File name:

79cdd44444d49b22b035fb0e695f0032c002479f

Full analysis: https://app.any.run/tasks/9ec5390b-2a7b-4068-a6f8-c9d6d22a91fb
Verdict: Malicious activity
Analysis date: December 13, 2024, 19:11:37
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
nodejs
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

FB2D69A2F0BB28DE6BFBC7CFE1B2763B

SHA1:

79CDD44444D49B22B035FB0E695F0032C002479F

SHA256:

87200E8B43A6707CD66FC240D2C9E9DA7F3ED03C8507ADF7C1CFE56BA1A9C57D

SSDEEP:

393216:OgqoMmxISDrjLsFjmMTc0CEwXmb8Kv9mv5Hot6TxeZZFDb5og/PUvwFAO:OgqoMmx7Dr3sFRT/8sAq6FeHpdrD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • 79cdd44444d49b22b035fb0e695f0032c002479f.exe (PID: 6956)

  • SUSPICIOUS

    • Malware-specific behavior (creating "System.dll" in Temp)

      • 79cdd44444d49b22b035fb0e695f0032c002479f.exe (PID: 6956)

    • Drops 7-zip archiver for unpacking

      • 79cdd44444d49b22b035fb0e695f0032c002479f.exe (PID: 6956)

    • Executable content was dropped or overwritten

      • 79cdd44444d49b22b035fb0e695f0032c002479f.exe (PID: 6956)

    • Reads security settings of Internet Explorer

      • 79cdd44444d49b22b035fb0e695f0032c002479f.exe (PID: 6956)

    • Process drops legitimate windows executable

      • 79cdd44444d49b22b035fb0e695f0032c002479f.exe (PID: 6956)

    • Starts CMD.EXE for commands execution

      • ArchiverApp.exe (PID: 4544)

    • Starts application with an unusual extension

      • cmd.exe (PID: 5920)

    • Application launched itself

      • ArchiverApp.exe (PID: 4544)

  • INFO

    • The sample compiled with english language support

      • 79cdd44444d49b22b035fb0e695f0032c002479f.exe (PID: 6956)

    • Reads the computer name

      • 79cdd44444d49b22b035fb0e695f0032c002479f.exe (PID: 6956)
      • ArchiverApp.exe (PID: 4544)
      • ArchiverApp.exe (PID: 6472)
      • ArchiverApp.exe (PID: 4536)

    • Checks supported languages

      • 79cdd44444d49b22b035fb0e695f0032c002479f.exe (PID: 6956)
      • ArchiverApp.exe (PID: 4544)
      • chcp.com (PID: 6436)
      • ArchiverApp.exe (PID: 6472)
      • ArchiverApp.exe (PID: 4536)

    • Changes the display of characters in the console

      • cmd.exe (PID: 5920)

    • Create files in a temporary directory

      • 79cdd44444d49b22b035fb0e695f0032c002479f.exe (PID: 6956)

    • Reads the machine GUID from the registry

      • ArchiverApp.exe (PID: 4544)

    • Node.js compiler has been detected

      • ArchiverApp.exe (PID: 4544)
      • ArchiverApp.exe (PID: 6472)
      • ArchiverApp.exe (PID: 4536)

    • Checks proxy server information

      • ArchiverApp.exe (PID: 4544)

    • Creates files or folders in the user directory

      • ArchiverApp.exe (PID: 4544)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:12:15 22:26:14+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26624
InitializedDataSize: 473088
UninitializedDataSize: 16384
EntryPoint: 0x338f
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 6.9.6.0
ProductVersionNumber: 6.9.6.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
FileDescription: -
FileVersion: 7.0.0
LegalCopyright: Copyright © 2024 ArchiverApp
LegalTrademarks: Silvanio Industries
ProductName: ArchiverApp
ProductVersion: 6.9.6
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
125
Monitored processes
7
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 79cdd44444d49b22b035fb0e695f0032c002479f.exe archiverapp.exe cmd.exe no specs conhost.exe no specs chcp.com no specs archiverapp.exe no specs archiverapp.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
6956"C:\Users\admin\AppData\Local\Temp\79cdd44444d49b22b035fb0e695f0032c002479f.exe" C:\Users\admin\AppData\Local\Temp\79cdd44444d49b22b035fb0e695f0032c002479f.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Version:
7.0.0
Modules
Images
c:\users\admin\appdata\local\temp\79cdd44444d49b22b035fb0e695f0032c002479f.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4544C:\Users\admin\AppData\Local\Temp\2q1oo5RcYTQ2dy9Id93vQ9yupDA\ArchiverApp.exe C:\Users\admin\AppData\Local\Temp\2q1oo5RcYTQ2dy9Id93vQ9yupDA\ArchiverApp.exe
79cdd44444d49b22b035fb0e695f0032c002479f.exe
User:
admin
Company:
GitHub, Inc.
Integrity Level:
MEDIUM
Description:
ArchiverApp
Version:
7.0.0
Modules
Images
c:\users\admin\appdata\local\temp\2q1oo5rcytq2dy9id93vq9yupda\archiverapp.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
5920C:\WINDOWS\system32\cmd.exe /d /s /c "chcp"C:\Windows\SysWOW64\cmd.exe—ArchiverApp.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6304\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6436chcpC:\Windows\SysWOW64\chcp.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Change CodePage Utility
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\chcp.com
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6472"C:\Users\admin\AppData\Local\Temp\2q1oo5RcYTQ2dy9Id93vQ9yupDA\ArchiverApp.exe" --type=gpu-process --user-data-dir="C:\Users\admin\AppData\Roaming\bmzyxxofvcrvmhzr" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1892 --field-trial-handle=1896,i,16251420032166522544,1757474095296082962,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2C:\Users\admin\AppData\Local\Temp\2q1oo5RcYTQ2dy9Id93vQ9yupDA\ArchiverApp.exe—ArchiverApp.exe
User:
admin
Company:
GitHub, Inc.
Integrity Level:
LOW
Description:
ArchiverApp
Version:
7.0.0
Modules
Images
c:\users\admin\appdata\local\temp\2q1oo5rcytq2dy9id93vq9yupda\archiverapp.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
4536"C:\Users\admin\AppData\Local\Temp\2q1oo5RcYTQ2dy9Id93vQ9yupDA\ArchiverApp.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\admin\AppData\Roaming\bmzyxxofvcrvmhzr" --mojo-platform-channel-handle=2188 --field-trial-handle=1896,i,16251420032166522544,1757474095296082962,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8C:\Users\admin\AppData\Local\Temp\2q1oo5RcYTQ2dy9Id93vQ9yupDA\ArchiverApp.exe—ArchiverApp.exe
User:
admin
Company:
GitHub, Inc.
Integrity Level:
MEDIUM
Description:
ArchiverApp
Version:
7.0.0
Modules
Images
c:\users\admin\appdata\local\temp\2q1oo5rcytq2dy9id93vq9yupda\archiverapp.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
Total events
1 658
Read events
1 658
Write events
0
Delete events
0

Modification events

No data
Executable files
17
Suspicious files
108
Text files
2
Unknown types
14

Dropped files

PID
Process
Filename
Type
695679cdd44444d49b22b035fb0e695f0032c002479f.exeC:\Users\admin\AppData\Local\Temp\nsr9B4A.tmp\app-32.7z —
MD5:—
SHA256:—
695679cdd44444d49b22b035fb0e695f0032c002479f.exeC:\Users\admin\AppData\Local\Temp\nsr9B4A.tmp\7z-out\icudtl.dat —
MD5:—
SHA256:—
695679cdd44444d49b22b035fb0e695f0032c002479f.exeC:\Users\admin\AppData\Local\Temp\nsr9B4A.tmp\7z-out\LICENSES.chromium.html —
MD5:—
SHA256:—
695679cdd44444d49b22b035fb0e695f0032c002479f.exeC:\Users\admin\AppData\Local\Temp\nsr9B4A.tmp\System.dllexecutable
MD5:0D7AD4F45DC6F5AA87F606D0331C6901
SHA256:3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
695679cdd44444d49b22b035fb0e695f0032c002479f.exeC:\Users\admin\AppData\Local\Temp\nsr9B4A.tmp\7z-out\locales\bg.pakpgc
MD5:A19269683A6347E07C55325B9ECC03A4
SHA256:AD65351A240205E881EF5C4CF30AD1BC6B6E04414343583597086B62D48D8A24
695679cdd44444d49b22b035fb0e695f0032c002479f.exeC:\Users\admin\AppData\Local\Temp\nsr9B4A.tmp\7z-out\locales\ar.pakpgc
MD5:47A6D10B4112509852D4794229C0A03B
SHA256:857FE3AB766B60A8D82B7B6043137E3A7D9F5CFB8DDD942316452838C67D0495
695679cdd44444d49b22b035fb0e695f0032c002479f.exeC:\Users\admin\AppData\Local\Temp\nsr9B4A.tmp\7z-out\locales\cs.pakpgc
MD5:04A680847C4A66AD9F0A88FB9FB1FC7B
SHA256:1CC44C5FBE1C0525DF37C5B6267A677F79C9671F86EDA75B6FC13ABF5D5356EB
695679cdd44444d49b22b035fb0e695f0032c002479f.exeC:\Users\admin\AppData\Local\Temp\nsr9B4A.tmp\7z-out\LICENSE.electron.txttext
MD5:4D42118D35941E0F664DDDBD83F633C5
SHA256:5154E165BD6C2CC0CFBCD8916498C7ABAB0497923BAFCD5CB07673FE8480087D
695679cdd44444d49b22b035fb0e695f0032c002479f.exeC:\Users\admin\AppData\Local\Temp\nsr9B4A.tmp\7z-out\locales\es.pakpgc
MD5:A36992D320A88002697DA97CD6A4F251
SHA256:C5566B661675B613D69A507CBF98768BC6305B80E6893DC59651A4BE4263F39D
695679cdd44444d49b22b035fb0e695f0032c002479f.exeC:\Users\admin\AppData\Local\Temp\nsr9B4A.tmp\7z-out\locales\am.pakpgc
MD5:2009647C3E7AED2C4C6577EE4C546E19
SHA256:6D61E5189438F3728F082AD6F694060D7EE8E571DF71240DFD5B77045A62954E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
95
DNS requests
21
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
—
—
GET
200
23.48.23.174:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6648
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6648
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
5392
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5392
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:138
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.48.23.174:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5064
SearchApp.exe
104.126.37.145:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1176
svchost.exe
20.190.160.17:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1176
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 51.104.136.2
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.48.23.174
  • 23.48.23.167
  • 23.48.23.183
  • 23.48.23.176
  • 23.48.23.166
  • 23.48.23.162
  • 23.48.23.177
  • 23.48.23.181
  • 23.48.23.169
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 88.221.169.152
whitelisted
google.com
  • 142.250.185.206
whitelisted
www.bing.com
  • 104.126.37.145
  • 104.126.37.139
  • 104.126.37.146
  • 104.126.37.136
  • 104.126.37.130
  • 104.126.37.131
  • 104.126.37.137
  • 104.126.37.129
  • 104.126.37.144
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.160.17
  • 40.126.32.134
  • 40.126.32.136
  • 20.190.160.14
  • 40.126.32.72
  • 40.126.32.138
  • 20.190.160.20
  • 40.126.32.74
whitelisted
go.microsoft.com
  • 23.213.166.81
whitelisted
www.google.com
  • 142.250.185.228
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
79cdd44444d49b22b035fb0e695f0032c002479f