File name:

a02989cb3d3e73d5c220704e63560809.zip

Full analysis: https://app.any.run/tasks/bd90da8d-7dcb-43a1-bfdf-8118710dbb4b
Verdict: Malicious activity
Analysis date: February 26, 2023, 11:29:48
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

A21DA4326BD9B00E7F23FA9EFA01FD74

SHA1:

34395DC01D0F25F546E9FDB87E14F500316D066A

SHA256:

A03922EF77F8D19809FFAEE4D72D0A5A59CAAEF59E018A9A66A3F63FC3E8043F

SSDEEP:

98304:uHPBuKpicYyAb/5WULFokDbn5pbkFur7YxU1rVA/b8vGgKwUceUasQNyk2Ncc+lz:suKPPA/5bokDjIFurkxUUT65UceVNykP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • setup.exe (PID: 692)

    • Application was dropped or rewritten from another process

      • setup.exe (PID: 3952)
      • setup.exe (PID: 692)
      • AggSrv.exe (PID: 3676)
      • Setup.exe (PID: 3404)

    • Creates a writable file the system directory

      • setup.exe (PID: 692)
      • DrvInst.exe (PID: 3696)
      • DrvInst.exe (PID: 1800)

    • Changes the autorun value in the registry

      • AggSrv.exe (PID: 3676)

  • SUSPICIOUS

    • Reads the Internet Settings

      • rundll32.exe (PID: 3804)

    • Executable content was dropped or overwritten

      • setup.exe (PID: 692)
      • msiexec.exe (PID: 2196)
      • MsiExec.exe (PID: 3740)
      • DrvInst.exe (PID: 3696)
      • DrvInst.exe (PID: 1800)

    • The process drops C-runtime libraries

      • setup.exe (PID: 692)

    • Drops a file with too old compile date

      • setup.exe (PID: 692)
      • msiexec.exe (PID: 2196)

    • Creates/Modifies COM task schedule object

      • setup.exe (PID: 692)

    • Creates or modifies Windows services

      • setup.exe (PID: 692)
      • msiexec.exe (PID: 2196)

    • Executes as Windows Service

      • AggSrv.exe (PID: 3676)

    • Reads settings of System Certificates

      • msiexec.exe (PID: 2196)
      • DrvInst.exe (PID: 3696)
      • DrvInst.exe (PID: 1800)

    • Application launched itself

      • msiexec.exe (PID: 2196)

    • Drops a system driver (possible attempt to evade defenses)

      • msiexec.exe (PID: 2196)
      • MsiExec.exe (PID: 3740)
      • DrvInst.exe (PID: 3696)
      • DrvInst.exe (PID: 1800)

    • Creates a software uninstall entry

      • Setup.exe (PID: 3404)
      • msiexec.exe (PID: 2196)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2696)

    • Manual execution by a user

      • rundll32.exe (PID: 3804)
      • WinRAR.exe (PID: 2696)

    • The process checks LSA protection

      • rundll32.exe (PID: 3804)
      • Setup.exe (PID: 3404)
      • msiexec.exe (PID: 856)
      • MsiExec.exe (PID: 3740)
      • msiexec.exe (PID: 2196)
      • DrvInst.exe (PID: 3696)
      • DrvInst.exe (PID: 1800)

    • Checks supported languages

      • setup.exe (PID: 692)
      • Setup.exe (PID: 3404)
      • AggSrv.exe (PID: 3676)
      • MSI4957.tmp (PID: 4076)
      • MSI4946.tmp (PID: 1180)

    • Drops a file that was compiled in debug mode

      • setup.exe (PID: 692)
      • msiexec.exe (PID: 2196)
      • MsiExec.exe (PID: 3740)
      • DrvInst.exe (PID: 1800)
      • DrvInst.exe (PID: 3696)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 2696)
      • MsiExec.exe (PID: 3740)
      • msiexec.exe (PID: 2196)
      • DrvInst.exe (PID: 3696)
      • DrvInst.exe (PID: 1800)

    • Changes default file association

      • rundll32.exe (PID: 3804)

    • Create files in a temporary directory

      • setup.exe (PID: 692)
      • Setup.exe (PID: 3404)
      • msiexec.exe (PID: 2196)
      • MsiExec.exe (PID: 3740)

    • Reads the computer name

      • Setup.exe (PID: 3404)
      • setup.exe (PID: 692)
      • AggSrv.exe (PID: 3676)

    • Reads the machine GUID from the registry

      • Setup.exe (PID: 3404)

    • Creates files in the program directory

      • Setup.exe (PID: 3404)
      • setup.exe (PID: 692)
      • MsiExec.exe (PID: 3740)
      • msiexec.exe (PID: 2196)

    • Starts application with an unusual extension

      • msiexec.exe (PID: 2196)

    • Application was dropped or rewritten from another process

      • MSI4946.tmp (PID: 1180)
      • MSI4957.tmp (PID: 4076)

    • Creates files in the driver directory

      • DrvInst.exe (PID: 3696)
      • DrvInst.exe (PID: 1800)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: a02989cb3d3e73d5c220704e63560809
ZipUncompressedSize: 5882923
ZipCompressedSize: 5883835
ZipCRC: 0x10c97baa
ZipModifyDate: 2023:02:26 13:26:14
ZipCompression: Deflated
ZipBitFlag: 0x0009
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
58
Monitored processes
15
Malicious processes
9
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start winrar.exe no specs rundll32.exe no specs winrar.exe no specs winrar.exe setup.exe no specs setup.exe setup.exe no specs aggsrv.exe msiexec.exe no specs msiexec.exe msiexec.exe msi4946.tmp no specs msi4957.tmp no specs drvinst.exe drvinst.exe

Process information

PID
CMD
Path
Indicators
Parent process
692"C:\Users\admin\AppData\Local\Temp\Rar$EXa2696.2701\setup.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2696.2701\setup.exe
WinRAR.exe
User:
admin
Company:
NCR
Integrity Level:
HIGH
Description:
Aggregate Installer Lite
Exit code:
1073741826
Version:
2, 9, 12, 1
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2696.2701\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
856"msiexec.exe" /i "PcGBRU.msi" CONFIGURATIONSET="" REBOOT=Suppress INSTALLDIR="C:\Program Files\NCR APTRA\PcGBRU" ARPSYSTEMCOMPONENT=1 TARGETTYPE="Runtime" /qn MSIRESTARTMANAGERCONTROL=DisableC:\Windows\system32\msiexec.exe—Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1180"C:\Windows\Installer\MSI4946.tmp"C:\Windows\Installer\MSI4946.tmp—msiexec.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\windows\installer\msi4946.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
1236"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\a02989cb3d3e73d5c220704e63560809"C:\Program Files\WinRAR\WinRAR.exe—rundll32.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
1073807364
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1800DrvInst.exe "4" "8" "C:\Users\admin\AppData\Local\Temp\{00017701-9c96-54d9-fd60-d52708b6990a}\AtmA4t.inf" "0" "6c343ba8f" "000003D8" "WinSta0\Default" "0000054C" "208" "C:\Program Files\NCR APTRA\PcGBRU"C:\Windows\system32\DrvInst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2196C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2696"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\_From hs185160\PCGbru.zip"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
1073807364
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3256"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\a02989cb3d3e73d5c220704e63560809.zip"C:\Program Files\WinRAR\WinRAR.exe—Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
1073807364
Version:
5.91.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\program files\winrar\winrar.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
3404"C:\Program Files\NCR APTRA\Aggregate Installer\Setup.exe" C:\Program Files\NCR APTRA\Aggregate Installer\Setup.exe—setup.exe
User:
admin
Company:
NCR
Integrity Level:
HIGH
Description:
Aggregate Installer and De-installer
Exit code:
1073741826
Version:
2, 9, 12, 1
Modules
Images
c:\program files\ncr aptra\aggregate installer\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\ncr aptra\aggregate installer\archlib.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\version.dll
c:\program files\ncr aptra\aggregate installer\custlib.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\setupapi.dll
3676"C:\Program Files\NCR APTRA\Aggregate Installer\AggSrv.exe"C:\Program Files\NCR APTRA\Aggregate Installer\AggSrv.exe
services.exe
User:
SYSTEM
Company:
NCR
Integrity Level:
SYSTEM
Description:
AggSrv
Exit code:
0
Version:
2, 9, 12, 1
Modules
Images
c:\windows\system32\kernel32.dll
c:\program files\ncr aptra\aggregate installer\aggsrv.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
Total events
30 610
Read events
28 974
Write events
1 614
Delete events
22

Modification events

(PID) Process:(3256) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3256) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3256) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3256) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3256) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3256) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3256) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\a02989cb3d3e73d5c220704e63560809.zip
(PID) Process:(3256) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3256) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3256) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
180
Suspicious files
96
Text files
58
Unknown types
30

Dropped files

PID
Process
Filename
Type
2696WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2696.2701\Aggs\_content.initext
MD5:—
SHA256:—
1236WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1236.1797\_From hs185160\PCGbru.zipcompressed
MD5:—
SHA256:—
3256WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3256.48690\a02989cb3d3e73d5c220704e63560809compressed
MD5:—
SHA256:—
2696WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2696.2701\_setup.initext
MD5:—
SHA256:—
2696WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2696.2701\AI.CABcompressed
MD5:—
SHA256:—
2696WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2696.2701\setup.exeexecutable
MD5:—
SHA256:—
2696WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2696.2701\ai00000.dllexecutable
MD5:—
SHA256:—
2696WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2696.2701\Comps\_content.initext
MD5:—
SHA256:—
2696WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2696.2701\Comps\PcGBRU.e93\94110002.1fa\_COMP.inibinary
MD5:—
SHA256:—
2696WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2696.2701\Comps\PcGBRU.e93\94110002.1fa\custom.initext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
Process
Message
AggSrv.exe
[NCRAggregateService] Returning the Main Thread
AggSrv.exe
[NCRAggregateService] Returning the Main Thread
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
a02989cb3d3e73d5c220704e63560809.zip