File name:

tron-12.0.6.zip

Full analysis: https://app.any.run/tasks/f6186215-601a-41a7-a5fe-708c11799c53
Verdict: Malicious activity
Analysis date: January 09, 2025, 14:24:18
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
arch-doc
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract, compression method=store
MD5:

2E69A6EFDC38B1FE1D1C915885F58B46

SHA1:

89411AC32E66BBCB090B82566FFF9A077F8BA897

SHA256:

9C93B0B6FCE38EE4D3AC346BE28D97E549BE4A15C0C7FF183FC2FCEF2C9ED577

SSDEEP:

98304:HMKbO0vwW9K8PGB1wadktGJoDBeoitoxeVbVoBUcdj29ivSdK5baK8jl5UyZgYJl:wutTwX

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 6628)

  • SUSPICIOUS

    • Uses WMIC.EXE to obtain time zone data

      • cmd.exe (PID: 2728)
      • cmd.exe (PID: 7048)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 2728)
      • cmd.exe (PID: 6276)
      • cmd.exe (PID: 7048)

    • Uses WMIC.EXE to obtain operating system information

      • cmd.exe (PID: 6572)
      • cmd.exe (PID: 6464)

    • Process uses IPCONFIG to discover network configuration

      • cmd.exe (PID: 5400)
      • cmd.exe (PID: 6276)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 5400)
      • cmd.exe (PID: 6276)

    • Application launched itself

      • cmd.exe (PID: 5400)
      • cmd.exe (PID: 6276)

    • Executable content was dropped or overwritten

      • update-smart-drivedb.exe (PID: 3608)

    • Uses WMIC.EXE to obtain physical disk drive information

      • cmd.exe (PID: 4740)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • update-smart-drivedb.exe (PID: 3608)

  • INFO

    • The sample compiled with english language support

      • WinRAR.exe (PID: 6628)

    • Manual execution by a user

      • cmd.exe (PID: 5400)
      • cmd.exe (PID: 6276)

    • The process uses the downloaded file

      • WinRAR.exe (PID: 6628)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6628)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2023:10:17 13:18:40
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: tron-12.0.6/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
191
Monitored processes
66
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe rundll32.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs wmic.exe no specs find.exe no specs cmd.exe no specs wmic.exe no specs findstr.exe no specs cmd.exe no specs reg.exe no specs find.exe no specs cmd.exe no specs reg.exe no specs find.exe no specs reg.exe no specs find.exe no specs ipconfig.exe no specs find.exe no specs reg.exe no specs cmd.exe conhost.exe no specs cmd.exe no specs wmic.exe no specs find.exe no specs cmd.exe no specs wmic.exe no specs findstr.exe no specs cmd.exe no specs reg.exe no specs find.exe no specs cmd.exe no specs reg.exe no specs find.exe no specs reg.exe no specs find.exe no specs ipconfig.exe no specs find.exe no specs reg.exe no specs update-smart-drivedb.exe cmd.exe no specs smartctl.exe no specs smartctl.exe no specs findstr.exe no specs cmd.exe no specs smartctl.exe no specs smartctl.exe no specs findstr.exe no specs cmd.exe no specs smartctl.exe no specs smartctl.exe no specs find.exe no specs cmd.exe no specs wmic.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs fsutil.exe no specs bcdedit.exe no specs wget.exe wget.exe

Process information

PID
CMD
Path
Indicators
Parent process
512C:\WINDOWS\System32\wbem\wmic.exe OS GET LocalDateTime C:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
536C:\WINDOWS\System32\wbem\wmic.exe OS GET LocalDateTime C:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
556\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
556bcdedit /set {default} bootmenupolicy legacy C:\Windows\System32\bcdedit.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Boot Configuration Data Editor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\bcdedit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cryptsp.dll
628reg query "hklm\system\controlset001\control\nls\language" /v Installlanguage C:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll
836C:\WINDOWS\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentVersion | C:\WINDOWS\System32\find.exe "CurrentVersion"C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
848stage_0_prep\check_update\wget.exe --user-agent="Tron-Update-Downloader/12.0.6 (Windows 10 Pro)" "https://bmrf.org/repos/tron/Tron v12.0.7 (2024-05-28).exe" -O "C:\Users\admin\Desktop\Tron v12.0.7 (2024-05-28).exe"C:\Users\admin\Desktop\tron-12.0.6\resources\stage_0_prep\check_update\wget.exe
cmd.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\desktop\tron-12.0.6\resources\stage_0_prep\check_update\wget.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
936C:\WINDOWS\System32\find.exe "."C:\Windows\System32\find.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (grep) Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\find.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
1480C:\WINDOWS\System32\find.exe /i "0409" C:\Windows\System32\find.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (grep) Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\find.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
1520C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
Total events
8 364
Read events
8 312
Write events
30
Delete events
22

Modification events

(PID) Process:(6628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\tron-12.0.6.zip
(PID) Process:(6628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:15
Value:
(PID) Process:(6628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:14
Value:
Executable files
11
Suspicious files
1
Text files
170
Unknown types
1

Dropped files

PID
Process
Filename
Type
6628WinRAR.exeC:\Users\admin\Desktop\tron-12.0.6\README_ru.mdtext
MD5:EAEA2D0751CB877582B8470A8EF3B032
SHA256:CA593A19178800868E0848D3631B203F58C0B6702194DC1FC7DC578B2FF886B2
6628WinRAR.exeC:\Users\admin\Desktop\tron-12.0.6\resources\functions\tron_settings.battext
MD5:B8D5B930D97946AF1EF86878E2249662
SHA256:2AA842C1D89FDA375436A70FC97E32AB0F5D2BBE91F232A5B1877B07DA33E276
6628WinRAR.exeC:\Users\admin\Desktop\tron-12.0.6\resources\functions\initialize_environment.battext
MD5:3E6FA082610F86E562AC368E5F23920F
SHA256:BEECB6CB5A23458A1FDD7995CE177DDB9DF710C5661616501EAF8EE3C5312F65
6628WinRAR.exeC:\Users\admin\Desktop\tron-12.0.6\.gitattributestext
MD5:459BE5ADEDB4992F507210D6AE7E8A37
SHA256:1B59A304318929CE1A4F69C69AC52AAC375C3F0F2F5ED7D4A36C205C180EAEE1
6628WinRAR.exeC:\Users\admin\Desktop\tron-12.0.6\resources\stage_0_prep\check_update\wget.exeexecutable
MD5:78C1D46F19EF98DC760E7C40F14EE242
SHA256:AA246768B4CE197C1D0945E233975C23ACD08B84170CC6581E17CDFD771C0CB3
6628WinRAR.exeC:\Users\admin\Desktop\tron-12.0.6\resources\stage_0_prep\check_update\check_update.battext
MD5:0FA8639F0F1B0DDB61E4981E0F281334
SHA256:D355320892C5B418E1CA63BB0255ED046AA4F42CB093F93BBE2C4B4156CB2E51
6628WinRAR.exeC:\Users\admin\Desktop\tron-12.0.6\resources\functions\log_with_date.battext
MD5:844C50DC940F09724434022B43DB0AC2
SHA256:F1EAB65C5C17DE961E81AA5992CABA4FDCBCE18EA2035996737F1098F8DEF978
6628WinRAR.exeC:\Users\admin\Desktop\tron-12.0.6\resources\stage_0_prep\repair_wmi\repair_wmi.battext
MD5:7E8D58AA6DCF8E3DDAC349FA729322B3
SHA256:824207D850FE08EED1CAF8EC7C063BCCEE6BFA8A8362C1DF937DE8AC68FFAEA9
6628WinRAR.exeC:\Users\admin\Desktop\tron-12.0.6\resources\stage_0_prep\check_update\hashdeep.exeexecutable
MD5:0ADADFF17B7F832CCF1C62CA80C90A3D
SHA256:8EFFD7F716751ECC6A8819766B6DB4140400BB94A1243C37006799F16C756DD6
6628WinRAR.exeC:\Users\admin\Desktop\tron-12.0.6\resources\stage_0_prep\check_update\check_update_debloat_lists.battext
MD5:2D453C701199BDA139820991B86594D8
SHA256:1FD29D359FCB1367B33C48F080602928D8368525D2DEABDCFD88DE872B20EB18
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
37
DNS requests
22
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
184.30.230.103:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
184.30.230.103:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6412
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
3608
update-smart-drivedb.exe
GET
200
216.105.38.41:80
http://svn.code.sf.net/p/smartmontools/code/branches/RELEASE_6_6_DRIVEDB/smartmontools/drivedb.h
unknown
—
—
unknown
5036
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5036
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.230.103:80
www.microsoft.com
AKAMAI-AS
US
whitelisted
4712
MoUsoCoreWorker.exe
184.30.230.103:80
www.microsoft.com
AKAMAI-AS
US
whitelisted
5064
SearchApp.exe
2.23.227.221:443
www.bing.com
Ooredoo Q.S.C.
QA
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1176
svchost.exe
40.126.31.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 2.16.241.12
  • 2.16.241.19
whitelisted
www.microsoft.com
  • 184.30.230.103
  • 95.101.149.131
whitelisted
google.com
  • 142.250.186.174
whitelisted
www.bing.com
  • 2.23.227.221
  • 2.23.227.208
  • 2.23.227.198
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.31.73
  • 40.126.31.69
  • 20.190.159.75
  • 20.190.159.73
  • 20.190.159.68
  • 20.190.159.4
  • 20.190.159.0
  • 20.190.159.23
  • 40.126.32.68
  • 40.126.32.76
  • 20.190.160.22
  • 20.190.160.17
  • 20.190.160.20
  • 20.190.160.14
  • 40.126.32.74
  • 40.126.32.136
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
arc.msn.com
  • 20.223.36.55
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted

Threats

Found threats are available for the paid subscriptions
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
tron-12.0.6.zip