.windowsupdate.com
Akamai International B.V.
NL
unknown

DNS requests

Domain
IP
Reputation
idm.ckk.ir
  • 172.67.164.61
  • 104.21.15.209
unknown
ctldl.windowsupdate.com
  • 104.110.191.158
  • 104.110.191.140
  • 104.110.191.139
  • 104.110.191.169
  • 104.110.191.133
  • 104.110.191.155
  • 104.110.191.165
  • 104.110.191.171
whitelisted
ocsp.pki.goog
  • 142.250.184.227
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
IDM_Internet_Download_Manager_6.41.15.zip