File name:

shroom-boom.zip.zip

Full analysis: https://app.any.run/tasks/c9314ac1-c41c-47b3-8ce9-78e5b8f9be70
Verdict: Malicious activity
Analysis date: May 15, 2025, 12:59:38
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
autoit
Indicators:
MIME: application/zip
File info: Zip archive data, at least v5.1 to extract, compression method=AES Encrypted
MD5:

EABF4A99EFA55377D8BD3D274F79DD12

SHA1:

AC79B3649D0D4B01C23C1EB5AFCCD9C04D7A4992

SHA256:

90C5B09C663DF2AABC361E0EE6CBC75EA618D4519BEB27040FB3CF0255FE9910

SSDEEP:

49152:YA+dvUrsBwndD1hNKS9KkUSwCMRzkTwP9UKfF37hJfI6Sr1lk+x62gfsFoK7icTk:bEvUrfndDH4MMBH9Bd3YVrs6t7FucTkb

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Gets %appdata% folder path (SCRIPT)

      • wscript.exe (PID: 8152)
      • wscript.exe (PID: 2108)

    • Accesses environment variables (SCRIPT)

      • wscript.exe (PID: 8152)
      • wscript.exe (PID: 2108)

    • Reads the value of a key from the registry (SCRIPT)

      • wscript.exe (PID: 7264)

    • Modifies registry startup key (SCRIPT)

      • wscript.exe (PID: 7264)
      • wscript.exe (PID: 8180)

    • Creates a new registry key or changes the value of an existing one (SCRIPT)

      • wscript.exe (PID: 7264)
      • wscript.exe (PID: 8180)

    • Copies file to a new location (SCRIPT)

      • wscript.exe (PID: 2108)
      • wscript.exe (PID: 7264)
      • wscript.exe (PID: 8180)

    • Starts NET.EXE for service management

      • cmd.exe (PID: 7740)
      • net.exe (PID: 8080)

    • Changes the autorun value in the registry

      • reg.exe (PID: 8420)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 7212)

  • SUSPICIOUS

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • wscript.exe (PID: 8152)
      • wscript.exe (PID: 7264)
      • wscript.exe (PID: 2108)
      • wscript.exe (PID: 8180)

    • The process executes VB scripts

      • 31529c7f5c2f38a57227b307bb77e2dc86d283bd8110cf0b8a38285f75b7f872.exe (PID: 8036)
      • cmd.exe (PID: 4980)
      • cmd.exe (PID: 8904)
      • cmd.exe (PID: 8944)
      • cmd.exe (PID: 5048)
      • cmd.exe (PID: 8568)
      • cmd.exe (PID: 8512)
      • cmd.exe (PID: 8296)
      • cmd.exe (PID: 8644)
      • cmd.exe (PID: 8712)
      • cmd.exe (PID: 7208)

    • Reads security settings of Internet Explorer

      • 31529c7f5c2f38a57227b307bb77e2dc86d283bd8110cf0b8a38285f75b7f872.exe (PID: 8036)
      • WinRAR.exe (PID: 7824)
      • WinRAR.exe (PID: 7268)
      • ORNYAE.EXE (PID: 5548)

    • The process executes JS scripts

      • 31529c7f5c2f38a57227b307bb77e2dc86d283bd8110cf0b8a38285f75b7f872.exe (PID: 8036)

    • Application launched itself

      • WinRAR.exe (PID: 7268)
      • cmd.exe (PID: 736)
      • cmd.exe (PID: 7588)

    • Checks whether a specific file exists (SCRIPT)

      • wscript.exe (PID: 8152)
      • wscript.exe (PID: 2108)

    • Gets full path of the running script (SCRIPT)

      • wscript.exe (PID: 8180)
      • wscript.exe (PID: 7264)
      • wscript.exe (PID: 2108)

    • Uses ATTRIB.EXE to modify file attributes

      • cmd.exe (PID: 7212)
      • cmd.exe (PID: 2692)
      • cmd.exe (PID: 5640)
      • cmd.exe (PID: 1052)
      • cmd.exe (PID: 4980)
      • cmd.exe (PID: 7588)
      • cmd.exe (PID: 8904)
      • cmd.exe (PID: 8944)
      • cmd.exe (PID: 5048)
      • cmd.exe (PID: 8568)
      • cmd.exe (PID: 8512)
      • cmd.exe (PID: 8296)
      • cmd.exe (PID: 8644)
      • cmd.exe (PID: 8712)
      • cmd.exe (PID: 8436)
      • cmd.exe (PID: 8612)
      • cmd.exe (PID: 4932)
      • cmd.exe (PID: 7208)

    • Likely accesses (executes) a file from the Public directory

      • cmd.exe (PID: 5640)
      • attrib.exe (PID: 7816)
      • cmd.exe (PID: 728)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 7264)
      • wscript.exe (PID: 8152)
      • wscript.exe (PID: 8180)
      • wscript.exe (PID: 2108)
      • wscript.exe (PID: 8536)
      • wscript.exe (PID: 9176)
      • wscript.exe (PID: 9120)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 7264)
      • mshta.exe (PID: 5256)
      • 31529c7f5c2f38a57227b307bb77e2dc86d283bd8110cf0b8a38285f75b7f872.exe (PID: 8036)
      • wscript.exe (PID: 8180)
      • wscript.exe (PID: 2108)
      • wscript.exe (PID: 8152)
      • mshta.exe (PID: 7816)
      • cmd.exe (PID: 736)
      • wscript.exe (PID: 8536)
      • cmd.exe (PID: 7588)
      • wscript.exe (PID: 9176)
      • wscript.exe (PID: 9120)
      • wscript.exe (PID: 9172)
      • wscript.exe (PID: 7376)
      • wscript.exe (PID: 8952)
      • wscript.exe (PID: 6392)

    • Executable content was dropped or overwritten

      • 31529c7f5c2f38a57227b307bb77e2dc86d283bd8110cf0b8a38285f75b7f872.exe (PID: 8036)
      • ORNYAE.EXE (PID: 5548)

    • Gets a collection of all available drive names (SCRIPT)

      • wscript.exe (PID: 2108)

    • Kill processes via PowerShell

      • powershell.exe (PID: 7672)
      • powershell.exe (PID: 7676)
      • powershell.exe (PID: 7768)
      • powershell.exe (PID: 5384)
      • powershell.exe (PID: 7752)

    • Starts POWERSHELL.EXE for commands execution

      • wscript.exe (PID: 8180)

    • Write to the desktop.ini file (may be used to cloak folders)

      • ORNYAE.EXE (PID: 5548)

    • Gets the drive type (SCRIPT)

      • wscript.exe (PID: 2108)

    • Accesses ComputerSystem(Win32_ComputerSystem) via WMI (SCRIPT)

      • wscript.exe (PID: 2108)

    • Executes WMI query (SCRIPT)

      • wscript.exe (PID: 2108)

    • Accesses computer name via WMI (SCRIPT)

      • wscript.exe (PID: 2108)

    • Accesses current user name via WMI (SCRIPT)

      • wscript.exe (PID: 8180)

    • Uses WMI to retrieve WMI-managed resources (SCRIPT)

      • wscript.exe (PID: 2108)

    • Executing commands from a ".bat" file

      • 31529c7f5c2f38a57227b307bb77e2dc86d283bd8110cf0b8a38285f75b7f872.exe (PID: 8036)
      • wscript.exe (PID: 8536)
      • wscript.exe (PID: 9176)
      • wscript.exe (PID: 9120)
      • wscript.exe (PID: 9172)
      • wscript.exe (PID: 8952)
      • wscript.exe (PID: 7376)
      • wscript.exe (PID: 6392)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 5984)
      • cmd.exe (PID: 6300)
      • cmd.exe (PID: 8332)
      • cmd.exe (PID: 1052)
      • cmd.exe (PID: 7588)

    • Uses WMIC.EXE to create a new process

      • cmd.exe (PID: 8244)

    • Uses NETSH.EXE to change the status of the firewall

      • cmd.exe (PID: 7740)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 1052)

    • Uses WMIC.EXE to obtain local storage devices information

      • cmd.exe (PID: 9048)

    • The process executes via Task Scheduler

      • wscript.exe (PID: 9992)

    • There is functionality for taking screenshot (YARA)

      • MONOXIDEX86.HARMLESS.EXE (PID: 5552)
      • ORNYAE.EXE (PID: 5548)

  • INFO

    • Process checks computer location settings

      • 31529c7f5c2f38a57227b307bb77e2dc86d283bd8110cf0b8a38285f75b7f872.exe (PID: 8036)

    • Checks supported languages

      • 31529c7f5c2f38a57227b307bb77e2dc86d283bd8110cf0b8a38285f75b7f872.exe (PID: 8036)
      • ORNYAE.EXE (PID: 5548)
      • MONOXIDEX86.HARMLESS.EXE (PID: 5552)

    • Create files in a temporary directory

      • 31529c7f5c2f38a57227b307bb77e2dc86d283bd8110cf0b8a38285f75b7f872.exe (PID: 8036)

    • Reads the computer name

      • 31529c7f5c2f38a57227b307bb77e2dc86d283bd8110cf0b8a38285f75b7f872.exe (PID: 8036)
      • ORNYAE.EXE (PID: 5548)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 7824)

    • Reads Internet Explorer settings

      • mshta.exe (PID: 5256)
      • mshta.exe (PID: 5680)
      • mshta.exe (PID: 7084)
      • mshta.exe (PID: 7816)

    • The sample compiled with english language support

      • 31529c7f5c2f38a57227b307bb77e2dc86d283bd8110cf0b8a38285f75b7f872.exe (PID: 8036)
      • ORNYAE.EXE (PID: 5548)

    • Reads the machine GUID from the registry

      • ORNYAE.EXE (PID: 5548)

    • Reads mouse settings

      • ORNYAE.EXE (PID: 5548)

    • Checks proxy server information

      • mshta.exe (PID: 5680)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 8552)
      • WMIC.exe (PID: 9068)

    • Creates files or folders in the user directory

      • ORNYAE.EXE (PID: 5548)

    • The process uses AutoIt

      • ORNYAE.EXE (PID: 5548)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 51
ZipBitFlag: 0x0009
ZipCompression: Unknown (99)
ZipModifyDate: 2025:05:15 12:59:04
ZipCRC: 0x45c1b020
ZipCompressedSize: 1356061
ZipUncompressedSize: 1355618
ZipFileName: shroom-boom.zip
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
525
Monitored processes
396
Malicious processes
22
Suspicious processes
4

Behavior graph

Click at the process to see the details
start winrar.exe no specs sppextcomobj.exe no specs slui.exe winrar.exe 31529c7f5c2f38a57227b307bb77e2dc86d283bd8110cf0b8a38285f75b7f872.exe wscript.exe no specs wscript.exe no specs mshta.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs wscript.exe no specs attrib.exe no specs mshta.exe no specs cmd.exe no specs conhost.exe no specs wscript.exe no specs monoxidex86.harmless.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs ornyae.exe cmd.exe no specs powershell.exe no specs conhost.exe no specs conhost.exe no specs powershell.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs attrib.exe no specs powershell.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs powershell.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs attrib.exe no specs cmd.exe no specs powershell.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs mshta.exe no specs conhost.exe no specs attrib.exe no specs mshta.exe no specs cmd.exe no specs conhost.exe no specs net.exe no specs reg.exe no specs cipher.exe no specs net1.exe no specs cmd.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs attrib.exe no specs attrib.exe no specs reg.exe attrib.exe no specs attrib.exe no specs reg.exe no specs reg.exe no specs attrib.exe no specs reg.exe no specs wscript.exe no specs wmic.exe no specs rundll32.exe no specs attrib.exe no specs schtasks.exe no specs attrib.exe no specs taskkill.exe no specs attrib.exe no specs netsh.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs attrib.exe no specs cmd.exe no specs wmic.exe no specs attrib.exe no specs attrib.exe no specs wscript.exe no specs wscript.exe no specs taskkill.exe no specs mshta.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs wscript.exe no specs wscript.exe no specs wscript.exe no specs attrib.exe no specs cmd.exe no specs conhost.exe no specs attrib.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs attrib.exe no specs wscript.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs wscript.exe no specs conhost.exe no specs wscript.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs attrib.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs attrib.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs attrib.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs mshta.exe no specs cmd.exe no specs conhost.exe no specs mshta.exe no specs cmd.exe no specs conhost.exe no specs mshta.exe no specs cmd.exe no specs conhost.exe no specs mshta.exe no specs cmd.exe no specs conhost.exe no specs mshta.exe no specs cmd.exe no specs conhost.exe no specs mshta.exe no specs cmd.exe no specs conhost.exe no specs mshta.exe no specs slui.exe cmd.exe no specs conhost.exe no specs mshta.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs mshta.exe no specs cmd.exe no specs conhost.exe no specs mshta.exe no specs cmd.exe no specs conhost.exe no specs mshta.exe no specs cmd.exe no specs conhost.exe no specs mshta.exe no specs cmd.exe no specs conhost.exe no specs mshta.exe no specs cmd.exe no specs conhost.exe no specs mshta.exe no specs cmd.exe no specs conhost.exe no specs mshta.exe no specs cmd.exe no specs conhost.exe no specs mshta.exe no specs cmd.exe no specs conhost.exe no specs mshta.exe no specs cmd.exe no specs conhost.exe no specs mshta.exe no specs cmd.exe no specs conhost.exe no specs mshta.exe no specs cmd.exe no specs conhost.exe no specs mshta.exe no specs cmd.exe no specs conhost.exe no specs mshta.exe no specs cmd.exe no specs conhost.exe no specs mshta.exe no specs cmd.exe no specs conhost.exe no specs mshta.exe no specs cmd.exe no specs conhost.exe no specs mshta.exe no specs cmd.exe no specs conhost.exe no specs mshta.exe no specs cmd.exe no specs conhost.exe no specs mshta.exe no specs cmd.exe no specs conhost.exe no specs mshta.exe no specs cmd.exe no specs conhost.exe no specs mshta.exe no specs cmd.exe no specs conhost.exe no specs mshta.exe no specs cmd.exe no specs conhost.exe no specs mshta.exe no specs cmd.exe no specs conhost.exe no specs mshta.exe no specs cmd.exe no specs conhost.exe no specs mshta.exe no specs cmd.exe no specs conhost.exe no specs mshta.exe no specs cmd.exe no specs conhost.exe no specs mshta.exe no specs cmd.exe no specs conhost.exe no specs mshta.exe no specs cmd.exe no specs conhost.exe no specs mshta.exe no specs cmd.exe no specs conhost.exe no specs mshta.exe no specs cmd.exe no specs conhost.exe no specs mshta.exe no specs cmd.exe no specs conhost.exe no specs mshta.exe no specs cmd.exe no specs conhost.exe no specs mshta.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
680\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
684"C:\Windows\System32\cmd.exe" /c copy C:\Users\admin\AppData\Roaming\sysproc.js C:\Users\admin\AppData\Roaming\winupdate.htaC:\Windows\SysWOW64\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
728"C:\Windows\System32\cmd.exe" /c copy C:\Users\admin\AppData\Roaming\sys32.hta \\DESKTOP-JGLLJLD\C$\Users\Public\sys32.htaC:\Windows\SysWOW64\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
736C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\S409-L4.BAT" "C:\Windows\SysWOW64\cmd.exe—31529c7f5c2f38a57227b307bb77e2dc86d283bd8110cf0b8a38285f75b7f872.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
896wscript "C:\Users\admin\AppData\Roaming\Microsoft\Windows\winproc.vbs"C:\Windows\SysWOW64\wscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Version:
5.812.10240.16384
Modules
Images
c:\windows\syswow64\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
976\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1012"C:\Windows\System32\cmd.exe" /c copy C:\Users\admin\AppData\Roaming\sysproc.js C:\Users\admin\AppData\Roaming\winupdate.htaC:\Windows\SysWOW64\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
1040\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1052C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\WIN32.BAT" "C:\Windows\SysWOW64\cmd.exe—31529c7f5c2f38a57227b307bb77e2dc86d283bd8110cf0b8a38285f75b7f872.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
1132C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\S409-M1.BAT" "C:\Windows\SysWOW64\cmd.exe—31529c7f5c2f38a57227b307bb77e2dc86d283bd8110cf0b8a38285f75b7f872.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
Total events
61 275
Read events
61 052
Write events
223
Delete events
0

Modification events

(PID) Process:(7268) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(7268) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(7268) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(7268) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\shroom-boom.zip.zip
(PID) Process:(7268) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7268) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(7268) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(7268) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(7268) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(7824) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\chromium_ext.zip
Executable files
4
Suspicious files
83
Text files
45
Unknown types
1

Dropped files

PID
Process
Filename
Type
7268WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIb7268.30125\shroom-boom.zipcompressed
MD5:FF581A73473581966C98F8E4B27FDB21
SHA256:3B00A039128A9FC41A2269EA943283E7254735AA98A4E218D2EBA42C25F2696D
803631529c7f5c2f38a57227b307bb77e2dc86d283bd8110cf0b8a38285f75b7f872.exeC:\Users\admin\AppData\Local\Temp\FINDME.HTAhtml
MD5:1C5F01BC9E5017F6817B36FBF51FD4A2
SHA256:06F073BC04C7FF783CD3ACFDAF6D7C835155FEE970EC8A98584B517D260E52E6
803631529c7f5c2f38a57227b307bb77e2dc86d283bd8110cf0b8a38285f75b7f872.exeC:\Users\admin\AppData\Local\Temp\INSTALLE10R.VBStext
MD5:7CC3B626518CF48DBFC1AFCC85D95F21
SHA256:5D3DB0D7702BC6B8CA3F8A644DD354203544E03E50E2745DD4540E95654C6296
7824WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb7824.31180\31529c7f5c2f38a57227b307bb77e2dc86d283bd8110cf0b8a38285f75b7f872.exeexecutable
MD5:86DC4A2BA727DF70A0C289846852CEA3
SHA256:31529C7F5C2F38A57227B307BB77E2DC86D283BD8110CF0B8A38285F75B7F872
803631529c7f5c2f38a57227b307bb77e2dc86d283bd8110cf0b8a38285f75b7f872.exeC:\Users\admin\AppData\Local\Temp\EXECUTION.JStext
MD5:D0EF78B5BE1F57ED5D18E57DD6BD6D31
SHA256:FD819D9467ABA2D315BE6051EBE84B2D6E72571F1174CA7C49763303E065A1FA
803631529c7f5c2f38a57227b307bb77e2dc86d283bd8110cf0b8a38285f75b7f872.exeC:\Users\admin\AppData\Local\Temp\FINDM10E.VBStext
MD5:8EF7859CB44262053840E18037C862BD
SHA256:D4E84178FA198E903C717FAC251159A053BEDB307685E29C047621A22813BD9F
803631529c7f5c2f38a57227b307bb77e2dc86d283bd8110cf0b8a38285f75b7f872.exeC:\Users\admin\AppData\Local\Temp\HV23UR2.BATtext
MD5:56D31575090E9C578213B2A5297B537E
SHA256:15938AAA257893055D2D5EA2B738FAF5E56640477108CE861471C3B3BA5770C0
803631529c7f5c2f38a57227b307bb77e2dc86d283bd8110cf0b8a38285f75b7f872.exeC:\Users\admin\AppData\Local\Temp\ORNYAE.EXEexecutable
MD5:7AF7333465E62F585BD425DFC4D063AB
SHA256:E6B33D16B98A88870625593BE8F20EC67CFE6227E8AD12229650B3F3BD6EE476
803631529c7f5c2f38a57227b307bb77e2dc86d283bd8110cf0b8a38285f75b7f872.exeC:\Users\admin\AppData\Local\Temp\MONOXIDEX86.HARMLESS.EXEexecutable
MD5:BD65D387482DEF1FE00B50406F731763
SHA256:1AB7375550516D7445C47FD9B551ED864F227401A14FF3F1FF0D70CACA3BD997
7212cmd.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\winhidden.vbstext
MD5:47D65D6905A58790BEC5DABCF90300A0
SHA256:20C0CA7197D010F994B859E304B0D317A54232A247F84D367D100E300CED6BCF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
21
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.167:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7996
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7996
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.167:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.3:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7996
SIHClient.exe
172.202.163.200:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
GB
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
whitelisted
google.com
  • 142.250.186.142
whitelisted
crl.microsoft.com
  • 23.48.23.167
  • 23.48.23.166
  • 23.48.23.159
  • 23.48.23.193
  • 23.48.23.180
  • 23.48.23.145
  • 23.48.23.194
  • 23.48.23.176
  • 23.48.23.173
whitelisted
www.microsoft.com
  • 23.35.229.160
  • 23.219.150.101
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 20.190.160.3
  • 20.190.160.67
  • 20.190.160.22
  • 20.190.160.5
  • 40.126.32.68
  • 40.126.32.133
  • 20.190.160.131
  • 40.126.32.76
  • 40.126.31.131
  • 40.126.31.0
  • 20.190.159.73
  • 20.190.159.2
  • 40.126.31.1
  • 40.126.31.71
  • 40.126.31.128
  • 40.126.31.130
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
shroom-boom.zip.zip