File name:

test41.zip

Full analysis: https://app.any.run/tasks/9ae292da-c568-4f44-82e0-a100d002bd71
Verdict: Malicious activity
Analysis date: July 24, 2024, 07:04:40
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=store
MD5:

8B4255B919E38CF1487EFC9DB01760D9

SHA1:

6367B5D73B3F312B3289561961A5110D9BD8C6E3

SHA256:

8C5E51F3B24F897D5CEA26D529C4FD40F706A1373D7756AA1B9CB529F68C2E7F

SSDEEP:

98304:Ggzxtqff/GNOQcYWMp9VVnfpsI6yW5bEDwQKoqAnDdELs0qHlmZiHEK6Miv60B5W:n/irtVHs

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 1264)
      • procexp.exe (PID: 6180)
      • procexp64.exe (PID: 188)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 5648)

    • Application launched itself

      • cmd.exe (PID: 5648)
      • AutoIt3.exe (PID: 7136)

    • Executes application which crashes

      • AutoIt3.exe (PID: 6284)

    • The process checks if it is being run in the virtual environment

      • procexp.exe (PID: 6180)
      • procexp64.exe (PID: 188)

    • Executable content was dropped or overwritten

      • procexp.exe (PID: 6180)
      • procexp64.exe (PID: 188)

    • Reads security settings of Internet Explorer

      • procexp64.exe (PID: 188)

    • Drops a system driver (possible attempt to evade defenses)

      • procexp64.exe (PID: 188)

    • Detected use of alternative data streams (AltDS)

      • procexp64.exe (PID: 188)

    • Read startup parameters

      • procexp64.exe (PID: 188)

    • Checks Windows Trust Settings

      • procexp64.exe (PID: 188)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1264)

    • Checks supported languages

      • AutoIt3.exe (PID: 7136)
      • AutoIt3.exe (PID: 6284)
      • procexp.exe (PID: 6180)
      • procexp64.exe (PID: 188)

    • Manual execution by a user

      • cmd.exe (PID: 5648)
      • procexp.exe (PID: 6180)

    • Reads mouse settings

      • AutoIt3.exe (PID: 7136)
      • AutoIt3.exe (PID: 6284)

    • Reads the machine GUID from the registry

      • AutoIt3.exe (PID: 7136)
      • procexp64.exe (PID: 188)

    • Reads the computer name

      • procexp.exe (PID: 6180)
      • procexp64.exe (PID: 188)

    • Checks proxy server information

      • WerFault.exe (PID: 3996)
      • procexp64.exe (PID: 188)
      • slui.exe (PID: 4880)

    • Create files in a temporary directory

      • procexp.exe (PID: 6180)
      • procexp64.exe (PID: 188)

    • Reads the software policy settings

      • WerFault.exe (PID: 3996)
      • procexp64.exe (PID: 188)
      • slui.exe (PID: 4880)

    • Reads product name

      • procexp64.exe (PID: 188)

    • Reads Environment values

      • procexp64.exe (PID: 188)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 3996)
      • procexp64.exe (PID: 188)

    • Reads Microsoft Office registry keys

      • procexp64.exe (PID: 188)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2024:07:24 07:49:48
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: test4/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
150
Monitored processes
10
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe slui.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs autoit3.exe no specs autoit3.exe werfault.exe procexp.exe procexp64.exe

Process information

PID
CMD
Path
Indicators
Parent process
188"C:\Users\admin\Desktop\procexp.exe" C:\Users\admin\AppData\Local\Temp\procexp64.exe
procexp.exe
User:
admin
Company:
Sysinternals - www.sysinternals.com
Integrity Level:
MEDIUM
Description:
Sysinternals Process Explorer
Version:
16.43
Modules
Images
c:\users\admin\appdata\local\temp\procexp64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\setupapi.dll
1264"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\test41.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
3996C:\WINDOWS\SysWOW64\WerFault.exe -u -p 6284 -s 632C:\Windows\SysWOW64\WerFault.exe
AutoIt3.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
4880C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5528\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5648C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\Desktop\temp.bat" "C:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
6180"C:\Users\admin\Desktop\procexp.exe" C:\Users\admin\Desktop\procexp.exe
explorer.exe
User:
admin
Company:
Sysinternals - www.sysinternals.com
Integrity Level:
MEDIUM
Description:
Sysinternals Process Explorer
Version:
16.43
Modules
Images
c:\users\admin\desktop\procexp.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
6284"C:\Users\admin\Desktop\AutoIt3.exe"C:\Users\admin\Desktop\AutoIt3.exe
AutoIt3.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script
Exit code:
3221225477
Version:
3, 3, 16, 1
Modules
Images
c:\users\admin\desktop\autoit3.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\psapi.dll
c:\windows\syswow64\user32.dll
7036cmd.exe /c AutoIt3.exe AutoIt3.a3xC:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
7136AutoIt3.exe AutoIt3.a3xC:\Users\admin\Desktop\AutoIt3.exe—cmd.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script
Exit code:
0
Version:
3, 3, 16, 1
Modules
Images
c:\users\admin\desktop\autoit3.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\psapi.dll
c:\windows\syswow64\user32.dll
Total events
61 423
Read events
61 410
Write events
13
Delete events
0

Modification events

(PID) Process:(1264) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1264) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1264) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(1264) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\test41.zip
(PID) Process:(1264) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1264) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1264) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1264) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1264) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\3c\52C64B7E
Operation:writeName:@C:\WINDOWS\System32\acppage.dll,-6002
Value:
Windows Batch File
(PID) Process:(1264) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:writeName:0
Value:
C:\Users\admin\Desktop
Executable files
5
Suspicious files
57
Text files
3
Unknown types
6

Dropped files

PID
Process
Filename
Type
3996WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_AutoIt3.exe_367ab2494e7ebdd990c1283e68eb75327a23a_b05016a0_e34d3c89-a2bb-4ed1-95ca-453e8d786b00\Report.wer —
MD5:—
SHA256:—
1264WinRAR.exeC:\Users\admin\Desktop\temp.battext
MD5:F7CC88B1234579D51627A82F6074A328
SHA256:B8D62C3A25475C460E5CB29960214054DB402B3BBEE2B2189007F88D8476C0C2
1264WinRAR.exeC:\Users\admin\Desktop\procexp64.exeexecutable
MD5:29DA4E6B4B4325651FD4E1A87D333B22
SHA256:77358157EFBF4572C2D7F17A1A264990843307F802D20BAD4FB2442245D65F0B
3996WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\37C951188967C8EB88D99893D9D191FEbinary
MD5:FB64A9EBEDF48D3895381D5B7D80743D
SHA256:EA21D495930AD76F267A33A0F593DBF0C7EA75E457FCAE49A29DAAD8BD920F42
188procexp64.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0B8A20E1F3F4D73D52A19929F922C892binary
MD5:7BB169F886CA269971E9E67774A7231F
SHA256:D4DAC80F046FEBBAC5E2C0E510F781AF59CEAFDF56F503DA3DEF7004A3D81BD7
3996WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\21253908F3CB05D51B1C2DA8B681A785binary
MD5:82C30E45BF5F93A5DB1D5E47F913053B
SHA256:2C6BBFF9207065E8800C4AF0CB2748818ABB3CFFC0D6D518FE17F76A232F8967
188procexp64.exeC:\Users\admin\AppData\Local\Temp\PROCEXP152.SYSexecutable
MD5:97E3A44EC4AE58C8CC38EEFC613E950E
SHA256:440883CD9D6A76DB5E53517D0EC7FE13D5A50D2F6A7F91ECFC863BC3490E4F5C
6180procexp.exeC:\Users\admin\AppData\Local\Temp\procexp64.exeexecutable
MD5:29DA4E6B4B4325651FD4E1A87D333B22
SHA256:77358157EFBF4572C2D7F17A1A264990843307F802D20BAD4FB2442245D65F0B
188procexp64.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A583E2A51BFBDC1E492A57B7C8325850binary
MD5:26B00A90BD91228C8309D636AC9968D2
SHA256:8DE0ABE24515E861073BA70C8717D77CC111876058E49270474AF575702537BF
3996WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\AutoIt3.exe.6284.dmpdmp
MD5:1AA0C24BB8A871B048CECF59EAD53245
SHA256:9E66B43333402AEEF27F23C7B28BB4C3230D240A68B5D2A1D2F85DD25DFEC64C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
38
TCP/UDP connections
61
DNS requests
30
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6612
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
188
procexp64.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
188
procexp64.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl%20
unknown
—
—
whitelisted
188
procexp64.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl
unknown
—
—
whitelisted
188
procexp64.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl
unknown
—
—
whitelisted
188
procexp64.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_2010-07-06.crl
unknown
—
—
whitelisted
188
procexp64.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
188
procexp64.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl
unknown
—
—
whitelisted
188
procexp64.exe
GET
200
192.229.221.95:80
http://crl.verisign.com/pca3.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6012
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4212
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
3076
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4204
svchost.exe
4.208.221.206:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
3952
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1392
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5368
SearchApp.exe
104.126.37.152:443
www.bing.com
Akamai International B.V.
DE
unknown
5272
svchost.exe
20.190.160.20:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
google.com
  • 216.58.212.142
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
www.bing.com
  • 104.126.37.152
  • 104.126.37.145
  • 104.126.37.128
  • 104.126.37.177
  • 104.126.37.146
  • 104.126.37.139
  • 104.126.37.185
  • 104.126.37.130
  • 104.126.37.153
whitelisted
login.live.com
  • 20.190.160.20
  • 20.190.160.17
  • 40.126.32.136
  • 40.126.32.72
  • 40.126.32.138
  • 20.190.160.14
  • 40.126.32.140
  • 40.126.32.134
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
arc.msn.com
  • 20.199.58.43
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
fd.api.iris.microsoft.com
  • 20.103.156.88
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
test41.zip