Malware analysis 𝙰𝚛𝚌𝚑𝚒𝚟𝚘795_485.zip Malicious activity

Add for printing

File name:	𝙰𝚛𝚌𝚑𝚒𝚟𝚘795_485.zip
Full analysis:	https://app.any.run/tasks/b18e9f4f-5301-468f-ac32-5360032b79d3
Verdict:	Malicious activity
Analysis date:	October 03, 2025, 16:51:38
OS:	Windows 10 Professional (build: 19044, 64 bit)
Tags:	anti-evasion
Indicators:
MIME:	application/zip
File info:	Zip archive data, at least v2.0 to extract, compression method=store
MD5:	D43BFB4F8FA4EA921551A12BD4431C4A
SHA1:	DC7DD6A9D2192CEE0F4B913B61C82F1BCD22B145
SHA256:	89AA37A3D1090F64D30CD494C8FA3771E4E7AC6728C14D1698F38C36753B2A4F
SSDEEP:	96:4UhV8oZ7l+JaecSt5n4waSGSMxzfGBTV8qhGY2+IC:FOh9t1XGSCIWBBC

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 60 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: none
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on
Elevated privileges:: off

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (133.0.6943.127)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (133.0.3065.92)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (136.0)
Mozilla Maintenance Service (136.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- Collects BIOS Properties (Win32_BIOS) (SCRIPT)
  - mshta.exe (PID: 2896)
  - mshta.exe (PID: 532)
- Checks whether a specified folder exists (SCRIPT)
  - mshta.exe (PID: 2896)
  - mshta.exe (PID: 532)
- Gets username (SCRIPT)
  - mshta.exe (PID: 2896)
  - mshta.exe (PID: 532)
- Accesses environment variables (SCRIPT)
  - mshta.exe (PID: 2896)
  - mshta.exe (PID: 532)
SUSPICIOUS
- Accesses WMI object, sets custom ImpersonationLevel (SCRIPT)
  - mshta.exe (PID: 2896)
  - mshta.exe (PID: 532)
- Gets computer name (SCRIPT)
  - mshta.exe (PID: 2896)
  - mshta.exe (PID: 532)
- Accesses current user name via WMI (SCRIPT)
  - mshta.exe (PID: 2896)
  - mshta.exe (PID: 532)
- Accesses computer name via WMI (SCRIPT)
  - mshta.exe (PID: 2896)
  - mshta.exe (PID: 532)
- Creates FileSystem object to access computer's file system (SCRIPT)
  - mshta.exe (PID: 2896)
  - mshta.exe (PID: 532)
- Reads security settings of Internet Explorer
  - WinRAR.exe (PID: 6512)
- Executes WMI query (SCRIPT)
  - mshta.exe (PID: 2896)
  - mshta.exe (PID: 532)
- Enumerates operating system information (Win32_OperatingSystem) (SCRIPT)
  - mshta.exe (PID: 2896)
  - mshta.exe (PID: 532)
- Accesses language version of the operating system installed via WMI (SCRIPT)
  - mshta.exe (PID: 2896)
  - mshta.exe (PID: 532)
INFO
- Checks proxy server information
  - mshta.exe (PID: 2896)
  - mshta.exe (PID: 532)
- Reads Internet Explorer settings
  - mshta.exe (PID: 2896)
  - mshta.exe (PID: 532)
- Reads Microsoft Office registry keys
  - WinRAR.exe (PID: 6512)
- Manual execution by a user
  - mshta.exe (PID: 532)
  - mspaint.exe (PID: 2864)
  - mspaint.exe (PID: 5584)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.zip	\|	ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion:	20
ZipBitFlag:	-
ZipCompression:	None
ZipModifyDate:	2025:10:03 11:44:00
ZipCRC:	0x00000000
ZipCompressedSize:	-
ZipUncompressedSize:	-
ZipFileName:	/\s/dAs557/ RY9CSI6VRWZZ

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

174

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

532

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\admin\Desktop\𝙰𝚛𝚌𝚑𝚒𝚟𝚘795844.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

explorer.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Microsoft (R) HTML Application host

Exit code:

Version:

11.00.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\syswow64\mshta.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\advapi32.dll

2116

C:\WINDOWS\System32\slui.exe -Embedding

C:\Windows\System32\slui.exe

—

svchost.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows Activation Client

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll

2428

C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache

C:\Windows\System32\svchost.exe

services.exe

User:

NETWORK SERVICE

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

Host Process for Windows Services

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll

2864

"C:\WINDOWS\system32\mspaint.exe" "C:\Users\admin\Desktop\articlesauthors.png"

C:\Windows\System32\mspaint.exe

—

explorer.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Paint

Exit code:

Version:

10.0.19041.3758 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\mspaint.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\acgenral.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll

2896

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIa6512.44435\𝙰𝚛𝚌𝚑𝚒𝚟𝚘795844.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

WinRAR.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Microsoft (R) HTML Application host

Exit code:

Version:

11.00.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\syswow64\mshta.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\advapi32.dll

5584

"C:\WINDOWS\system32\mspaint.exe" "C:\Users\admin\Desktop\toldplay.png"

C:\Windows\System32\mspaint.exe

—

explorer.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Paint

Exit code:

Version:

10.0.19041.3758 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\mspaint.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\acgenral.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll

6512

"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\𝙰𝚛𝚌𝚑𝚒𝚟𝚘795_485.zip

C:\Program Files\WinRAR\WinRAR.exe

—

explorer.exe

User:

admin

Company:

Alexander Roshal

Integrity Level:

MEDIUM

Description:

WinRAR archiver

Exit code:

Version:

5.91.0

Modules

Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll

Add for printing

Total events

9 196

Read events

9 091

Write events

Delete events

Modification events


(PID) Process:	(6512) WinRAR.exe	Key:	HKEY_CLASSES_ROOT\Local Settings\MuiCache\3c\52C64B7E
Operation:	write	Name:	@C:\Windows\System32\mshta.exe,-6412
Value: HTML Application
(PID) Process:	(6512) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:	write	Name:	ShellExtBMP
Value:
(PID) Process:	(6512) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:	write	Name:	ShellExtIcon
Value:
(PID) Process:	(6512) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:	write	Name:	3
Value: C:\Users\admin\Desktop\preferences.zip
(PID) Process:	(6512) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:	write	Name:	2
Value: C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:	(6512) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:	write	Name:	1
Value: C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:	(6512) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:	write	Name:	0
Value: C:\Users\admin\AppData\Local\Temp\𝙰𝚛𝚌𝚑𝚒𝚟𝚘795_485.zip
(PID) Process:	(6512) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	name
Value: 120
(PID) Process:	(6512) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	size
Value: 80
(PID) Process:	(6512) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	type
Value: 120

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
2896	mshta.exe	C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\83D863F495E7D991917B3ABB3E1EB382_552A1FD08486B486377D3C2208603584		binary
		MD5:D42FE64ACC33CF08CF1E8F276D2D3C9A	SHA256:83B5DA8BAD9FB442D70D1D9357430460F79B96192A14E90C3C3FADCE71FF7889
2896	mshta.exe	C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517		binary
		MD5:150FDF9AF5D120559380AAC8B275EF23	SHA256:88F0BE5DD898B3B41DB11A9AF439AC0F7D9553E17DB43FC4AA42CECA55AF8230
6512	WinRAR.exe	C:\Users\admin\AppData\Local\Temp\Rar$DIa6512.44435\𝙰𝚛𝚌𝚑𝚒𝚟𝚘795844.hta		html
		MD5:3C255B5A16C58F2008DBAE192CF877A2	SHA256:AD78E00EA786C4A12B99AC0D62E6070258C29A198445F5B3BBC941A2EA3E9602
2896	mshta.exe	C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517		binary
		MD5:6AB9279647E6795D3A6FDA750A0439A9	SHA256:87F175790FFB7613BC7802FC4369F39FFECD5819A36E8082493041E3AD9E4B69
2896	mshta.exe	C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751		binary
		MD5:7F924EAEA21BB91214FF7B4525F3BD29	SHA256:E718475014C8F51A8F2746FBE90A7BFF516B65BEF36EE6340A5FC746BC5DFC32
2896	mshta.exe	C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\83D863F495E7D991917B3ABB3E1EB382_552A1FD08486B486377D3C2208603584		binary
		MD5:82412789B6FD333307F34D2B3BF270E0	SHA256:0B10B13E5FA9C4B8F1BF9887D39D2516A7BE5A5C2A58FECCBB7D19EDC0141698
2896	mshta.exe	C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3F23679C268B8B3767EE301A5B644533		binary
		MD5:1B4FF19077F1152B74B6802AD8ABD5CE	SHA256:C8EB6B17E14E7E90C4FBCDDDD951D954233EA6F30CABF631ED224E7FA4716C35
2896	mshta.exe	C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3F23679C268B8B3767EE301A5B644533		binary
		MD5:C9E18571FA6E13A9A31FEA6FBFAF94E9	SHA256:9031961320A060C2FE5F5B6E87C51E6F0B70EA401DD3B365838589200CA12E06
2896	mshta.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\E4DJRUXW\jOczvEXFD1[1].js		text
		MD5:7299E2CAEBDBCB07315265974AB8145D	SHA256:FFD00623D3BD524CA289892AF18C42F6923D467FF8E836948C1A07361222681B
2896	mshta.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\E4DJRUXW\cid[1].htm		xml
		MD5:FAD43F869F10D29E3010B9CC4146A94A	SHA256:B366B6FB6D575089CAFD41B066CF4C19EF8EC9F2675EBD30CBE75C6D6EB9F637

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
1828	svchost.exe	GET	200	172.66.2.5:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	US	binary	471 b	whitelisted
2896	mshta.exe	GET	200	18.245.65.219:80	http://ocsp.r2m03.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQqHI%2BsdmapawQncL1rpCEZZ8gTSAQUVdkYX9IczAHhWLS%2Bq9lVQgHXLgICEASSLs8bivtMtQSolDXxm6c%3D	US	binary	471 b	whitelisted
2896	mshta.exe	GET	200	18.245.38.235:80	http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkzUBtJnwJkc3SmanzgxeYU%3D	US	binary	1.40 Kb	whitelisted
2896	mshta.exe	GET	200	104.18.21.213:80	http://r13.c.lencr.org/17.crl	unknown	binary	83.3 Kb	whitelisted
1828	svchost.exe	GET	200	172.66.2.5:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	US	binary	471 b	whitelisted
1388	backgroundTaskHost.exe	GET	200	172.66.2.5:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D	US	binary	313 b	whitelisted
6132	backgroundTaskHost.exe	GET	200	172.66.2.5:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	US	binary	471 b	whitelisted
5192	backgroundTaskHost.exe	GET	200	172.66.2.5:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	US	binary	471 b	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:137	—	—	—	whitelisted
6016	MoUsoCoreWorker.exe	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
6332	RUXIMICS.exe	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
5224	SearchApp.exe	92.123.104.32:443	www.bing.com	Akamai International B.V.	DE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
2896	mshta.exe	68.178.207.114:443	filesprocesomxs.cotilandiasolutions.com	GO-DADDY-COM-LLC	US	unknown
2896	mshta.exe	99.84.152.39:443	club-ui-static-files.cb.hotmart.com	AMAZON-02	US	whitelisted
2896	mshta.exe	18.245.38.235:80	ocsp.rootca1.amazontrust.com	—	US	whitelisted
2896	mshta.exe	18.245.65.219:80	ocsp.r2m03.amazontrust.com	—	US	whitelisted
2896	mshta.exe	104.18.21.213:80	r13.c.lencr.org	CLOUDFLARENET	—	whitelisted

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	40.127.240.158	whitelisted
google.com	142.250.181.238	whitelisted
www.bing.com	92.123.104.32 92.123.104.34 92.123.104.38 92.123.104.46 92.123.104.47 92.123.104.35 92.123.104.33 92.123.104.37 92.123.104.36	whitelisted
club-ui-static-files.cb.hotmart.com	99.84.152.39 99.84.152.30 99.84.152.14 99.84.152.107	unknown
filesprocesomxs.cotilandiasolutions.com	68.178.207.114	unknown
ocsp.rootca1.amazontrust.com	18.245.38.235	whitelisted
ocsp.r2m03.amazontrust.com	18.245.65.219	whitelisted
r13.c.lencr.org	104.18.21.213 104.18.20.213	unknown
194.149.167.72.host.secureserver.net	72.167.149.194	malicious
login.live.com	20.190.160.128 20.190.160.3 40.126.32.138 40.126.32.134 20.190.160.17 20.190.160.66 20.190.160.64 40.126.32.74	whitelisted

Threats

PID	Process	Class	Message
—	—	Unknown Traffic	ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
—	—	A Network Trojan was detected	ET MALWARE Likely Malicious Windows SCT Download MSXMLHTTP AX M2
—	—	Misc activity	ET HUNTING [TW] Likely Javascript-Obfuscator Usage Observed M3
—	—	Misc activity	SUSPICIOUS [ANY.RUN] JavaScript Obfuscation (ParseInt)
—	—	Misc activity	ET HUNTING [TW] Likely Javascript-Obfuscator Usage Observed M2
—	—	Misc activity	ET HUNTING [TW] Likely Javascript-Obfuscator Usage Observed M1
—	—	Misc activity	ET HUNTING [TW] Likely Javascript-Obfuscator Usage Observed M2
—	—	Misc activity	SUSPICIOUS [ANY.RUN] JavaScript Obfuscation (ParseInt)
—	—	Misc activity	ET HUNTING [TW] Likely Javascript-Obfuscator Usage Observed M1
—	—	A Network Trojan was detected	ET MALWARE Likely Malicious Windows SCT Download MSXMLHTTP AX M2

Add for printing

No debug info

General Info

𝙰𝚛𝚌𝚑𝚒𝚟𝚘795_485.zip

D43BFB4F8FA4EA921551A12BD4431C4A

DC7DD6A9D2192CEE0F4B913B61C82F1BCD22B145

89AA37A3D1090F64D30CD494C8FA3771E4E7AC6728C14D1698F38C36753B2A4F

96:4UhV8oZ7l+JaecSt5n4waSGSMxzfGBTV8qhGY2+IC:FOh9t1XGSCIWBBC

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Collects BIOS Properties (Win32_BIOS) (SCRIPT)

Checks whether a specified folder exists (SCRIPT)

Gets username (SCRIPT)

Accesses environment variables (SCRIPT)

SUSPICIOUS

Accesses WMI object, sets custom ImpersonationLevel (SCRIPT)

Gets computer name (SCRIPT)

Accesses current user name via WMI (SCRIPT)

Accesses computer name via WMI (SCRIPT)

Creates FileSystem object to access computer's file system (SCRIPT)

Reads security settings of Internet Explorer

Executes WMI query (SCRIPT)

Enumerates operating system information (Win32_OperatingSystem) (SCRIPT)

Accesses language version of the operating system installed via WMI (SCRIPT)

INFO

Checks proxy server information

Reads Internet Explorer settings

Reads Microsoft Office registry keys

Manual execution by a user

Malware configuration

Static information

TRiD

EXIF

ZIP

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings