File name:

mmc-develop-win32.zip

Full analysis: https://app.any.run/tasks/9775b820-23f3-414c-955f-84320fd4c90d
Verdict: Malicious activity
Analysis date: November 07, 2023, 19:10:27
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

1A332FE339F321EBB3B91CBE6F7034DC

SHA1:

94B8E884CBF59378754BC300E60E570ED204E819

SHA256:

85C9B01515C4F19F797D8753D7187F463B3C742012BD22D3EA84C222EA7F5A76

SSDEEP:

98304:PKSe0AxsA44S7ZENwbFjCJxGE/PnVtMbbi/iC4AzQIbs/ZIqh96p+aekQff+MzVK:sCfBbh2n42DHPlWL60jYcnXBih

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • MultiMC.exe (PID: 2928)

  • SUSPICIOUS

    • Reads settings of System Certificates

      • MultiMC.exe (PID: 2928)

    • Checks for Java to be installed

      • MultiMC.exe (PID: 2928)
      • javaw.exe (PID: 3524)
      • javaw.exe (PID: 3556)

  • INFO

    • Reads the machine GUID from the registry

      • MultiMC.exe (PID: 2928)
      • wmpnscfg.exe (PID: 4016)

    • Create files in a temporary directory

      • MultiMC.exe (PID: 2928)
      • javaw.exe (PID: 3472)
      • javaw.exe (PID: 3524)
      • javaw.exe (PID: 3556)

    • Checks supported languages

      • MultiMC.exe (PID: 2928)
      • javaw.exe (PID: 3472)
      • javaw.exe (PID: 3524)
      • javaw.exe (PID: 3556)
      • wmpnscfg.exe (PID: 4016)

    • Reads the computer name

      • MultiMC.exe (PID: 2928)
      • wmpnscfg.exe (PID: 4016)

    • Creates files in the program directory

      • javaw.exe (PID: 3524)
      • javaw.exe (PID: 3472)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 4016)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3212)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2023:09:17 11:21:22
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: MultiMC/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
7
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs multimc.exe javaw.exe no specs javaw.exe no specs icacls.exe no specs javaw.exe no specs wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2928"C:\Users\admin\AppData\Local\Temp\Rar$EXa3212.24462\MultiMC\MultiMC.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3212.24462\MultiMC\MultiMC.exe
WinRAR.exe
User:
admin
Company:
MultiMC Contributors
Integrity Level:
MEDIUM
Description:
MultiMC Launcher
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3212.24462\multimc\multimc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\temp\rar$exa3212.24462\multimc\liblauncher_iconfix.dll
c:\users\admin\appdata\local\temp\rar$exa3212.24462\multimc\qt5core.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3212"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\mmc-develop-win32.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3472"C:\Program Files\Java\jre1.8.0_271\bin\javaw.exe" -jar C:/Users/admin/AppData/Local/Temp/Rar$EXa3212.24462/MultiMC/jars/JavaCheck.jarC:\Program Files\Java\jre1.8.0_271\bin\javaw.exe—MultiMC.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.2710.9
Modules
Images
c:\program files\java\jre1.8.0_271\bin\javaw.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3524javaw -jar C:/Users/admin/AppData/Local/Temp/Rar$EXa3212.24462/MultiMC/jars/JavaCheck.jarC:\Program Files\Common Files\Oracle\Java\javapath_target_52116515\javaw.exe—MultiMC.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.2710.9
Modules
Images
c:\program files\common files\oracle\java\javapath_target_52116515\javaw.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3556javaw -Xms512m -Xmx1024m -jar C:/Users/admin/AppData/Local/Temp/Rar$EXa3212.24462/MultiMC/jars/JavaCheck.jarC:\Program Files\Common Files\Oracle\Java\javapath_target_52116515\javaw.exe—MultiMC.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.2710.9
Modules
Images
c:\program files\common files\oracle\java\javapath_target_52116515\javaw.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3584C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)MC:\Windows\System32\icacls.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
4016"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
Total events
2 992
Read events
2 971
Write events
16
Delete events
5

Modification events

(PID) Process:(3212) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17A\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3212) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3212) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3212) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3212) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3212) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3212) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3212) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3212) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3212) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
30
Suspicious files
12
Text files
27
Unknown types
0

Dropped files

PID
Process
Filename
Type
3212WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3212.24462\MultiMC\Qt5Core.dllexecutable
MD5:9C31C47941EDD8AED4BB51A3BE9C6EA2
SHA256:79B83C43AF99A9CB72A744AE2262C090227907907E8F2DEB937CD4E1F0965E4D
3212WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3212.24462\MultiMC\libLauncher_nbt++.dllexecutable
MD5:A8FD1D3CA86576AF970775E814578DC0
SHA256:0DE8B725FF2074290B6C9F5F38A4650B84EAF299456C2DC5CD9E71B1E1962824
3212WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3212.24462\MultiMC\iconengines\qsvgicon.dllexecutable
MD5:CBB708ACDBCFD89E1DE38E2C4AA9192A
SHA256:8CB93B212C02FD6D222E985E629DF698227323C43B7F0B71BE3649AA8CB3CC2F
3212WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3212.24462\MultiMC\libLauncher_nbt++.dll.abinary
MD5:D33B558EF7BD4D8617686BA972D581EB
SHA256:41D0787573AC821BE0CE45BCADDC77440A1BB1B9CB077B3C86C39B75B1404B11
3212WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3212.24462\MultiMC\Qt5Network.dllexecutable
MD5:A72DFD36B9B8C51DE93F3C7CCA5945CE
SHA256:41FAFDCEA112CB01EDADC0B2C14995D4CF05E4B5FD101A6E196BAAA614B228E8
3212WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3212.24462\MultiMC\Qt5Svg.dllexecutable
MD5:96934C8F93716FB4C5AB7433C3FCF660
SHA256:ADB44DE5A537F5FADB9288E3852189F799BA7B95CEF847F2198A8864AB6F063B
3212WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3212.24462\MultiMC\MultiMC.exeexecutable
MD5:028F895FFC4FCBCA816498FA009E672C
SHA256:4213D880E0BD7926FCB1CBDCB1FA94AB4D7E9810DF5E5FFD23D267194CF4D2A2
3212WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3212.24462\MultiMC\libLauncher_iconfix.dllexecutable
MD5:84ACB289049B167366875F61B5596752
SHA256:055F67A18E58C8637CB2CD8A58F9C05BB942521465954E18722564E0337776BE
3212WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3212.24462\MultiMC\libstdc++-6.dllexecutable
MD5:C283D446B34E75019B81D0981CB11F0D
SHA256:F6530962659D0641236A42517A30DC55C4FCB7D30E942C3E820AF343798A770D
3212WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3212.24462\MultiMC\libLauncher_quazip.dllexecutable
MD5:8EEFE03D3897ACF1C470197676C6E460
SHA256:CE2D399A65AF4A02AEF7EC144643C4A104933CCBED859CD47BC6FAD908AEFFDB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
8
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
301
172.67.132.190:80
http://files.multimc.org/update/win32/develop/index.json
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
868
svchost.exe
184.30.20.134:80
armmf.adobe.com
AKAMAI-AS
DE
unknown
2928
MultiMC.exe
172.67.132.190:443
files.multimc.org
CLOUDFLARENET
US
unknown
2928
MultiMC.exe
172.67.132.190:80
files.multimc.org
CLOUDFLARENET
US
unknown
2928
MultiMC.exe
104.21.5.18:443
files.multimc.org
CLOUDFLARENET
—
unknown

DNS requests

Domain
IP
Reputation
armmf.adobe.com
  • 184.30.20.134
whitelisted
files.multimc.org
  • 172.67.132.190
  • 104.21.5.18
unknown
multimc.org
  • 172.67.132.190
  • 104.21.5.18
whitelisted
meta.multimc.org
  • 104.21.5.18
  • 172.67.132.190
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
mmc-develop-win32.zip