| File name: | d35e48bfb4fbfa07d0f58cba44465922f683a84d8235601e3259d4405fefccb5.zip |
| Full analysis: | https://app.any.run/tasks/a22c9978-eeef-4e13-b3d1-17e806dcae17 |
| Verdict: | Malicious activity |
| Threats: | Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links. |
| Analysis date: | September 14, 2025, 19:13:18 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v5.1 to extract, compression method=AES Encrypted |
| MD5: | DB9E76631F2EA73C9A838BA0E1131737 |
| SHA1: | A4BE36F575554D889B30EE23949E3D788260FF88 |
| SHA256: | 9358151755DD466B50DA68554DED67286DD8C2D7866E955822CACF32402A4083 |
| SSDEEP: | 24576:CwwJlNNGpzWs489pFNbtHzHq8jLmLrQHxge3ULDWDvL7cgpIAEs9pMneq7ZweBxt:CwwJlNNGpzWs489pbbtHzHq8jLmLrQHc |
MALICIOUS
Generic archive extractor
- WinRAR.exe (PID: 4072)
Gets %windir% folder path (SCRIPT)
- wscript.exe (PID: 3028)
- wscript.exe (PID: 4156)
Creates a new registry key or changes the value of an existing one (SCRIPT)
- wscript.exe (PID: 3028)
Creates a new scheduled task (SCRIPT)
- wscript.exe (PID: 3028)
Accesses environment variables (SCRIPT)
- wscript.exe (PID: 3028)
- wscript.exe (PID: 4156)
Access Task Scheduler's settings (SCRIPT)
- wscript.exe (PID: 3028)
Gets %appdata% folder path (SCRIPT)
- wscript.exe (PID: 3028)
Gets context to execute command-line operations (SCRIPT)
- wscript.exe (PID: 3028)
Reads the value of a key from the registry (SCRIPT)
- wscript.exe (PID: 3028)
- wscript.exe (PID: 4156)
Run PowerShell with an invisible window
- powershell.exe (PID: 6164)
Bypass execution policy to execute commands
- powershell.exe (PID: 6164)
Changes powershell execution policy (Bypass)
- wscript.exe (PID: 3028)
REMCOS has been detected
- AddInProcess32.exe (PID: 6676)
REMCOS mutex has been found
- AddInProcess32.exe (PID: 6676)
Uses sleep, probably for evasion detection (SCRIPT)
- wscript.exe (PID: 4156)
SUSPICIOUS
Reads security settings of Internet Explorer
- WinRAR.exe (PID: 4072)
Checks whether a specific file exists (SCRIPT)
- wscript.exe (PID: 3028)
Creates FileSystem object to access computer's file system (SCRIPT)
- wscript.exe (PID: 3028)
Accesses Scheduled Task settings (SCRIPT)
- wscript.exe (PID: 3028)
Gets context to manipulate triggers of a scheduled task (SCRIPT)
- wscript.exe (PID: 3028)
Gets scheduled task context (SCRIPT)
- wscript.exe (PID: 3028)
Accesses object representing scheduled task trigger (SCRIPT)
- wscript.exe (PID: 3028)
Writes binary data to a Stream object (SCRIPT)
- wscript.exe (PID: 3028)
Gets a folder of registered tasks (SCRIPT)
- wscript.exe (PID: 3028)
Gets context to manipulate scheduled tasks (SCRIPT)
- wscript.exe (PID: 3028)
Accesses antivirus product name via WMI (SCRIPT)
- wscript.exe (PID: 3028)
Runs shell command (SCRIPT)
- wscript.exe (PID: 3028)
Starts POWERSHELL.EXE for commands execution
- wscript.exe (PID: 3028)
Probably obfuscated PowerShell command line is found
- wscript.exe (PID: 3028)
Uses base64 encoding (POWERSHELL)
- powershell.exe (PID: 6164)
Connects to unusual port
- AddInProcess32.exe (PID: 6676)
Executes WMI query (SCRIPT)
- wscript.exe (PID: 4156)
The process executes via Task Scheduler
- wscript.exe (PID: 4156)
Uses WMI to retrieve WMI-managed resources (SCRIPT)
- wscript.exe (PID: 4156)
INFO
Drops encrypted VBS script (Microsoft Script Encoder)
- WinRAR.exe (PID: 4072)
Reads Microsoft Office registry keys
- WinRAR.exe (PID: 4072)
Gets data length (POWERSHELL)
- powershell.exe (PID: 6164)
Checks supported languages
- AddInProcess32.exe (PID: 6676)
Reads the computer name
- AddInProcess32.exe (PID: 6676)
Checks current location (POWERSHELL)
- powershell.exe (PID: 6164)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .zip | | | ZIP compressed archive (100) |
|---|
EXIF
ZIP
| ZipRequiredVersion: | 51 |
|---|---|
| ZipBitFlag: | 0x0003 |
| ZipCompression: | Unknown (99) |
| ZipModifyDate: | 2025:09:14 18:38:26 |
| ZipCRC: | 0x0ab0b6d5 |
| ZipCompressedSize: | 680728 |
| ZipUncompressedSize: | 2354662 |
| ZipFileName: | d35e48bfb4fbfa07d0f58cba44465922f683a84d8235601e3259d4405fefccb5.vbe |
Total processes
141
Monitored processes
7
Malicious processes
5
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1508 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2112 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3028 | "C:\WINDOWS\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIb4072.34517\d35e48bfb4fbfa07d0f58cba44465922f683a84d8235601e3259d4405fefccb5.vbe" | C:\Windows\System32\wscript.exe | — | WinRAR.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.812.10240.16384 Modules
| |||||||||||||||
| 4072 | "C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\d35e48bfb4fbfa07d0f58cba44465922f683a84d8235601e3259d4405fefccb5.zip | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.91.0 Modules
| |||||||||||||||
| 4156 | C:\WINDOWS\System32\WScript.exe "C:\Users\admin\AppData\Roaming\NkNtKGwYKPHIMNw.vbs" | C:\Windows\System32\wscript.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Version: 5.812.10240.16384 Modules
| |||||||||||||||
| 6164 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -noexit -Command [AppDomain]::CurrentDomain.Load([Convert]::FromBase64String((-join (Get-ItemProperty -LiteralPath 'HKCU:\Software\NkNtKGwYKPHIMNw' -Name 's').s | ForEach-Object {$_[-1..-($_.Length)]}))); [x.x]::x('NkNtKGwYKPHIMNw') | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | wscript.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6676 | "C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe | powershell.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: AddInProcess.exe Version: 4.8.9037.0 built by: NET481REL1 Modules
| |||||||||||||||
Total events
8 366
Read events
8 292
Write events
74
Delete events
0
Modification events
| (PID) Process: | (4072) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 3 |
Value: C:\Users\admin\Desktop\preferences.zip | |||
| (PID) Process: | (4072) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\chromium_ext.zip | |||
| (PID) Process: | (4072) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\omni_23_10_2024_.zip | |||
| (PID) Process: | (4072) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\Desktop\d35e48bfb4fbfa07d0f58cba44465922f683a84d8235601e3259d4405fefccb5.zip | |||
| (PID) Process: | (4072) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (4072) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (4072) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (4072) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (4072) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface |
| Operation: | write | Name: | ShowPassword |
Value: 1 | |||
| (PID) Process: | (4072) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vbe\OpenWithProgids |
| Operation: | write | Name: | VBEFile |
Value: | |||
Executable files
0
Suspicious files
1
Text files
3
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 4072 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DIb4072.34517\d35e48bfb4fbfa07d0f58cba44465922f683a84d8235601e3259d4405fefccb5.vbe | binary | |
MD5:— | SHA256:— | |||
| 3028 | wscript.exe | C:\Users\admin\AppData\Roaming\NkNtKGwYKPHIMNw.vbs | text | |
MD5:— | SHA256:— | |||
| 6164 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_5spkmyhq.4wi.psm1 | text | |
MD5:— | SHA256:— | |||
| 6164 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_adotx4yy.bnz.ps1 | text | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
24
DNS requests
17
Threats
1
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1268 | svchost.exe | GET | 200 | 23.210.215.64:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | TW | binary | 825 b | whitelisted |
1268 | svchost.exe | GET | 200 | 23.40.125.183:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | SE | binary | 814 b | whitelisted |
4520 | svchost.exe | GET | 200 | 2.22.98.7:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | GB | binary | 471 b | whitelisted |
5348 | SIHClient.exe | GET | 200 | 23.40.125.183:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | SE | binary | 419 b | whitelisted |
5348 | SIHClient.exe | GET | 200 | 23.40.125.183:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | SE | binary | 407 b | whitelisted |
5348 | SIHClient.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl | NL | binary | 813 b | whitelisted |
5348 | SIHClient.exe | GET | 200 | 23.55.110.193:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl | DE | binary | 824 b | whitelisted |
5348 | SIHClient.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl | NL | binary | 814 b | whitelisted |
5348 | SIHClient.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.2.crl | NL | binary | 400 b | whitelisted |
5348 | SIHClient.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl | NL | binary | 401 b | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
5944 | MoUsoCoreWorker.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
1268 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4196 | RUXIMICS.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
1268 | svchost.exe | 23.210.215.64:80 | crl.microsoft.com | Akamai International B.V. | TW | whitelisted |
1268 | svchost.exe | 23.40.125.183:80 | www.microsoft.com | Telia Company AB | SE | whitelisted |
4520 | svchost.exe | 40.126.32.68:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4520 | svchost.exe | 2.22.98.7:80 | ocsp.digicert.com | AKAMAI-AS | GB | whitelisted |
6676 | AddInProcess32.exe | 216.9.225.168:13647 | — | ATT-INTERNET4 | US | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
self.events.data.microsoft.com |
| whitelisted |
activation-v2.sls.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | Unknown Traffic | ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW) |