File name:

TestMem5 v0.12 (best configs)English.rar

Full analysis: https://app.any.run/tasks/58944203-3fbb-4e60-9844-d926f39a876e
Verdict: Malicious activity
Analysis date: July 17, 2024, 22:16:45
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v4, os: Win32
MD5:

1BA594D49A7C89DE3DEC4C0E0D1776B4

SHA1:

AC5BBED017430312857E8BB21A6E720DEF144A65

SHA256:

9A6978497804647B70D3AFCEE58CFA9119611A2066A572B79757785D57861202

SSDEEP:

768:hkpeTKiK9wHFiiDlNGgOWqULpefUsppAqd6IlLpQSffYSVRNILrMxmT:CpC7XNxqUtu+IbQSLV8x

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 1192)

  • SUSPICIOUS

    • Application launched itself

      • TM5.exe (PID: 6160)
      • TM5.exe (PID: 6588)
      • TM5.exe (PID: 6732)

  • INFO

    • Manual execution by a user

      • TM5.exe (PID: 6732)
      • TM5.exe (PID: 6588)
      • TM5.exe (PID: 6160)

    • Checks supported languages

      • TM5.exe (PID: 6732)
      • TM5.exe (PID: 3164)
      • TM5.exe (PID: 6588)
      • TM5.exe (PID: 900)
      • TM5.exe (PID: 4628)
      • TM5.exe (PID: 6708)
      • TM5.exe (PID: 6724)
      • TM5.exe (PID: 6716)
      • TM5.exe (PID: 6160)
      • TM5.exe (PID: 6824)
      • TM5.exe (PID: 6804)
      • TM5.exe (PID: 6812)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1192)

    • Reads the computer name

      • TM5.exe (PID: 6732)
      • TM5.exe (PID: 6588)
      • TM5.exe (PID: 6160)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v-4.x) (58.3)
.rar | RAR compressed archive (gen) (41.6)

EXIF

ZIP

CompressedSize: 843
UncompressedSize: 3443
OperatingSystem: Win32
ModifyDate: 2021:01:06 14:53:40
PackingMethod: Normal
ArchivedFileName: TestMem5 v0.12 (best configs)\bin\1usmus_v3.cfg
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
149
Monitored processes
14
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe rundll32.exe no specs tm5.exe tm5.exe no specs tm5.exe no specs tm5.exe no specs tm5.exe no specs tm5.exe no specs tm5.exe no specs tm5.exe no specs tm5.exe tm5.exe no specs tm5.exe no specs tm5.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
900 C:\Users\admin\Desktop\TestMem5 v0.12 (best configs)\TM5.exe—TM5.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
2
Modules
Images
c:\users\admin\desktop\testmem5 v0.12 (best configs)\tm5.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
1192"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\TestMem5 v0.12 (best configs)English.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
3164 C:\Users\admin\Desktop\TestMem5 v0.12 (best configs)\TM5.exe—TM5.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
2
Modules
Images
c:\users\admin\desktop\testmem5 v0.12 (best configs)\tm5.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
4628 C:\Users\admin\Desktop\TestMem5 v0.12 (best configs)\TM5.exe—TM5.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
2
Modules
Images
c:\users\admin\desktop\testmem5 v0.12 (best configs)\tm5.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
6160"C:\Users\admin\Desktop\TestMem5 v0.12 (best configs)\TM5.exe" C:\Users\admin\Desktop\TestMem5 v0.12 (best configs)\TM5.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\testmem5 v0.12 (best configs)\tm5.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
6436C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
6588"C:\Users\admin\Desktop\TestMem5 v0.12 (best configs)\TM5.exe" C:\Users\admin\Desktop\TestMem5 v0.12 (best configs)\TM5.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\testmem5 v0.12 (best configs)\tm5.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6708 C:\Users\admin\Desktop\TestMem5 v0.12 (best configs)\TM5.exe—TM5.exe
User:
admin
Integrity Level:
HIGH
Exit code:
2
Modules
Images
c:\users\admin\desktop\testmem5 v0.12 (best configs)\tm5.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6716 C:\Users\admin\Desktop\TestMem5 v0.12 (best configs)\TM5.exe—TM5.exe
User:
admin
Integrity Level:
HIGH
Exit code:
2
Modules
Images
c:\users\admin\desktop\testmem5 v0.12 (best configs)\tm5.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6724 C:\Users\admin\Desktop\TestMem5 v0.12 (best configs)\TM5.exe—TM5.exe
User:
admin
Integrity Level:
HIGH
Exit code:
2
Modules
Images
c:\users\admin\desktop\testmem5 v0.12 (best configs)\tm5.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
6 572
Read events
6 553
Write events
19
Delete events
0

Modification events

(PID) Process:(1192) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1192) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1192) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(1192) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\TestMem5 v0.12 (best configs)English.rar
(PID) Process:(1192) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1192) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1192) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1192) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1192) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFB800000052000000780400003B020000
(PID) Process:(1192) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\General
Operation:writeName:LastFolder
Value:
C:\Users\admin\AppData\Local\Temp
Executable files
2
Suspicious files
0
Text files
12
Unknown types
1

Dropped files

PID
Process
Filename
Type
1192WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1192.42388\TestMem5 v0.12 (best configs)\bin\[email protected]text
MD5:8BF40E3A762F93D84D9BB22C6E386205
SHA256:35353B73E4281D377441D24FABA2A7B5E31429009142125C0301B834B299EEC8
1192WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1192.42388\TestMem5 v0.12 (best configs)\bin\[email protected]text
MD5:106636DF50DB900C1B8694F04E1D3B8A
SHA256:C1ABFD15A0F95B27F470BCB69E6B5278F2A70FDF609CF1C0CADFE12BBB184927
1192WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1192.42388\TestMem5 v0.12 (best configs)\bin\[email protected]text
MD5:9AF535C1E3C504E0FED1E6885F013D9E
SHA256:436A8B12EEC5B8640F294BF32B24E3D5E5294155063E4F827B294338C12F7D9D
1192WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1192.42388\TestMem5 v0.12 (best configs)\bin\Cfg.linktext
MD5:6866474E10DC58DDFCF3C8BEE7B869E6
SHA256:5C17043A6EDDB8488557C6FB8BD1F9B42B3C2FBDC37028F18C978BF8613B2743
1192WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1192.42388\TestMem5 v0.12 (best configs)\bin\[email protected]text
MD5:3AB536ABE742F644C8EF3D6ECC854DAC
SHA256:0C5489A79B23AA7F51E8B38B63B2C07321B215D0F573DA569A35BDD8DAEA1755
1192WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1192.42388\TestMem5 v0.12 (best configs)\bin\[email protected]text
MD5:B4FAE4EC786EBEDA5CB74654A8240A00
SHA256:AE0C5F2A11E6CA09BF65BDE3F45EEFD1E36EACD672A5436847E183A16D82538D
1192WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1192.42388\TestMem5 v0.12 (best configs)\bin\1usmus_v3.cfgtext
MD5:5703389EF9C64C8266DDFD07E5C1F050
SHA256:CBE22F736AA86D6DCB6D5BACCD4CF5BC2ED89A7397E361D1517A6AB866E8EA91
1192WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1192.42388\TestMem5 v0.12 (best configs)\TM5.exeexecutable
MD5:C5CD49BCF5FC17944383D387638C955E
SHA256:B7ED4B39DE012E88EC9AD7F21B0AC68A4E863FE078B5C54857A16D37D480CC21
6732TM5.exeC:\Users\admin\Desktop\TestMem5.lnklnk
MD5:BC2A519B4B9E7A0E1B2D269312A20106
SHA256:1F37AEB171FC3DC4C11D5911B3DFF2E562191062EA3331B7179CCA2F71B47993
1192WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1192.42388\TestMem5 v0.12 (best configs)\bin\[email protected]text
MD5:F7BE3BD4855C46BA2FB601C819A29579
SHA256:B5B3AB96835163DA0B321039FD820CB388D2E282C2AA850F312E077667DD31CD
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
56
DNS requests
19
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
4004
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2180
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
2260
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
7088
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7088
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
376
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3580
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
unknown
4656
SearchApp.exe
104.126.37.163:443
www.bing.com
Akamai International B.V.
DE
unknown
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4032
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 95.101.149.131
whitelisted
google.com
  • 216.58.212.174
whitelisted
www.bing.com
  • 104.126.37.163
  • 104.126.37.160
  • 104.126.37.155
  • 104.126.37.178
  • 104.126.37.123
  • 104.126.37.136
  • 104.126.37.179
  • 104.126.37.129
  • 104.126.37.186
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.32.74
  • 40.126.32.72
  • 20.190.160.17
  • 20.190.160.20
  • 40.126.32.136
  • 40.126.32.138
  • 40.126.32.134
  • 40.126.32.133
whitelisted
go.microsoft.com
  • 184.30.17.189
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.11
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
TestMem5 v0.12 (best configs)English.rar