File name:

Orbit.zip

Full analysis: https://app.any.run/tasks/61805f8f-5ffa-4362-bd51-c8261ffca03b
Verdict: Malicious activity
Analysis date: July 04, 2024, 17:52:26
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

18CDECDB7689F56B90E162BC986FED91

SHA1:

EA9DDFC153BBBE80A9DCA5BB79FC6735E87F3523

SHA256:

8B13D40FFB470F984837155E90B8DC17457A4C1153967FA9B0E9ED119DBFCFC0

SSDEEP:

98304:hJ+qlvJLMMAkbRm3OtCCiaWWndqivr5r56WehxL1ritfLlkdqjM4rU+eXz5hUiHO:OSqWv

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 5332)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 5332)

    • Drops a system driver (possible attempt to evade defenses)

      • WinRAR.exe (PID: 5332)

  • INFO

    • Dropped object may contain TOR URL's

      • WinRAR.exe (PID: 5332)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 5332)

    • Checks supported languages

      • Orbit Unknowncheats.exe (PID: 3020)
      • Orbit Unknowncheats.exe (PID: 6696)

    • Creates files or folders in the user directory

      • Orbit Unknowncheats.exe (PID: 3020)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2024:06:14 09:00:38
ZipCRC: 0x8fac9e58
ZipCompressedSize: 999374
ZipUncompressedSize: 1976320
ZipFileName: Orbit Unknowncheats.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
143
Monitored processes
7
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe orbit unknowncheats.exe no specs orbit unknowncheats.exe conhost.exe no specs orbit unknowncheats.exe no specs orbit unknowncheats.exe conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1520"C:\Users\admin\AppData\Local\Temp\Rar$EXa5332.37168\Orbit Unknowncheats.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa5332.37168\Orbit Unknowncheats.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa5332.37168\orbit unknowncheats.exe
c:\windows\system32\ntdll.dll
1660\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—Orbit Unknowncheats.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3020"C:\Users\admin\AppData\Local\Temp\Rar$EXa5332.37168\Orbit Unknowncheats.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa5332.37168\Orbit Unknowncheats.exe
WinRAR.exe
User:
admin
Integrity Level:
HIGH
Exit code:
3221225786
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa5332.37168\orbit unknowncheats.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\winsxs\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.3996_none_91a79472cc852ba0\gdiplus.dll
c:\windows\system32\gdi32full.dll
5332"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\Orbit.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
6648"C:\Users\admin\AppData\Local\Temp\Rar$EXa5332.39181\Orbit Unknowncheats.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa5332.39181\Orbit Unknowncheats.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa5332.39181\orbit unknowncheats.exe
c:\windows\system32\ntdll.dll
6696"C:\Users\admin\AppData\Local\Temp\Rar$EXa5332.39181\Orbit Unknowncheats.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa5332.39181\Orbit Unknowncheats.exe
WinRAR.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa5332.39181\orbit unknowncheats.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\winsxs\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.3996_none_91a79472cc852ba0\gdiplus.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32full.dll
6704\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—Orbit Unknowncheats.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
5 660
Read events
5 642
Write events
18
Delete events
0

Modification events

(PID) Process:(5332) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(5332) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(5332) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(5332) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Orbit.zip
(PID) Process:(5332) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(5332) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(5332) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(5332) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(5332) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(5332) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
10
Suspicious files
6
Text files
27
Unknown types
2

Dropped files

PID
Process
Filename
Type
5332WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa5332.37168\Orbit Unknowncheats.exeexecutable
MD5:83B7B051A986977E209078EF4E569DF3
SHA256:500695942BC3C61FA8478E9C48A6155F7FF87C9CB544AC61BAEB4CA913EC6774
5332WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa5332.37168\Orbit\Orbit Mapdata\cs_italy.txtcsv
MD5:0EDE6AC4D38EE87B3394E1FB7EA8E894
SHA256:E4DEB569A108ECFA0BDD4E19050A7609EC90A905451385C7BC5F5ECAB68E8623
5332WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa5332.37168\Orbit\Orbit Mapdata\ar_shoots.txtcsv
MD5:25E2E0A60D5E8464504AA5B77AE00D91
SHA256:BC351315447248C53B31DD58B4213825AC6C4DEECB7356EE98517D1E2E49A505
5332WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa5332.37168\Orbit\Orbit Mapdata\cs_office.txtcsv
MD5:F1EA212D0B3A237C089C73D542AA9A5C
SHA256:9C6F94A209C7255B16D6B1FB8F3BA58D20E6A6B947419EA7A4B7DE8E7E2ED33D
5332WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa5332.37168\Orbit\cs2-dumper.exeexecutable
MD5:5990B58F0F39446914BB6EFE78C6D87D
SHA256:EB794988A35CD238029B8523360D6232E9712DFAE449F84D84C629C98C84EC6F
5332WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa5332.37168\Orbit\Orbit Mapdata\de_ancient.txtcsv
MD5:27871442EC9923351B2FAE785B28F59A
SHA256:B465DC4B30782286EA72E366DCA81B0652437A042C729358EAD460D308A8AEBB
5332WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa5332.37168\Orbit\GrenadeHelper.txtcsv
MD5:C6B9CF1EDE0610B145A3010224710D9C
SHA256:45A60CEE6B2021961C1B19B10D04CDA7E1F055B4CB70CD2C2A3B03B273F5F80A
5332WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa5332.37168\Orbit\Orbit Mapdata\ar_baggage.txtcsv
MD5:3BF4DCF5608BFD9B36E1FEA67253A2B7
SHA256:9F0BE0E0F207AEC47E2F84489212F102EB7F3058C3412F4F0549BD22D4FF8CAC
5332WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa5332.37168\Orbit\SmallestPixel7-Regular.ttfttf
MD5:CD2242816D23DAD4250F5EA159C7675C
SHA256:0E71338A9AE45DF2EDE080567CFAB831627BAC9A83BE601521DDBACE4CBED11E
5332WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa5332.37168\Orbit\Orbit Mapdata\de_overpass.txtcsv
MD5:04C07EF25CF95E67F64F1A53B78DFF56
SHA256:87FA6262AF35C85A7A87807CAA561F1F467B72A59DD27705176DB68B4F7EC04E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
56
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2248
svchost.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
2248
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
4656
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
unknown
2456
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
6476
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
unknown
6476
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
unknown
3800
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
unknown
5932
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4032
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
2248
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
188
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4180
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2248
svchost.exe
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
2248
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
unknown
4180
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4656
SearchApp.exe
92.123.104.51:443
www.bing.com
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.53.40.176
  • 23.53.40.178
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
www.bing.com
  • 92.123.104.51
  • 92.123.104.40
  • 92.123.104.31
  • 92.123.104.32
  • 92.123.104.30
  • 92.123.104.33
  • 92.123.104.47
  • 92.123.104.46
  • 92.123.104.43
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.160.14
  • 40.126.32.68
  • 40.126.32.136
  • 40.126.32.74
  • 40.126.32.134
  • 40.126.32.72
  • 20.190.160.20
  • 20.190.160.22
whitelisted
go.microsoft.com
  • 23.213.166.81
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Orbit.zip