File name:

test41.zip

Full analysis: https://app.any.run/tasks/9ae292da-c568-4f44-82e0-a100d002bd71
Verdict: Malicious activity
Analysis date: July 24, 2024, 07:04:40
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=store
MD5:

8B4255B919E38CF1487EFC9DB01760D9

SHA1:

6367B5D73B3F312B3289561961A5110D9BD8C6E3

SHA256:

8C5E51F3B24F897D5CEA26D529C4FD40F706A1373D7756AA1B9CB529F68C2E7F

SSDEEP:

98304:Ggzxtqff/GNOQcYWMp9VVnfpsI6yW5bEDwQKoqAnDdELs0qHlmZiHEK6Miv60B5W:n/irtVHs

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 1264)
      • procexp.exe (PID: 6180)
      • procexp64.exe (PID: 188)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 5648)

    • Application launched itself

      • cmd.exe (PID: 5648)
      • AutoIt3.exe (PID: 7136)

    • Executes application which crashes

      • AutoIt3.exe (PID: 6284)

    • The process checks if it is being run in the virtual environment

      • procexp.exe (PID: 6180)
      • procexp64.exe (PID: 188)

    • Executable content was dropped or overwritten

      • procexp.exe (PID: 6180)
      • procexp64.exe (PID: 188)

    • Drops a system driver (possible attempt to evade defenses)

      • procexp64.exe (PID: 188)

    • Reads security settings of Internet Explorer

      • procexp64.exe (PID: 188)

    • Detected use of alternative data streams (AltDS)

      • procexp64.exe (PID: 188)

    • Read startup parameters

      • procexp64.exe (PID: 188)

    • Checks Windows Trust Settings

      • procexp64.exe (PID: 188)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1264)

    • Manual execution by a user

      • cmd.exe (PID: 5648)
      • procexp.exe (PID: 6180)

    • Checks supported languages

      • AutoIt3.exe (PID: 7136)
      • AutoIt3.exe (PID: 6284)
      • procexp.exe (PID: 6180)
      • procexp64.exe (PID: 188)

    • Reads mouse settings

      • AutoIt3.exe (PID: 7136)
      • AutoIt3.exe (PID: 6284)

    • Reads the machine GUID from the registry

      • AutoIt3.exe (PID: 7136)
      • procexp64.exe (PID: 188)

    • Reads the computer name

      • procexp.exe (PID: 6180)
      • procexp64.exe (PID: 188)

    • Create files in a temporary directory

      • procexp.exe (PID: 6180)
      • procexp64.exe (PID: 188)

    • Checks proxy server information

      • WerFault.exe (PID: 3996)
      • procexp64.exe (PID: 188)
      • slui.exe (PID: 4880)

    • Reads the software policy settings

      • WerFault.exe (PID: 3996)
      • procexp64.exe (PID: 188)
      • slui.exe (PID: 4880)

    • Reads product name

      • procexp64.exe (PID: 188)

    • Reads Environment values

      • procexp64.exe (PID: 188)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 3996)
      • procexp64.exe (PID: 188)

    • Reads Microsoft Office registry keys

      • procexp64.exe (PID: 188)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2024:07:24 07:49:48
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: test4/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
150
Monitored processes
10
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe slui.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs autoit3.exe no specs autoit3.exe werfault.exe procexp.exe procexp64.exe

Process information

PID
CMD
Path
Indicators
Parent process
188"C:\Users\admin\Desktop\procexp.exe" C:\Users\admin\AppData\Local\Temp\procexp64.exe
procexp.exe
User:
admin
Company:
Sysinternals - www.sysinternals.com
Integrity Level:
MEDIUM
Description:
Sysinternals Process Explorer
Version:
16.43
Modules
Images
c:\users\admin\appdata\local\temp\procexp64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\setupapi.dll
1264"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\test41.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
3996C:\WINDOWS\SysWOW64\WerFault.exe -u -p 6284 -s 632C:\Windows\SysWOW64\WerFault.exe
AutoIt3.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
4880C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5528\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5648C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\Desktop\temp.bat" "C:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
6180"C:\Users\admin\Desktop\procexp.exe" C:\Users\admin\Desktop\procexp.exe
explorer.exe
User:
admin
Company:
Sysinternals - www.sysinternals.com
Integrity Level:
MEDIUM
Description:
Sysinternals Process Explorer
Version:
16.43
Modules
Images
c:\users\admin\desktop\procexp.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
6284"C:\Users\admin\Desktop\AutoIt3.exe"C:\Users\admin\Desktop\AutoIt3.exe
AutoIt3.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script
Exit code:
3221225477
Version:
3, 3, 16, 1
Modules
Images
c:\users\admin\desktop\autoit3.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\psapi.dll
c:\windows\syswow64\user32.dll
7036cmd.exe /c AutoIt3.exe AutoIt3.a3xC:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
7136AutoIt3.exe AutoIt3.a3xC:\Users\admin\Desktop\AutoIt3.exe—cmd.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script
Exit code:
0
Version:
3, 3, 16, 1
Modules
Images
c:\users\admin\desktop\autoit3.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\psapi.dll
c:\windows\syswow64\user32.dll
Total events
61 423
Read events
61 410
Write events
13
Delete events
0

Modification events

(PID) Process:(1264) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1264) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1264) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(1264) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\test41.zip
(PID) Process:(1264) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1264) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1264) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1264) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1264) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\3c\52C64B7E
Operation:writeName:@C:\WINDOWS\System32\acppage.dll,-6002
Value:
Windows Batch File
(PID) Process:(1264) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:writeName:0
Value:
C:\Users\admin\Desktop
Executable files
5
Suspicious files
57
Text files
3
Unknown types
6

Dropped files

PID
Process
Filename
Type
3996WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_AutoIt3.exe_367ab2494e7ebdd990c1283e68eb75327a23a_b05016a0_e34d3c89-a2bb-4ed1-95ca-453e8d786b00\Report.wer —
MD5:—
SHA256:—
1264WinRAR.exeC:\Users\admin\Desktop\procexp64.exeexecutable
MD5:29DA4E6B4B4325651FD4E1A87D333B22
SHA256:77358157EFBF4572C2D7F17A1A264990843307F802D20BAD4FB2442245D65F0B
3996WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERBE5B.tmp.WERInternalMetadata.xmlxml
MD5:1A240A61A338355915953E73CB77646B
SHA256:4586436CC78A1D6F4E387A2C5A07CC55DDAF3ED6B850E435BFD7136C1DE570CC
3996WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERBE8B.tmp.xmlxml
MD5:58B7A94F58CE3EBEF31F978A0DDAD610
SHA256:D03D41D87000D1876A93333F8149040113CC9B3493EFBD6D5D4A9F3714B435E1
1264WinRAR.exeC:\Users\admin\Desktop\AutoIt3.a3xbinary
MD5:4A1F2CBBA55A6FA758C0F0B1D043812E
SHA256:22EA25EC7A5F8047DB3494648205198F9E3C4EDF1710E784AA82BB47F7A3251D
1264WinRAR.exeC:\Users\admin\Desktop\AutoIt3.exeexecutable
MD5:0ADB9B817F1DF7807576C2D7068DD931
SHA256:98E4F904F7DE1644E519D09371B8AFCBBF40FF3BD56D76CE4DF48479A4AB884B
188procexp64.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0B8A20E1F3F4D73D52A19929F922C892binary
MD5:0840F3C261E695105CD15C84EA85BEED
SHA256:F60632399A87485A7417DDF8B407DA66794C37347B3AA9E995EC389ECD091947
188procexp64.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A583E2A51BFBDC1E492A57B7C8325850binary
MD5:26B00A90BD91228C8309D636AC9968D2
SHA256:8DE0ABE24515E861073BA70C8717D77CC111876058E49270474AF575702537BF
188procexp64.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A583E2A51BFBDC1E492A57B7C8325850der
MD5:3582D5284FE8B34513E337C07AE9B8F8
SHA256:686C5D8F56C9BC20D444B6F3A32D78C249B94F10080F1B595CC8F856A62B65A6
188procexp64.exeC:\Users\admin\AppData\Local\Temp\PROCEXP152.SYSexecutable
MD5:97E3A44EC4AE58C8CC38EEFC613E950E
SHA256:440883CD9D6A76DB5E53517D0EC7FE13D5A50D2F6A7F91ECFC863BC3490E4F5C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
38
TCP/UDP connections
61
DNS requests
30
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6612
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
188
procexp64.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
188
procexp64.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl%20
unknown
—
—
whitelisted
188
procexp64.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl
unknown
—
—
whitelisted
188
procexp64.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl
unknown
—
—
whitelisted
188
procexp64.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_2010-07-06.crl
unknown
—
—
whitelisted
188
procexp64.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl
unknown
—
—
whitelisted
188
procexp64.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
188
procexp64.exe
GET
200
192.229.221.95:80
http://crl.verisign.com/pca3.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6012
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4212
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
3076
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4204
svchost.exe
4.208.221.206:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
3952
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1392
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5368
SearchApp.exe
104.126.37.152:443
www.bing.com
Akamai International B.V.
DE
unknown
5272
svchost.exe
20.190.160.20:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
google.com
  • 216.58.212.142
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
www.bing.com
  • 104.126.37.152
  • 104.126.37.145
  • 104.126.37.128
  • 104.126.37.177
  • 104.126.37.146
  • 104.126.37.139
  • 104.126.37.185
  • 104.126.37.130
  • 104.126.37.153
whitelisted
login.live.com
  • 20.190.160.20
  • 20.190.160.17
  • 40.126.32.136
  • 40.126.32.72
  • 40.126.32.138
  • 20.190.160.14
  • 40.126.32.140
  • 40.126.32.134
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
arc.msn.com
  • 20.199.58.43
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
fd.api.iris.microsoft.com
  • 20.103.156.88
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
test41.zip