File name:

shotzy.funsite.zip

Full analysis: https://app.any.run/tasks/513a83b1-7736-4dfb-9aa1-02f87087ede9
Verdict: Malicious activity
Analysis date: March 23, 2025, 07:41:45
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-scr
ims-api
generic
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=store
MD5:

060A6D3C842A12DAEA5956B898553D6B

SHA1:

D5258585B092F2E66EA186DC634177A2F33978C4

SHA256:

A067AA086C9402197D9F4FC4D2F13B5D12D222C3BAF12A56E232565D6FF41EE8

SSDEEP:

49152:Ltd83/AuFURkWboqoLFf/6TxL6I7alJkAy9tG9FxS61aen460slwJHD61eBFGWio:Ltd8JUR/kqop/6TxLxalWRtWFn1a44Hd

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 7328)

  • SUSPICIOUS

    • Possible usage of Discord/Telegram API has been detected (YARA)

      • wscript.exe (PID: 7560)

    • Executing commands from a ".bat" file

      • WinRAR.exe (PID: 7328)

    • Starts CMD.EXE for commands execution

      • WinRAR.exe (PID: 7328)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 7328)

  • INFO

    • Manual execution by a user

      • wscript.exe (PID: 7680)
      • wscript.exe (PID: 7452)
      • wscript.exe (PID: 7560)
      • wscript.exe (PID: 7776)
      • wscript.exe (PID: 7632)
      • wscript.exe (PID: 7960)
      • wscript.exe (PID: 7720)
      • wscript.exe (PID: 7828)
      • wscript.exe (PID: 7880)
      • wscript.exe (PID: 7920)

    • JScript runtime error (SCRIPT)

      • wscript.exe (PID: 7776)
      • wscript.exe (PID: 7828)

    • Create files in a temporary directory

      • MpCmdRun.exe (PID: 4200)

    • Reads the computer name

      • MpCmdRun.exe (PID: 4200)

    • Checks supported languages

      • MpCmdRun.exe (PID: 4200)

    • Checks proxy server information

      • slui.exe (PID: 6476)

    • Reads the software policy settings

      • slui.exe (PID: 6476)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

ims-api

(PID) Process(7560) wscript.exe
Discord-Webhook-Tokens (1)1317569210360266862/KKWXoxBiJ1QMLTxPpHExbWMfSBc8HFeuhxuf5Xhtco24WcO_pEPAY12EadahmN8ZM-mH
Discord-Info-Links
1317569210360266862/KKWXoxBiJ1QMLTxPpHExbWMfSBc8HFeuhxuf5Xhtco24WcO_pEPAY12EadahmN8ZM-mH
Get Webhook Infohttps://discord.com/api/webhooks/1317569210360266862/KKWXoxBiJ1QMLTxPpHExbWMfSBc8HFeuhxuf5Xhtco24WcO_pEPAY12EadahmN8ZM-mH
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2025:02:14 21:26:02
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: shotzy.fun site/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
136
Monitored processes
15
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe no specs wscript.exe no specs wscript.exe no specs wscript.exe no specs wscript.exe no specs wscript.exe no specs wscript.exe no specs wscript.exe no specs wscript.exe no specs wscript.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs mpcmdrun.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
4200"C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\admin\AppData\Local\Temp\Rar$VR7328.6015"C:\Program Files\Windows Defender\MpCmdRun.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Malware Protection Command Line Utility
Exit code:
2
Version:
4.18.1909.6 (WinBuild.160101.0800)
Modules
Images
c:\program files\windows defender\mpcmdrun.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
5332\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6476C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7328"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\shotzy.funsite.zipC:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
7452"C:\Windows\System32\WScript.exe" C:\Users\admin\Desktop\mainRoutes.jsC:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
1
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7560"C:\Windows\System32\WScript.exe" C:\Users\admin\Desktop\authRoutes.jsC:\Windows\System32\wscript.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
1
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
ims-api
(PID) Process(7560) wscript.exe
Discord-Webhook-Tokens (1)1317569210360266862/KKWXoxBiJ1QMLTxPpHExbWMfSBc8HFeuhxuf5Xhtco24WcO_pEPAY12EadahmN8ZM-mH
Discord-Info-Links
1317569210360266862/KKWXoxBiJ1QMLTxPpHExbWMfSBc8HFeuhxuf5Xhtco24WcO_pEPAY12EadahmN8ZM-mH
Get Webhook Infohttps://discord.com/api/webhooks/1317569210360266862/KKWXoxBiJ1QMLTxPpHExbWMfSBc8HFeuhxuf5Xhtco24WcO_pEPAY12EadahmN8ZM-mH
7632"C:\Windows\System32\WScript.exe" C:\Users\admin\Desktop\back-snow.jsC:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
1
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7680"C:\Windows\System32\WScript.exe" C:\Users\admin\Desktop\deleteuser.jsC:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
1
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7720"C:\Windows\System32\WScript.exe" C:\Users\admin\Desktop\cur-snow.jsC:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
1
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7776"C:\Windows\System32\WScript.exe" C:\Users\admin\Desktop\back-storm.jsC:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
6 215
Read events
6 203
Write events
12
Delete events
0

Modification events

(PID) Process:(7328) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(7328) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(7328) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(7328) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\shotzy.funsite.zip
(PID) Process:(7328) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7328) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(7328) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(7328) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(7328) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList
Operation:writeName:ArcSort
Value:
32
(PID) Process:(7328) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\VirusScan
Operation:writeName:DefScanner
Value:
Windows Defender
Executable files
0
Suspicious files
15
Text files
36
Unknown types
0

Dropped files

PID
Process
Filename
Type
7328WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR7328.6015\shotzy.funsite.zip\shotzy.fun site\package-lock.json —
MD5:—
SHA256:—
7328WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR7328.6015\shotzy.funsite.zip\shotzy.fun site\middlewares\apiMiddleware.jsbinary
MD5:700E267EB8BCFA69C152A6B4D8C64B69
SHA256:26335E97B38B0501F24C5781E0A612922717B89A6E3F19FF4129B7A4EF856E9D
7328WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR7328.6015\shotzy.funsite.zip\shotzy.fun site\package.jsonbinary
MD5:54CF4F53EFA0E65C4810D2D85F175C04
SHA256:0CB16B2C7A93795F3FF321BA2CDCA4CF5A717407A7A301F444559C184A3E0132
7328WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR7328.6015\shotzy.funsite.zip\shotzy.fun site\models\ApiKey.jsbinary
MD5:959A0DC4F40D65236D5E5C40F2C3B31C
SHA256:C1FC8E27D0D3564560084172F7F003FB18DAC3C73FB8CEA07A41159A1C221077
7328WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR7328.6015\shotzy.funsite.zip\shotzy.fun site\public\css\global.csstext
MD5:7B4BD6B38844657E52A77BFAED5AA4A5
SHA256:C8460BFC6D502257C48F664FEFA1327CD0A5C04E6A699CD1EE86742A419B3CA4
7328WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR7328.6015\shotzy.funsite.zip\shotzy.fun site\public\css\account.csstext
MD5:45E71A97FABC23EA1CD919351AD082A9
SHA256:7FF9FFC99906AB1A95F8C204E9F1A436943F35DE7511CFD4174F162899CD2F52
7328WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR7328.6015\shotzy.funsite.zip\shotzy.fun site\public\css\home.csstext
MD5:CB0215FB2F7DFEBC2804C335634B18FF
SHA256:4950A9EF946EFF70489F9AA2E3E5AB006F65FAAA9E74DA9E9B6CD95C157C578F
7328WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR7328.6015\shotzy.funsite.zip\shotzy.fun site\public\css\404.csstext
MD5:E05E5C677ABB66BAF2537AC3F7746930
SHA256:0A1711F40CF89F3294B9EE7C667F0BFF39168F3ACB82CCDCA2376BCBA5C3CCDE
7328WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR7328.6015\shotzy.funsite.zip\shotzy.fun site\public\css\images.csstext
MD5:84AF97D84DAE3D76C65129ED187D2D55
SHA256:6F16216C31E8F13BA6D0CD4042EE2E2790D44C6676C9EF8682E73B3B7C362D4A
7328WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR7328.6015\shotzy.funsite.zip\shotzy.fun site\public\img\featured-bio-banner.png —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
21
DNS requests
5
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7176
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6476
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
whitelisted
google.com
  • 142.250.186.142
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
shotzy.funsite.zip