File name:

1.zip

Full analysis: https://app.any.run/tasks/097c9174-dcb4-4634-bb8d-53addecac9e1
Verdict: Malicious activity
Analysis date: December 25, 2024, 15:16:24
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
evasion
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

95E010FEB14CFB00C835FA50FE0E57CF

SHA1:

F822971E417D4C5EB7D0CDA8831BBAC91BAE798D

SHA256:

81C77C5E75627424061C5A005BAD6F873B92B692DA469D2A38B211B3BEF9357B

SSDEEP:

196608:Brw0F4f/ivqcht/elltZRIEArfc994aoBFJ3:5w//MqchQlfIEAr0r7ofp

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 2324)

    • Antivirus name has been found in the command line (generic signature)

      • MpCmdRun.exe (PID: 2008)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • ת הקשורות להפרת זכויות יוצרים.exe (PID: 5244)
      • WinRAR.exe (PID: 2324)

    • Checks for external IP

      • ת הקשורות להפרת זכויות יוצרים.exe (PID: 5244)

    • Executing commands from a ".bat" file

      • WinRAR.exe (PID: 2324)

    • Starts CMD.EXE for commands execution

      • WinRAR.exe (PID: 2324)

  • INFO

    • The process uses the downloaded file

      • WinRAR.exe (PID: 2324)

    • Reads the computer name

      • ת הקשורות להפרת זכויות יוצרים.exe (PID: 5244)
      • MpCmdRun.exe (PID: 2008)

    • Checks supported languages

      • ת הקשורות להפרת זכויות יוצרים.exe (PID: 5244)
      • MpCmdRun.exe (PID: 2008)

    • Manual execution by a user

      • ת הקשורות להפרת זכויות יוצרים.exe (PID: 5244)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2324)

    • Checks proxy server information

      • ת הקשורות להפרת זכויות יוצרים.exe (PID: 5244)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 2324)

    • Create files in a temporary directory

      • MpCmdRun.exe (PID: 2008)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0002
ZipCompression: Deflated
ZipModifyDate: 2024:12:25 00:25:04
ZipCRC: 0x2211c678
ZipCompressedSize: 18516173
ZipUncompressedSize: 31272960
ZipFileName: msimg32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
121
Monitored processes
5
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe ת הקשורות להפרת זכויות יוצרים.exe cmd.exe no specs conhost.exe no specs mpcmdrun.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1016C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\Rar$VR2324.13593\Rar$Scan22487.bat" "C:\Windows\System32\cmd.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
2008"C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\admin\AppData\Local\Temp\Rar$VR2324.13593"C:\Program Files\Windows Defender\MpCmdRun.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Malware Protection Command Line Utility
Exit code:
2
Version:
4.18.1909.6 (WinBuild.160101.0800)
Modules
Images
c:\program files\windows defender\mpcmdrun.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
2324"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\1.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
2796\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5244"C:\Users\admin\Desktop\ת הקשורות להפרת זכויות יוצרים.exe" C:\Users\admin\Desktop\ת הקשורות להפרת זכויות יוצרים.exe
explorer.exe
User:
admin
Company:
Haihaisoft Limited
Integrity Level:
MEDIUM
Description:
Haihaisoft PDF Reader
Version:
1.5.7.0
Modules
Images
c:\users\admin\desktop\ת הקשורות להפרת זכויות יוצרים.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
2 054
Read events
2 044
Write events
10
Delete events
0

Modification events

(PID) Process:(2324) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(2324) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(2324) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(2324) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\1.zip
(PID) Process:(2324) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2324) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2324) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2324) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(5244) ת הקשורות להפרת זכויות יוצרים.exeKey:HKEY_CURRENT_USER\SOFTWARE\Haihaisoft PDF Reader
Operation:writeName:UpdateDate
Value:
133796134086640000
(PID) Process:(2324) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\VirusScan
Operation:writeName:DefScanner
Value:
Windows Defender
Executable files
2
Suspicious files
0
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
2008MpCmdRun.exeC:\Users\admin\AppData\Local\Temp\MpCmdRun.logtext
MD5:DB44169F16BDAF5509C80DB3C4D6D0EC
SHA256:5373E1632A045D836E8FC0EC4AF80D857DF02075E24F18C6D66C53E40178A17F
2324WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR2324.13593\1.zip\ת הקשורות להפרת זכויות יוצרים.exeexecutable
MD5:4864A55CFF27F686023456A22371E790
SHA256:08C7FB6067ACC8AC207D28AB616C9EA5BC0D394956455D6A3EECB73F8010F7A2
2324WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR2324.13593\Rar$Scan22487.battext
MD5:7870417323E0FCAA19BF5A8935F96682
SHA256:7199DBAEEF46A82C692005D2E30FDF1161A76FFC609F2A3FEF61C19547A56C9F
2324WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR2324.13593\1.zip\msimg32.dllexecutable
MD5:A4B49EFA4D0BA48A1888422E174FDEB2
SHA256:B2FA5AC6E8619A365F5FFC1D98E8C2927FEDF8BEA71418A01BB0184B684A601C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
22
DNS requests
10
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
640
svchost.exe
GET
200
23.53.40.178:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.53.40.178:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5244
ת הקשורות להפרת זכויות יוצרים.exe
GET
200
163.171.128.241:80
http://www.drm-x.com/pdfversion.htm
unknown
—
—
unknown
640
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
640
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
—
—
192.168.100.255:138
—
—
—
whitelisted
—
—
2.23.209.135:443
www.bing.com
Akamai International B.V.
GB
whitelisted
640
svchost.exe
23.53.40.178:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
23.53.40.178:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
640
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5244
ת הקשורות להפרת זכויות יוצרים.exe
163.171.128.241:80
www.drm-x.com
QUANTILNETWORKS
DE
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
www.bing.com
  • 2.23.209.135
  • 2.23.209.148
  • 2.23.209.141
  • 2.23.209.149
  • 2.23.209.133
  • 2.23.209.150
  • 2.23.209.160
  • 2.23.209.140
  • 2.23.209.176
whitelisted
google.com
  • 142.250.185.174
whitelisted
crl.microsoft.com
  • 23.53.40.178
  • 23.53.40.176
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
www.drm-x.com
  • 163.171.128.241
  • 163.171.128.150
unknown
self.events.data.microsoft.com
  • 40.79.150.121
whitelisted

Threats

PID
Process
Class
Message
5244
ת הקשורות להפרת זכויות יוצרים.exe
Device Retrieving External IP Address Detected
SUSPICIOUS [ANY.RUN] An IP address was received from the server as a result of an HTTP request
No debug info