File name:

WUSB6300v2_2_1_01_17_win_setup_signed.zip

Full analysis: https://app.any.run/tasks/3432d314-beb6-4dc9-a87f-d7e38069bb29
Verdict: Malicious activity
Analysis date: December 09, 2024, 23:10:08
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
arch-doc
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=store
MD5:

30343A2A29DAC17B92EA95C9B463C657

SHA1:

2EB1656F7D6C82ABF26115BB1B315F3D3112ADD5

SHA256:

9E769BE25D117249B79981054A01D61AEBF43A3A5117E2ECF62AB37BADFCC212

SSDEEP:

393216:uQg2ogb46sMmftoYLSaLwVxr2uIk7zE/ZaLwVxr2u0MfTzbs6S5fTzAwx:+2ogb4Us1WaLwLrCk3E/ZaLwLricwx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Antivirus name has been found in the command line (generic signature)

      • MpCmdRun.exe (PID: 4556)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • setup.exe (PID: 7080)
      • setup.exe (PID: 7128)
      • setup.exe (PID: 4516)

    • Starts itself from another location

      • setup.exe (PID: 7080)
      • setup.exe (PID: 7128)
      • setup.exe (PID: 4516)

    • Creates file in the systems drive root

      • setup.exe (PID: 7080)
      • setup.exe (PID: 7128)
      • setup.exe (PID: 4516)

    • Drops a system driver (possible attempt to evade defenses)

      • WinRAR.exe (PID: 6668)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 6668)

    • Executing commands from a ".bat" file

      • WinRAR.exe (PID: 6668)

    • Starts CMD.EXE for commands execution

      • WinRAR.exe (PID: 6668)

  • INFO

    • Manual execution by a user

      • setup.exe (PID: 7080)
      • RTUWPSrvcMain.exe (PID: 6992)
      • RTUWPSrvcMain.exe (PID: 6936)
      • setup.exe (PID: 7128)
      • RTUWPSrvcMain.exe (PID: 6084)
      • setup.exe (PID: 4516)
      • RTUWPSrvcMain.exe (PID: 6192)

    • Checks supported languages

      • setup.exe (PID: 7080)
      • setup.exe (PID: 7096)
      • setup.exe (PID: 7128)
      • setup.exe (PID: 7144)
      • setup.exe (PID: 5720)
      • setup.exe (PID: 4516)
      • MpCmdRun.exe (PID: 4556)

    • Create files in a temporary directory

      • setup.exe (PID: 7080)
      • setup.exe (PID: 7096)
      • setup.exe (PID: 7128)
      • setup.exe (PID: 7144)
      • setup.exe (PID: 4516)
      • setup.exe (PID: 5720)
      • MpCmdRun.exe (PID: 4556)

    • Reads the computer name

      • setup.exe (PID: 7080)
      • setup.exe (PID: 7096)
      • setup.exe (PID: 7128)
      • setup.exe (PID: 7144)
      • setup.exe (PID: 4516)
      • setup.exe (PID: 5720)
      • MpCmdRun.exe (PID: 4556)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6668)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2021:01:28 15:43:32
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: WUSB6300v2_2_1_01_17_win_setup_signed/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
131
Monitored processes
16
Malicious processes
1
Suspicious processes
3

Behavior graph

Click at the process to see the details
start winrar.exe rtuwpsrvcmain.exe no specs rtuwpsrvcmain.exe conhost.exe no specs setup.exe setup.exe no specs setup.exe setup.exe no specs rtuwpsrvcmain.exe no specs rtuwpsrvcmain.exe conhost.exe no specs setup.exe setup.exe no specs cmd.exe no specs conhost.exe no specs mpcmdrun.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1920\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—RTUWPSrvcMain.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4516"C:\Users\admin\Desktop\setup.exe" C:\Users\admin\Desktop\setup.exe
explorer.exe
User:
admin
Company:
Linksys LLC
Integrity Level:
MEDIUM
Description:
Setup Launcher Unicode
Exit code:
0
Version:
20.08.0003
Modules
Images
c:\users\admin\desktop\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
4556"C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\admin\AppData\Local\Temp\Rar$VR6668.26059"C:\Program Files\Windows Defender\MpCmdRun.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Malware Protection Command Line Utility
Exit code:
2
Version:
4.18.1909.6 (WinBuild.160101.0800)
Modules
Images
c:\program files\windows defender\mpcmdrun.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
5720C:\Users\admin\AppData\Local\Temp\{162618EC-8FC1-4BB1-B947-2DDD61F85E25}\setup.exe /q"C:\Users\admin\Desktop\setup.exe" /tempdisk1folder"C:\Users\admin\AppData\Local\Temp\{162618EC-8FC1-4BB1-B947-2DDD61F85E25}" /IS_tempC:\Users\admin\AppData\Local\Temp\{162618EC-8FC1-4BB1-B947-2DDD61F85E25}\setup.exe—setup.exe
User:
admin
Company:
Linksys LLC
Integrity Level:
MEDIUM
Description:
Setup Launcher Unicode
Version:
20.08.0003
Modules
Images
c:\users\admin\appdata\local\temp\{162618ec-8fc1-4bb1-b947-2ddd61f85e25}\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
5728\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5872C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\Rar$VR6668.26059\Rar$Scan124879.bat" "C:\Windows\System32\cmd.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
6084"C:\Users\admin\Desktop\RTUWPSrvcMain.exe" C:\Users\admin\Desktop\RTUWPSrvcMain.exe
explorer.exe
User:
admin
Company:
Realtek Semiconductor Corp.
Integrity Level:
HIGH
Description:
RealTek Service Main Program (UWP)
Exit code:
3221225781
Version:
12.1.0116.2019
Modules
Images
c:\users\admin\desktop\rtuwpsrvcmain.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
6192"C:\Users\admin\Desktop\RTUWPSrvcMain.exe" C:\Users\admin\Desktop\RTUWPSrvcMain.exe—explorer.exe
User:
admin
Company:
Realtek Semiconductor Corp.
Integrity Level:
MEDIUM
Description:
RealTek Service Main Program (UWP)
Exit code:
3221226540
Version:
12.1.0116.2019
Modules
Images
c:\users\admin\desktop\rtuwpsrvcmain.exe
c:\windows\system32\ntdll.dll
6668"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\WUSB6300v2_2_1_01_17_win_setup_signed.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
6936"C:\Users\admin\Desktop\RTUWPSrvcMain.exe" C:\Users\admin\Desktop\RTUWPSrvcMain.exe—explorer.exe
User:
admin
Company:
Realtek Semiconductor Corp.
Integrity Level:
MEDIUM
Description:
RealTek Service Main Program (UWP)
Exit code:
3221226540
Version:
12.1.0116.2019
Modules
Images
c:\users\admin\desktop\rtuwpsrvcmain.exe
c:\windows\system32\ntdll.dll
Total events
1 755
Read events
1 746
Write events
9
Delete events
0

Modification events

(PID) Process:(6668) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6668) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6668) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6668) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\WUSB6300v2_2_1_01_17_win_setup_signed.zip
(PID) Process:(6668) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6668) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6668) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6668) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6668) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\VirusScan
Operation:writeName:DefScanner
Value:
Windows Defender
Executable files
30
Suspicious files
11
Text files
29
Unknown types
1

Dropped files

PID
Process
Filename
Type
7080setup.exeC:\Users\admin\AppData\Local\Temp\{306AA957-9E44-4027-81AF-189E07E22B7B}\setup.exeexecutable
MD5:7113EBAD78D35CA58B4F1D2B17BC45D9
SHA256:A76886E1430DAA899641B2EF6B55D975AE95B908218B87E29CFFD4E6B6FACA66
6668WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR6668.26059\WUSB6300v2_2_1_01_17_win_setup_signed.zip\WUSB6300v2_2_1_01_17_win_setup_signed\{2471626C-B03B-440E-A3C6-B24440F043F7}\program files\WUSB6300\WUSB6300\netrtwlanu\netrtwlanu.infbinary
MD5:AC59D13D684C02659847C3A39D5B8F9F
SHA256:5DB4F73D16C08FB8AF5C62779DA493A771FC318DF383644D149611692A364451
7128setup.exeC:\Users\admin\AppData\Local\Temp\{F390808D-EE86-46E1-842C-243DDEAFF97C}\_ISMSIDEL.INItext
MD5:F259412469BBC7A117EEC7542BCEA896
SHA256:5751716BF707DE93160A36C91364154720A888F8CADC5A28628F9571B0CEE61D
4516setup.exeC:\Users\admin\AppData\Local\Temp\{162618EC-8FC1-4BB1-B947-2DDD61F85E25}\_ISMSIDEL.INItext
MD5:C44F2D0FE22DCA0BD27F593221635D65
SHA256:6E0FAE9F31E6B022BD86789B9D43DD3705D09BB1C3BAFBE76C38D5401C70B495
6668WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR6668.26059\WUSB6300v2_2_1_01_17_win_setup_signed.zip\WUSB6300v2_2_1_01_17_win_setup_signed\{2471626C-B03B-440E-A3C6-B24440F043F7}\program files\WUSB6300\WUSB6300\netrtwlanu\rtwlanu.sysexecutable
MD5:E7D41072186979BE599EB63B13371C6B
SHA256:3CBD11346E561E394937736D393A167ADE9BEEE175C1AE5091F82057A4FF16D3
6668WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR6668.26059\WUSB6300v2_2_1_01_17_win_setup_signed.zip\WUSB6300v2_2_1_01_17_win_setup_signed\{2471626C-B03B-440E-A3C6-B24440F043F7}\0x0409.initext
MD5:A108F0030A2CDA00405281014F897241
SHA256:8B76DF0FFC9A226B532B60936765B852B89780C6E475C152F7C320E085E43948
6668WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR6668.26059\WUSB6300v2_2_1_01_17_win_setup_signed.zip\WUSB6300v2_2_1_01_17_win_setup_signed\{2471626C-B03B-440E-A3C6-B24440F043F7}\program files\WUSB6300\WUSB6300\netrtwlanu\netrtwlanu.catcat
MD5:19E3C9421C06B9752C4D67F9B244FEDA
SHA256:C3B719C38FB0BDBBE6C4E2684113A7A31CB4D8F573AA7D4F0E7DE16EEB194808
6668WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR6668.26059\WUSB6300v2_2_1_01_17_win_setup_signed.zip\WUSB6300v2_2_1_01_17_win_setup_signed\{2471626C-B03B-440E-A3C6-B24440F043F7}\Setup.initext
MD5:E9DF00CAC4B7E3C156EADA439051F9F5
SHA256:D810D9B2BA6AE95C287E284F8AC339BBB51BCFFB9AA67C6A31219F014B96416E
6668WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR6668.26059\WUSB6300v2_2_1_01_17_win_setup_signed.zip\WUSB6300v2_2_1_01_17_win_setup_signed\{2471626C-B03B-440E-A3C6-B24440F043F7}\setup.exeexecutable
MD5:CF6873A041E4C33CF5B0EA40635521E6
SHA256:40532D84EA842DF4F6E66BF8D68DF4B18F2170FBDEFFA27474E82576B9F08243
6668WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR6668.26059\WUSB6300v2_2_1_01_17_win_setup_signed.zip\WUSB6300v2_2_1_01_17_win_setup_signed\{2471626C-B03B-440E-A3C6-B24440F043F7}\program files\WUSB6300\WUSB6300\netrtwlanu\GEMTEKPHY_REG_PG.txttext
MD5:40961FAA112987F734711B73204B90F1
SHA256:48927AADD4DE81F4311D76CBE6011C365F0C26AAE8A5621CDAB27F1D317987C1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
23
DNS requests
7
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2624
svchost.exe
GET
200
184.24.77.37:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2624
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
184.24.77.37:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
104.126.37.139:443
www.bing.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2624
svchost.exe
184.24.77.37:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
184.24.77.37:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2624
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4712
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3976
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
whitelisted
www.bing.com
  • 104.126.37.139
  • 104.126.37.137
  • 104.126.37.179
  • 104.126.37.160
  • 104.126.37.177
  • 104.126.37.153
  • 104.126.37.186
  • 104.126.37.176
  • 104.126.37.145
whitelisted
google.com
  • 142.250.185.238
whitelisted
crl.microsoft.com
  • 184.24.77.37
  • 184.24.77.35
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
self.events.data.microsoft.com
  • 52.168.117.170
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
WUSB6300v2_2_1_01_17_win_setup_signed.zip