File name:

21590684287.zip

Full analysis: https://app.any.run/tasks/181bbd63-70a8-4b09-a928-edc5d666f5b9
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: March 24, 2025, 18:52:48
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
stealer
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

B05AB76569CD9D169E273335CEB6ACD6

SHA1:

7D8AD6652F5360FA71588E417EAF7F1BDA6D99A4

SHA256:

8EEC4BB537EC21EC13F3547B7AEE72AA61AC6D369953587347DED3796ADBDC04

SSDEEP:

384:jDNTS5WkhcJwJyjFXNYy+fiK5/mUs/zac8upqx+PzgLUGdhZ80yxi:jpO5AwYYy+5w/2c8ucxjdT80yxi

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • a00aef230d4cae1f163a4b930a40748efaaf41f0ff8ee0b9da8309680f39cefc.exe (PID: 2544)

    • Actions looks like stealing of personal data

      • findstr.exe (PID: 3836)
      • winmgmt.exe (PID: 2724)
      • cmd.exe (PID: 2436)

    • Starts NET.EXE to view/add/change user profiles

      • net.exe (PID: 3648)
      • cmd.exe (PID: 2436)

    • Starts NET.EXE to view/change users localgroup

      • net.exe (PID: 3816)
      • cmd.exe (PID: 2436)

    • Starts NET.EXE to view/change shared resources

      • net.exe (PID: 3764)
      • cmd.exe (PID: 2436)

    • Starts NET.EXE for service management

      • net.exe (PID: 3384)
      • cmd.exe (PID: 2436)

    • Changes appearance of the Explorer extensions

      • winmgmt.exe (PID: 2724)

  • SUSPICIOUS

    • Creates file in the systems drive root

      • WinRAR.exe (PID: 2840)
      • a00aef230d4cae1f163a4b930a40748efaaf41f0ff8ee0b9da8309680f39cefc.exe (PID: 2544)
      • cmd.exe (PID: 2436)
      • ntvdm.exe (PID: 3280)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 2840)

    • Application launched itself

      • WinRAR.exe (PID: 2840)
      • cmd.exe (PID: 2436)

    • Executable content was dropped or overwritten

      • dllhost.exe (PID: 676)
      • a00aef230d4cae1f163a4b930a40748efaaf41f0ff8ee0b9da8309680f39cefc.exe (PID: 2544)

    • Starts itself from another location

      • a00aef230d4cae1f163a4b930a40748efaaf41f0ff8ee0b9da8309680f39cefc.exe (PID: 2544)

    • Executing commands from a ".bat" file

      • winmgmt.exe (PID: 2724)

    • Starts CMD.EXE for commands execution

      • winmgmt.exe (PID: 2724)
      • cmd.exe (PID: 2436)
      • NETSTAT.EXE (PID: 608)

    • Starts application with an unusual extension

      • cmd.exe (PID: 2436)

    • Get information on the list of running processes

      • cmd.exe (PID: 2436)

    • Uses SYSTEMINFO.EXE to read the environment

      • cmd.exe (PID: 2436)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 2436)

    • Uses ROUTE.EXE to obtain the routing table information

      • cmd.exe (PID: 2756)

    • Process uses NBTSTAT to discover network configuration

      • cmd.exe (PID: 2436)

    • Starts NET.EXE to map network drives

      • cmd.exe (PID: 2436)

    • Starts NET.EXE for network exploration

      • cmd.exe (PID: 2436)

    • Process uses ARP to discover network configuration

      • cmd.exe (PID: 2436)

    • Process uses IPCONFIG to discover network configuration

      • cmd.exe (PID: 2436)

    • The process executes VB scripts

      • cmd.exe (PID: 2436)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • cscript.exe (PID: 3692)

    • Gets the drive type (SCRIPT)

      • cscript.exe (PID: 3692)

    • Gets a collection of all available drive names (SCRIPT)

      • cscript.exe (PID: 3692)

  • INFO

    • Manual execution by a user

      • explorer.exe (PID: 1784)
      • a00aef230d4cae1f163a4b930a40748efaaf41f0ff8ee0b9da8309680f39cefc.exe (PID: 2544)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1824)

    • Creates files in the program directory

      • a00aef230d4cae1f163a4b930a40748efaaf41f0ff8ee0b9da8309680f39cefc.exe (PID: 2544)

    • Checks supported languages

      • a00aef230d4cae1f163a4b930a40748efaaf41f0ff8ee0b9da8309680f39cefc.exe (PID: 2544)
      • winmgmt.exe (PID: 2724)
      • chcp.com (PID: 3712)

    • Changes the display of characters in the console

      • cmd.exe (PID: 2436)

    • Reads the computer name

      • winmgmt.exe (PID: 2724)

    • Create files in a temporary directory

      • winmgmt.exe (PID: 2724)

    • Prints a route via ROUTE.EXE

      • ROUTE.EXE (PID: 3368)

    • Reads security settings of Internet Explorer

      • cscript.exe (PID: 3692)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0009
ZipCompression: Deflated
ZipModifyDate: 1980:00:00 00:00:00
ZipCRC: 0x4e79888d
ZipCompressedSize: 17243
ZipUncompressedSize: 90112
ZipFileName: a00aef230d4cae1f163a4b930a40748efaaf41f0ff8ee0b9da8309680f39cefc
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
99
Monitored processes
53
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs winrar.exe explorer.exe no specs Copy/Move/Rename/Delete/Link Object a00aef230d4cae1f163a4b930a40748efaaf41f0ff8ee0b9da8309680f39cefc.exe winmgmt.exe ntvdm.exe no specs cmd.exe findstr.exe chcp.com no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs tasklist.exe no specs systeminfo.exe no specs reg.exe no specs find.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs ipconfig.exe no specs netstat.exe no specs arp.exe no specs netstat.exe no specs cmd.exe no specs route.exe no specs nbtstat.exe no specs nbtstat.exe no specs net.exe no specs net1.exe no specs net.exe no specs net.exe no specs cmd.exe no specs net1.exe no specs net.exe no specs cmd.exe no specs find.exe no specs find.exe no specs cmd.exe no specs cmd.exe no specs find.exe no specs cmd.exe no specs find.exe no specs cmd.exe no specs find.exe no specs cmd.exe no specs find.exe no specs cscript.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
116find /i /v "domain" C:\Windows\System32\find.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (grep) Utility
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\find.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
120reg query HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Common\UserInfo C:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
348reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer" C:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
604C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\admin\AppData\Local\Temp\t.log "C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
608netstat -rC:\Windows\System32\NETSTAT.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Netstat Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netstat.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\iphlpapi.dll
676C:\Windows\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}C:\Windows\System32\dllhost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
904C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\admin\AppData\Local\Temp\t.log "C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1092find /i /v "completed successfully" C:\Windows\System32\find.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (grep) Utility
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\find.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1164reg query HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\Common\UserInfo C:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1584C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\admin\AppData\Local\Temp\s.log "C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
4 061
Read events
4 006
Write events
42
Delete events
13

Modification events

(PID) Process:(2840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2840) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(2840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(2840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\21590684287.zip
(PID) Process:(2840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
3
Suspicious files
3
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
1824WinRAR.exeC:\a00aef230d4cae1f163a4b930a40748efaaf41f0ff8ee0b9da8309680f39cefcexecutable
MD5:07A6E1B4545869F820D2D974FE975DF1
SHA256:A00AEF230D4CAE1F163A4B930A40748EFAAF41F0FF8EE0B9DA8309680F39CEFC
3280ntvdm.exeC:\Users\admin\AppData\Local\Temp\scsE3C3.tmptext
MD5:8CF6DDB5AA59B49F34B967CD46F013B6
SHA256:EE06792197C3E025B84860A72460EAF628C66637685F8C52C5A08A9CC35D376C
2724winmgmt.exeC:\Users\admin\AppData\Local\Temp\avp.exebinary
MD5:CDF76A843084FA2F9A953DB3F606B201
SHA256:ECCA1BD8B2DE16395531F12E5AFD5293DB6C9BC20F17694E03ACE9C6F5BEB8B1
2544a00aef230d4cae1f163a4b930a40748efaaf41f0ff8ee0b9da8309680f39cefc.exeC:\ProgramData\winmgmt.exeexecutable
MD5:07A6E1B4545869F820D2D974FE975DF1
SHA256:A00AEF230D4CAE1F163A4B930A40748EFAAF41F0FF8EE0B9DA8309680F39CEFC
2724winmgmt.exeC:\Users\admin\AppData\Local\Temp\L4SD\15F6949E.dbbinary
MD5:180228D9ED81A44AF89CE05C6E095A7A
SHA256:D971E8FD5E6FAD13912FCB2078E889EB3DFBA5B48C41971E92A55D5FDF5E6533
3280ntvdm.exeC:\Users\admin\AppData\Local\Temp\scsE3F3.tmptext
MD5:4C361DEA398F7AEEF49953BDC0AB4A9B
SHA256:06D61C23E6CA59B9DDAD1796ECCC42C032CD8F6F424AF6CFEE5D085D36FF7DFD
2436cmd.exeC:\Users\admin\AppData\Local\Temp\INFO.TXTtext
MD5:3A3670FD7EB7835DA5CD149FB6F12EC8
SHA256:0FE5D81DE65F346B8C2B70E2A724020E513645C05AC9540929CF53F4DC49BC6F
2724winmgmt.exeC:\Users\admin\AppData\Local\Temp\ghi.battext
MD5:E0B2EC9E69574D9461038FF85711F08C
SHA256:0B5B66BBEE4526C3291966794024C9EAF548001F42E0CB09EA0FA22D6D702B29
2436cmd.exeC:\Users\admin\AppData\Local\Temp\driver.vbstext
MD5:000D0274EAE805098EBA5B8D58CA0540
SHA256:9D4C26B1F1E1E01D89858D655073C44FF1002933D0AB9C789C75D6A88D2A1621
2724winmgmt.exeC:\Users\admin\AppData\Local\Temp\ifdDC4C.tmpbinary
MD5:B291BC216BDB451B42C33900D6166BC9
SHA256:6B3D907E4EEC36520E7D1B6AB74EA6F00E230A0E127702FCFE01DF15F9D7D068
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
5
DNS requests
2
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.238
whitelisted
windowsupdate.microsoft.com
  • 20.109.209.108
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
21590684287.zip