URL:

http://www.angusj.com/resourcehacker/reshacker_setup.exe

Full analysis: https://app.any.run/tasks/c07401a6-4409-48c2-898c-5a521714f564
Verdict: Malicious activity
Analysis date: September 24, 2019, 12:46:50
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

1D14F84234B99174EACA744D6C9AE4BB

SHA1:

88498A482CDDBC46F20179CD1C3A53A393CF2793

SHA256:

8B3F6D1BE812522337D6556BD40CB0CD7895A6599C295DD9D4EFF011806F2D1B

SSDEEP:

3:N1KJS4BzGTd4PIKW0u4A:Cc4VGTd4AKxu4A

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • reshacker_setup.exe (PID: 664)
      • reshacker_setup.exe (PID: 3804)
      • ResourceHacker.exe (PID: 1632)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • opera.exe (PID: 3104)
      • reshacker_setup.exe (PID: 664)
      • reshacker_setup.exe (PID: 3804)
      • reshacker_setup.tmp (PID: 2240)

    • Creates files in the program directory

      • ResourceHacker.exe (PID: 1632)

  • INFO

    • Manual execution by user

      • reshacker_setup.exe (PID: 664)
      • ResourceHacker.exe (PID: 1632)

    • Application was dropped or rewritten from another process

      • reshacker_setup.tmp (PID: 2456)
      • reshacker_setup.tmp (PID: 2240)

    • Creates files in the user directory

      • opera.exe (PID: 3104)

    • Creates files in the program directory

      • reshacker_setup.tmp (PID: 2240)

    • Creates a software uninstall entry

      • reshacker_setup.tmp (PID: 2240)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
7
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start opera.exe reshacker_setup.exe reshacker_setup.tmp no specs reshacker_setup.exe reshacker_setup.tmp notepad.exe no specs resourcehacker.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
664"C:\Users\admin\Desktop\reshacker_setup.exe" C:\Users\admin\Desktop\reshacker_setup.exe
explorer.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Resource Hacker Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\desktop\reshacker_setup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
1632"C:\Program Files\Resource Hacker\ResourceHacker.exe" C:\Program Files\Resource Hacker\ResourceHacker.exe—explorer.exe
User:
admin
Company:
Angus Johnson
Integrity Level:
MEDIUM
Description:
Resource viewer, decompiler & recompiler
Exit code:
0
Version:
5.1.7.343
Modules
Images
c:\program files\resource hacker\resourcehacker.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2240"C:\Users\admin\AppData\Local\Temp\is-JEUMB.tmp\reshacker_setup.tmp" /SL5="$10012A,2649214,147968,C:\Users\admin\Desktop\reshacker_setup.exe" /SPAWNWND=$50148 /NOTIFYWND=$40190 C:\Users\admin\AppData\Local\Temp\is-JEUMB.tmp\reshacker_setup.tmp
reshacker_setup.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.52.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-jeumb.tmp\reshacker_setup.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
2456"C:\Users\admin\AppData\Local\Temp\is-U89OU.tmp\reshacker_setup.tmp" /SL5="$40190,2649214,147968,C:\Users\admin\Desktop\reshacker_setup.exe" C:\Users\admin\AppData\Local\Temp\is-U89OU.tmp\reshacker_setup.tmp—reshacker_setup.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.52.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-u89ou.tmp\reshacker_setup.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
3104"C:\Program Files\Opera\opera.exe" "http://www.angusj.com/resourcehacker/reshacker_setup.exe"C:\Program Files\Opera\opera.exe
explorer.exe
User:
admin
Company:
Opera Software
Integrity Level:
MEDIUM
Description:
Opera Internet Browser
Exit code:
0
Version:
1748
Modules
Images
c:\program files\opera\opera.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\psapi.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\rpcrt4.dll
3584"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\Resource Hacker\ReadMe.txtC:\Windows\system32\NOTEPAD.EXE—reshacker_setup.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3804"C:\Users\admin\Desktop\reshacker_setup.exe" /SPAWNWND=$50148 /NOTIFYWND=$40190 C:\Users\admin\Desktop\reshacker_setup.exe
reshacker_setup.tmp
User:
admin
Company:
Integrity Level:
HIGH
Description:
Resource Hacker Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\desktop\reshacker_setup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
Total events
954
Read events
807
Write events
139
Delete events
8

Modification events

(PID) Process:(3104) opera.exeKey:HKEY_CURRENT_USER\Software\Opera Software
Operation:writeName:Last CommandLine v2
Value:
C:\Program Files\Opera\opera.exe "http://www.angusj.com/resourcehacker/reshacker_setup.exe"
(PID) Process:(3104) opera.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\72\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3104) opera.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:NodeSlots
Value:
020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202
(PID) Process:(3104) opera.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:MRUListEx
Value:
02000000070000000100000009000000080000000000000006000000030000000500000004000000FFFFFFFF
(PID) Process:(3104) opera.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\50\ComDlg
Operation:writeName:TV_FolderType
Value:
{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}
(PID) Process:(3104) opera.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\50\ComDlg
Operation:writeName:TV_TopViewID
Value:
{82BA0782-5B7A-4569-B5D7-EC83085F08CC}
(PID) Process:(3104) opera.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\50\ComDlg
Operation:writeName:TV_TopViewVersion
Value:
0
(PID) Process:(3104) opera.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}
Operation:writeName:Mode
Value:
4
(PID) Process:(3104) opera.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}
Operation:writeName:LogicalViewMode
Value:
1
(PID) Process:(3104) opera.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}
Operation:writeName:FFlags
Value:
1092616257
Executable files
8
Suspicious files
22
Text files
30
Unknown types
3

Dropped files

PID
Process
Filename
Type
3104opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\sessions\opr13F7.tmp —
MD5:—
SHA256:—
3104opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\opr13F8.tmp —
MD5:—
SHA256:—
3104opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\opr1447.tmp —
MD5:—
SHA256:—
3104opera.exeC:\Users\admin\AppData\Local\Opera\Opera\cache\sesn\opr00001.tmp —
MD5:—
SHA256:—
3104opera.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5PIUJQPNWMCO880A6KSC.temp —
MD5:—
SHA256:—
2240reshacker_setup.tmpC:\Program Files\Resource Hacker\is-I196O.tmp —
MD5:—
SHA256:—
2240reshacker_setup.tmpC:\Program Files\Resource Hacker\is-EVVVV.tmp —
MD5:—
SHA256:—
3104opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\tasks.xmlxml
MD5:—
SHA256:—
2240reshacker_setup.tmpC:\Program Files\Resource Hacker\is-865V9.tmp —
MD5:—
SHA256:—
3104opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\operaprefs.initext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
8
DNS requests
4
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3104
opera.exe
GET
200
93.184.220.29:80
http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl
US
der
528 b
whitelisted
3104
opera.exe
GET
400
185.26.182.111:80
http://sitecheck2.opera.com/?host=www.angusj.com&hdn=1R2gkuF14jB%2Bjle1rCmd%2BQ==
unknown
html
150 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3104
opera.exe
185.26.182.94:443
certs.opera.com
Opera Software AS
—
whitelisted
3104
opera.exe
150.101.136.194:80
www.angusj.com
Internode Pty Ltd
AU
suspicious
3104
opera.exe
185.26.182.94:80
certs.opera.com
Opera Software AS
—
whitelisted
3104
opera.exe
185.26.182.93:443
certs.opera.com
Opera Software AS
—
whitelisted
3104
opera.exe
93.184.220.29:80
crl4.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3104
opera.exe
185.26.182.111:80
sitecheck2.opera.com
Opera Software AS
—
whitelisted

DNS requests

Domain
IP
Reputation
www.angusj.com
  • 150.101.136.194
suspicious
certs.opera.com
  • 185.26.182.94
  • 185.26.182.93
whitelisted
sitecheck2.opera.com
  • 185.26.182.94
  • 185.26.182.111
  • 185.26.182.112
  • 185.26.182.93
whitelisted
crl4.digicert.com
  • 93.184.220.29
whitelisted

Threats

PID
Process
Class
Message
3104
opera.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://www.angusj.com/resourcehacker/reshacker_setup.exe