File name:

Install_Win11_Win10_10073_09232024.zip

Full analysis: https://app.any.run/tasks/f93a4c1f-4092-49b0-9333-f97f7590f693
Verdict: Malicious activity
Analysis date: October 08, 2024, 15:17:22
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

497EC7C52835CE95D900AE3355F7817D

SHA1:

5F5E4E7DF06684AE3DADF600528E507C0C88C23F

SHA256:

9D56D24BDFB15667E83DD656682FAB9C43354CBAE237730E40A9140F9FCEE13B

SSDEEP:

98304:absU4DzikcrdQGGmnuEsyh85KXq1TGRcypRl34FAEnAB1QkXNAIKhIcunPD/QFld:4Z1DMf

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 5036)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Install_Win11_Win10_10073_09232024.exe (PID: 1700)
      • setup.exe (PID: 1952)
      • setup.exe (PID: 7156)

    • Drops a system driver (possible attempt to evade defenses)

      • Install_Win11_Win10_10073_09232024.exe (PID: 1700)

    • Starts itself from another location

      • setup.exe (PID: 1952)

    • Executes as Windows Service

      • VSSVC.exe (PID: 7040)

  • INFO

    • Manual execution by a user

      • Install_Win11_Win10_10073_09232024.exe (PID: 1700)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 5036)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2024:09:26 17:53:18
ZipCRC: 0x1a83caf3
ZipCompressedSize: 4907887
ZipUncompressedSize: 5100208
ZipFileName: Install_Win11_Win10_10073_09232024.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
143
Monitored processes
12
Malicious processes
0
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe install_win11_win10_10073_09232024.exe setup.exe setup.exe isbew64.exe no specs isbew64.exe no specs isbew64.exe no specs isbew64.exe no specs isbew64.exe no specs isbew64.exe no specs SPPSurrogate no specs vssvc.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1700"C:\Users\admin\Desktop\Install_Win11_Win10_10073_09232024.exe" C:\Users\admin\Desktop\Install_Win11_Win10_10073_09232024.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
1952.\setup.exeC:\Users\admin\AppData\Local\Temp\7zS4A664379\setup.exe
Install_Win11_Win10_10073_09232024.exe
User:
admin
Company:
Realtek
Integrity Level:
HIGH
Description:
InstallScript Setup Launcher Unicode
Version:
1.0.0.38
2428C:\Users\admin\AppData\Local\Temp\{ADCB9E7F-C88A-4CC7-A9EC-0F8A51B46545}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4EEA8ED6-E537-494D-9CE9-F559E03E292A}C:\Users\admin\AppData\Local\Temp\{ADCB9E7F-C88A-4CC7-A9EC-0F8A51B46545}\ISBEW64.exe—setup.exe
User:
admin
Company:
Flexera
Integrity Level:
HIGH
Description:
InstallShield (R) 64-bit Setup Engine
Exit code:
0
Version:
29.0.111
3944C:\Users\admin\AppData\Local\Temp\{ADCB9E7F-C88A-4CC7-A9EC-0F8A51B46545}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{186DEFDE-FC44-4541-A8C2-478D494173FB}C:\Users\admin\AppData\Local\Temp\{ADCB9E7F-C88A-4CC7-A9EC-0F8A51B46545}\ISBEW64.exe—setup.exe
User:
admin
Company:
Flexera
Integrity Level:
HIGH
Description:
InstallShield (R) 64-bit Setup Engine
Exit code:
0
Version:
29.0.111
5036"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\Install_Win11_Win10_10073_09232024.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
6380C:\Users\admin\AppData\Local\Temp\{ADCB9E7F-C88A-4CC7-A9EC-0F8A51B46545}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F548C3DE-1769-4AF3-9D33-9003FD4230FC}C:\Users\admin\AppData\Local\Temp\{ADCB9E7F-C88A-4CC7-A9EC-0F8A51B46545}\ISBEW64.exe—setup.exe
User:
admin
Company:
Flexera
Integrity Level:
HIGH
Description:
InstallShield (R) 64-bit Setup Engine
Version:
29.0.111
6384C:\Users\admin\AppData\Local\Temp\{ADCB9E7F-C88A-4CC7-A9EC-0F8A51B46545}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0C6E8A9A-3D98-4AC0-AFCE-84425C864A17}C:\Users\admin\AppData\Local\Temp\{ADCB9E7F-C88A-4CC7-A9EC-0F8A51B46545}\ISBEW64.exe—setup.exe
User:
admin
Company:
Flexera
Integrity Level:
HIGH
Description:
InstallShield (R) 64-bit Setup Engine
Exit code:
0
Version:
29.0.111
6392C:\WINDOWS\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801}C:\Windows\System32\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Version:
10.0.19041.3636 (WinBuild.160101.0800)
6444C:\Users\admin\AppData\Local\Temp\{ADCB9E7F-C88A-4CC7-A9EC-0F8A51B46545}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F7D66AA6-8D85-4811-A1F1-4D35F9886C22}C:\Users\admin\AppData\Local\Temp\{ADCB9E7F-C88A-4CC7-A9EC-0F8A51B46545}\ISBEW64.exe—setup.exe
User:
admin
Company:
Flexera
Integrity Level:
HIGH
Description:
InstallShield (R) 64-bit Setup Engine
Version:
29.0.111
7040C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
10.0.19041.1 (WinBuild.160101.0800)
Total events
0
Read events
0
Write events
0
Delete events
0

Modification events

No data
Executable files
19
Suspicious files
46
Text files
592
Unknown types
0

Dropped files

PID
Process
Filename
Type
1700Install_Win11_Win10_10073_09232024.exeC:\Users\admin\AppData\Local\Temp\7zS4A664379\0x0406.initext
MD5:75BFC6FA26A38A09F22331B425F99179
SHA256:8CD689EA619D6C331304E26098D4CF6C20FF4CC28FD9CAD1548BFE5ABC545350
1700Install_Win11_Win10_10073_09232024.exeC:\Users\admin\AppData\Local\Temp\7zS4A664379\0x0404.initext
MD5:CD658D92DF1AD180483136CD6960E7F6
SHA256:5D31E009A36325032AB1521D2B1CA1A5BE89BB969D1948D4FE99C387B1055DB1
5036WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5036.47521\Install_Win11_Win10_10073_09232024.exeexecutable
MD5:9F08244D0DDC6C6BB59CD30FEC150A2F
SHA256:04D8C1E9B7D8456A6E5DAD96B5A27DB161EACD6C5A72D13B33C09C29513CDEC1
1700Install_Win11_Win10_10073_09232024.exeC:\Users\admin\AppData\Local\Temp\7zS4A664379\0x0409.initext
MD5:1196F20CA8BCAA637625E6A061D74C9E
SHA256:CDB316D7F9AA2D854EB28F7A333426A55CC65FA7D31B0BDF8AE108E611583D29
1700Install_Win11_Win10_10073_09232024.exeC:\Users\admin\AppData\Local\Temp\7zS4A664379\0x040a.initext
MD5:B216BC7B827622578E60B0B37CE9C4C0
SHA256:4E42D96CF24224D3ED43E7E14227B96FDE3B43235636480F8861DB0B048FFDDF
1700Install_Win11_Win10_10073_09232024.exeC:\Users\admin\AppData\Local\Temp\7zS4A664379\0x040b.initext
MD5:4E5D02CC0D690246F40C01771174E95C
SHA256:A26C1A4F9B457940D94D2DEAC6550C01740964051405E2999C1D884F6D46D5C7
1700Install_Win11_Win10_10073_09232024.exeC:\Users\admin\AppData\Local\Temp\7zS4A664379\0x0412.initext
MD5:59B2E4A2D3898F3E4F49186FF150E26C
SHA256:9416C7B55D1FD9DC06F20E1E3EBBAC1357217113833553D49586E339360529C7
1700Install_Win11_Win10_10073_09232024.exeC:\Users\admin\AppData\Local\Temp\7zS4A664379\0x040e.initext
MD5:DDC9D58C000E9E2E212541424A266BF7
SHA256:2A00E14AD397F8C903E0D6C3CF1D1C98BA0560D577F31189B6A42F1D490BAFC2
1700Install_Win11_Win10_10073_09232024.exeC:\Users\admin\AppData\Local\Temp\7zS4A664379\0x0408.initext
MD5:F0D1FE8FE1139887DD77BD288C301211
SHA256:6596A4FF344BCD6B09E57F9F9BB7AC62E7BA7FD462FD798E45B1BB1917A2BC37
1700Install_Win11_Win10_10073_09232024.exeC:\Users\admin\AppData\Local\Temp\7zS4A664379\0x0410.initext
MD5:FFD754CB7FB9D6E7B999C7ECB444F8D1
SHA256:4B13428BAAB7405A1125EFD93F3569875CD19477B38608D4DD2FE2CCD3861E0F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
53
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
624
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5952
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
3864
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
3864
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1588
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5488
MoUsoCoreWorker.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4360
SearchApp.exe
2.23.209.187:443
www.bing.com
Akamai International B.V.
GB
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4020
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6944
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
www.microsoft.com
  • 88.221.169.152
whitelisted
www.bing.com
  • 2.23.209.187
  • 2.23.209.150
  • 2.23.209.133
  • 2.23.209.149
  • 2.23.209.130
  • 2.23.209.140
  • 2.23.209.189
  • 2.23.209.135
  • 2.23.209.185
  • 2.23.209.179
  • 2.23.209.176
  • 2.23.209.158
  • 2.23.209.182
  • 2.23.209.161
  • 2.23.209.177
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
google.com
  • 142.250.184.238
whitelisted
login.live.com
  • 20.190.160.14
  • 40.126.32.74
  • 40.126.32.133
  • 40.126.32.134
  • 40.126.32.68
  • 40.126.32.136
  • 40.126.32.138
  • 40.126.32.140
whitelisted
th.bing.com
  • 2.23.209.179
  • 2.23.209.176
  • 2.23.209.158
  • 2.23.209.185
  • 2.23.209.182
  • 2.23.209.150
  • 2.23.209.161
  • 2.23.209.177
  • 2.23.209.187
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Install_Win11_Win10_10073_09232024.zip