File name:

VMware Workstation 10.0.2 Cracked.7z

Full analysis: https://app.any.run/tasks/a7897ae6-cd00-45df-a256-aa52daf39658
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: December 28, 2024, 23:49:03
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
ransomware
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

38644204661AA1AF9B37D0BB57B4D074

SHA1:

89A472C48FAEC21A8731B5C2E302DD3E8FCA778C

SHA256:

8682708F673A7D584001119BC935FB4158CD7D77C855254E872E10851977E0D9

SSDEEP:

98304:elUAlUDJS+FgoQ1qY/B0xI6NfBnmpYkk+vML9J4r15+yFa+CpKBbw72r9eZk8Lge:5FAM9bh

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • VMware-workstation-full-10.0.2-1744117.exe (PID: 6840)

    • RANSOMWARE has been detected

      • VMware-workstation-full-10.0.2-1744117.exe (PID: 6840)

    • Deletes shadow copies

      • cmd.exe (PID: 7144)

  • SUSPICIOUS

    • Application launched itself

      • Taskmgr.exe (PID: 6936)

    • Reads the BIOS version

      • VMware-workstation-full-10.0.2-1744117.exe (PID: 6840)

    • Uses RUNDLL32.EXE to load library

      • control.exe (PID: 5788)

    • Executes as Windows Service

      • VSSVC.exe (PID: 2448)

    • Reads security settings of Internet Explorer

      • VMware-workstation-full-10.0.2-1744117.exe (PID: 6840)

    • Start notepad (likely ransomware note)

      • VMware-workstation-full-10.0.2-1744117.exe (PID: 6840)

    • Starts CMD.EXE for commands execution

      • VMware-workstation-full-10.0.2-1744117.exe (PID: 6840)

  • INFO

    • Manual execution by a user

      • Taskmgr.exe (PID: 6884)
      • Taskmgr.exe (PID: 6936)
      • VMware-workstation-full-10.0.2-1744117.exe (PID: 6840)
      • control.exe (PID: 5788)

    • Reads security settings of Internet Explorer

      • Taskmgr.exe (PID: 6936)
      • control.exe (PID: 5788)
      • rundll32.exe (PID: 2828)
      • notepad.exe (PID: 6948)
      • WMIC.exe (PID: 7160)
      • Taskmgr.exe (PID: 7048)

    • The process uses the downloaded file

      • WinRAR.exe (PID: 1064)
      • VMware-workstation-full-10.0.2-1744117.exe (PID: 6840)
      • Taskmgr.exe (PID: 6936)
      • control.exe (PID: 5788)
      • rundll32.exe (PID: 2828)

    • Reads the computer name

      • VMware-workstation-full-10.0.2-1744117.exe (PID: 6840)

    • Reads the machine GUID from the registry

      • VMware-workstation-full-10.0.2-1744117.exe (PID: 6840)

    • Creates files or folders in the user directory

      • VMware-workstation-full-10.0.2-1744117.exe (PID: 6840)

    • Process checks whether UAC notifications are on

      • VMware-workstation-full-10.0.2-1744117.exe (PID: 6840)

    • Process checks computer location settings

      • VMware-workstation-full-10.0.2-1744117.exe (PID: 6840)

    • Checks supported languages

      • VMware-workstation-full-10.0.2-1744117.exe (PID: 6840)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)

EXIF

ZIP

FileVersion: 7z v0.04
ModifyDate: 2024:12:12 18:45:25+00:00
ArchivedFileName: VMware-workstation-full-10.0.2-1744117.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
148
Monitored processes
15
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs taskmgr.exe no specs taskmgr.exe taskmgr.exe no specs control.exe no specs rundll32.exe no specs systempropertiescomputername.exe no specs systempropertiescomputername.exe THREAT vmware-workstation-full-10.0.2-1744117.exe conhost.exe no specs notepad.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs vssvc.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1064"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\VMware Workstation 10.0.2 Cracked.7z"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
2448C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2828"C:\WINDOWS\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\WINDOWS\system32\sysdm.cpl",C:\Windows\System32\rundll32.exe—control.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
3576\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—VMware-workstation-full-10.0.2-1744117.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3772\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4384"C:\Windows\System32\SystemPropertiesComputerName.exe" C:\Windows\System32\SystemPropertiesComputerName.exe
rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Change Computer Settings
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\systempropertiescomputername.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sysdm.cpl
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
5472"C:\Windows\System32\SystemPropertiesComputerName.exe" C:\Windows\System32\SystemPropertiesComputerName.exe—rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Change Computer Settings
Exit code:
3221226540
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\systempropertiescomputername.exe
c:\windows\system32\ntdll.dll
5788"C:\WINDOWS\System32\control.exe" "C:\WINDOWS\system32\sysdm.cpl",C:\Windows\System32\control.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Control Panel
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\control.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6840"C:\Users\admin\Desktop\VMware-workstation-full-10.0.2-1744117.exe" C:\Users\admin\Desktop\VMware-workstation-full-10.0.2-1744117.exe
explorer.exe
User:
admin
Company:
VMware, Inc.
Integrity Level:
HIGH
Description:
VMware Software Installer
Exit code:
0
Version:
1.1.2 build-00000
Modules
Images
c:\users\admin\desktop\vmware-workstation-full-10.0.2-1744117.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\mscoree.dll
6884"C:\WINDOWS\system32\taskmgr.exe" /4C:\Windows\System32\Taskmgr.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Manager
Exit code:
3221226540
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
Total events
9 000
Read events
8 971
Write events
27
Delete events
2

Modification events

(PID) Process:(1064) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(1064) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(1064) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(1064) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\VMware Workstation 10.0.2 Cracked.7z
(PID) Process:(1064) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1064) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1064) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1064) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1064) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(1064) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:name
Value:
256
Executable files
0
Suspicious files
58
Text files
17
Unknown types
0

Dropped files

PID
Process
Filename
Type
1064WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1064.6288\VMware-workstation-full-10.0.2-1744117.exe —
MD5:—
SHA256:—
6936Taskmgr.exeC:\Users\admin\AppData\Local\D3DSCache\3534848bb9f4cb71\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.locktext
MD5:F49655F856ACB8884CC0ACE29216F511
SHA256:7852FCE59C67DDF1D6B8B997EAA1ADFAC004A9F3A91C37295DE9223674011FBA
6840VMware-workstation-full-10.0.2-1744117.exeC:\Users\admin\Downloads\ZWZmZWN0c3Byb2R1Y3RzLnBuZw==.glorytoukrainebinary
MD5:048584BE412023B849D064AB34CC91BD
SHA256:D1177183DF47850DEA20B939C2E241470684BFB1A1F5C326F555DB681ED01CFE
6840VMware-workstation-full-10.0.2-1744117.exeC:\Users\admin\Downloads\ZGVza3RvcC5pbmk=.glorytoukrainebinary
MD5:4E2CB40E9510BF44F2FBB4985056119E
SHA256:CE1216852FBB5B671DBA1E7A593EC70A115FFAB44B1E0F71170CB56F521A7350
6840VMware-workstation-full-10.0.2-1744117.exeC:\Users\admin\Documents\ZG9pbmdmb3JlaWduLnJ0Zg==.glorytoukrainebinary
MD5:C6593C08E7EC6A5448E649C1E498E996
SHA256:AFC8E066004FB67DD1CD71D632A13781ECF31D3FEF65E87A79288805564719A5
6840VMware-workstation-full-10.0.2-1744117.exeC:\Users\admin\Downloads\bGlzdGluZ29mZmljaWFsLmpwZw==.glorytoukrainebinary
MD5:80D5A2C4C63EE04FC0D2E08357D0F08F
SHA256:8B82CF7275C5081A7B21F7E91E1FD2F9E813199684D6359B9FB03699D898E94E
6840VMware-workstation-full-10.0.2-1744117.exeC:\Users\admin\Downloads\ZmFsbGNvbW1hbmQucG5n.glorytoukrainebinary
MD5:715C0E4370A2F5A6AC85BA1D28B79B12
SHA256:EE8F8F19F659E5DC265B88B18910169DA1CBFF712F44AB4D3A1C929771E661A3
6840VMware-workstation-full-10.0.2-1744117.exeC:\Users\admin\Documents\ZGVza3RvcC5pbmk=.glorytoukrainebinary
MD5:0821A4D4CB057F70811B7AB3E6093D85
SHA256:C8755A7B073813C660BE9D9A55E99E49DFE8FEB8836D4A101D3F1D33773A81F6
6840VMware-workstation-full-10.0.2-1744117.exeC:\Users\admin\Documents\OneNote Notebooks\My Notebook\T3BlbiBOb3RlYm9vay5vbmV0b2My.glorytoukrainebinary
MD5:3B2663E4F363F593794963EE3C30094F
SHA256:564CD5B8E38BD7238F25F19B490AB8F87815B2E4BCEF03187EA0BDC91B12D245
6840VMware-workstation-full-10.0.2-1744117.exeC:\Users\admin\Documents\bWV0bWF4aW11bS5ydGY=.glorytoukrainebinary
MD5:9AA820F3081CF3BCC8535F29948A2579
SHA256:579D6D235B2D03C415A2C99F37782673C1E6F2A15BD8BC035270DCCE84B3C8CF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
33
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
7152
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7152
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6256
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
732
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4712
MoUsoCoreWorker.exe
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4712
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5064
SearchApp.exe
2.23.209.187:443
www.bing.com
Akamai International B.V.
GB
whitelisted
1176
svchost.exe
40.126.32.140:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1176
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 2.16.164.49
  • 2.16.164.120
unknown
www.microsoft.com
  • 95.101.149.131
  • 23.35.229.160
whitelisted
google.com
  • 142.250.184.206
whitelisted
www.bing.com
  • 2.23.209.187
  • 2.23.209.130
  • 2.23.209.149
  • 2.23.209.133
  • 2.23.209.182
whitelisted
login.live.com
  • 40.126.32.140
  • 40.126.32.138
  • 40.126.32.74
  • 20.190.160.14
  • 40.126.32.72
  • 40.126.32.76
  • 20.190.160.20
  • 40.126.32.68
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
VMware Workstation 10.0.2 Cracked.7z