File name:

проверка сотрудников от инспектора ИФНС Михайловой А.А. - Copy.rar

Full analysis: https://app.any.run/tasks/30622b29-bfe0-4845-acee-06da0d25d5bb
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: May 16, 2025, 04:14:34
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
everything
tool
mimic
ransomware
auto
generic
themida
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

6446F892F97CB135B5F5EEAED7153E1E

SHA1:

4466167EC339E731B483CEA95C0DF9BCCF012C1A

SHA256:

A29F767A75C38464F71D0A4D3B6472FD3C72AEF4D5728464A98818433F6C0E9F

SSDEEP:

98304:CGG/cu+u4W9yBQM9vpaB1CFPu2UVCk4dzC2+ig4kwQ63ahcyKB4pmoTAcDxBPQo8:HlFkZzx8F

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • GENERIC has been found (auto)

      • 7za.exe (PID: 4980)
      • enc-build.exe (PID: 7732)
      • 7za.exe (PID: 5352)
      • 7za.exe (PID: 7464)

    • Changes the autorun value in the registry

      • enc-build.exe (PID: 7732)

    • MIMIC mutex has been found

      • browser.exe (PID: 7932)
      • browser.exe (PID: 2616)
      • browser.exe (PID: 7968)

    • Changes image file execution options

      • browser.exe (PID: 7932)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 5736)
      • powershell.exe (PID: 7272)
      • powershell.exe (PID: 5084)
      • powershell.exe (PID: 6916)
      • powershell.exe (PID: 7416)
      • powershell.exe (PID: 5796)
      • powershell.exe (PID: 5212)
      • powershell.exe (PID: 6944)
      • powershell.exe (PID: 788)

    • Changes powershell execution policy (Bypass)

      • browser.exe (PID: 7932)
      • enc-build.exe (PID: 3976)
      • enc-build.exe (PID: 5376)

    • Disables the Shutdown in the Start menu

      • browser.exe (PID: 7932)

    • MIMIC has been detected (YARA)

      • browser.exe (PID: 7932)

    • Using BCDEDIT.EXE to modify recovery options

      • browser.exe (PID: 7932)
      • enc-build.exe (PID: 5376)
      • enc-build.exe (PID: 3976)

    • Deletes shadow copies

      • browser.exe (PID: 7932)
      • enc-build.exe (PID: 3976)
      • enc-build.exe (PID: 5376)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • Заявка на рассчет.exe (PID: 2384)

    • Starts CMD.EXE for commands execution

      • Заявка на рассчет.exe (PID: 2384)
      • cmd.exe (PID: 720)
      • Заявка на рассчет.exe (PID: 2800)
      • Заявка на рассчет.exe (PID: 6080)
      • cmd.exe (PID: 1348)
      • cmd.exe (PID: 6620)
      • browser.exe (PID: 7932)
      • enc-build.exe (PID: 5376)
      • cmd.exe (PID: 5256)
      • cmd.exe (PID: 7952)
      • enc-build.exe (PID: 3976)
      • cmd.exe (PID: 7884)

    • Executing commands from ".cmd" file

      • Заявка на рассчет.exe (PID: 2384)
      • Заявка на рассчет.exe (PID: 2800)
      • Заявка на рассчет.exe (PID: 6080)

    • The process bypasses the loading of PowerShell profile settings

      • cmd.exe (PID: 720)
      • cmd.exe (PID: 6620)
      • cmd.exe (PID: 1348)

    • Manipulates environment variables

      • powershell.exe (PID: 7196)
      • powershell.exe (PID: 7624)
      • powershell.exe (PID: 684)

    • Possibly malicious use of IEX has been detected

      • cmd.exe (PID: 720)
      • cmd.exe (PID: 6620)
      • cmd.exe (PID: 1348)

    • Executes script without checking the security policy

      • powershell.exe (PID: 7196)
      • powershell.exe (PID: 7624)
      • powershell.exe (PID: 684)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 720)
      • browser.exe (PID: 7932)
      • cmd.exe (PID: 6620)
      • cmd.exe (PID: 1348)
      • enc-build.exe (PID: 3976)
      • enc-build.exe (PID: 5376)

    • Gets content of a file (POWERSHELL)

      • powershell.exe (PID: 7196)

    • Uses sleep to delay execution (POWERSHELL)

      • powershell.exe (PID: 7196)

    • There is functionality for taking screenshot (YARA)

      • Заявка на рассчет.exe (PID: 2384)
      • Everything.exe (PID: 6700)

    • The executable file from the user directory is run by the CMD process

      • 7za.exe (PID: 5344)
      • 7za.exe (PID: 4980)
      • enc-build.exe (PID: 7732)
      • 7za.exe (PID: 7656)
      • 7za.exe (PID: 6592)
      • 7za.exe (PID: 5352)
      • 7za.exe (PID: 7464)
      • enc-build.exe (PID: 5376)
      • enc-build.exe (PID: 3976)

    • Drops 7-zip archiver for unpacking

      • powershell.exe (PID: 7196)
      • enc-build.exe (PID: 7732)
      • powershell.exe (PID: 7624)
      • powershell.exe (PID: 684)
      • enc-build.exe (PID: 5376)
      • enc-build.exe (PID: 3976)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 7196)
      • 7za.exe (PID: 5344)
      • 7za.exe (PID: 4980)
      • enc-build.exe (PID: 7732)
      • powershell.exe (PID: 7624)
      • 7za.exe (PID: 7656)
      • powershell.exe (PID: 684)
      • 7za.exe (PID: 5352)
      • 7za.exe (PID: 6592)
      • 7za.exe (PID: 7464)
      • enc-build.exe (PID: 5376)
      • enc-build.exe (PID: 3976)

    • The process verifies whether the antivirus software is installed

      • 7za.exe (PID: 5344)
      • cmd.exe (PID: 720)
      • cmd.exe (PID: 6324)
      • powrprof.exe (PID: 1072)
      • find.exe (PID: 6372)
      • WerFault.exe (PID: 7680)
      • wsc_proxy.exe (PID: 5280)

    • Writes data into a file (POWERSHELL)

      • powershell.exe (PID: 7196)

    • Executes as Windows Service

      • wsc_proxy.exe (PID: 5280)
      • vds.exe (PID: 7272)
      • wbengine.exe (PID: 7180)
      • wsc_proxy.exe (PID: 1096)
      • wbengine.exe (PID: 2096)
      • vds.exe (PID: 6036)
      • wsc_proxy.exe (PID: 3268)

    • Executes application which crashes

      • wsc_proxy.exe (PID: 5280)
      • wsc_proxy.exe (PID: 1096)
      • wsc_proxy.exe (PID: 3268)

    • Application launched itself

      • cmd.exe (PID: 720)
      • browser.exe (PID: 7932)
      • cmd.exe (PID: 1348)
      • cmd.exe (PID: 6620)
      • enc-build.exe (PID: 5376)
      • enc-build.exe (PID: 3976)
      • cmd.exe (PID: 7884)
      • cmd.exe (PID: 5256)
      • cmd.exe (PID: 7952)

    • Reads the BIOS version

      • enc-build.exe (PID: 7732)
      • browser.exe (PID: 7932)
      • browser.exe (PID: 2616)
      • browser.exe (PID: 7968)
      • browser.exe (PID: 4164)

    • Starts itself from another location

      • enc-build.exe (PID: 7732)

    • Creates file in the systems drive root

      • browser.exe (PID: 7932)

    • Creates or modifies Windows services

      • browser.exe (PID: 7932)

    • Uses powercfg.exe to modify the power settings

      • browser.exe (PID: 7932)
      • enc-build.exe (PID: 5376)
      • enc-build.exe (PID: 3976)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 720)
      • cmd.exe (PID: 1348)
      • cmd.exe (PID: 6620)

    • Start notepad (likely ransomware note)

      • browser.exe (PID: 7932)
      • enc-build.exe (PID: 5376)
      • enc-build.exe (PID: 3976)

    • Uses WEVTUTIL.EXE to cleanup log

      • browser.exe (PID: 7932)
      • enc-build.exe (PID: 5376)
      • enc-build.exe (PID: 3976)

  • INFO

    • Manual execution by a user

      • Заявка на рассчет.exe (PID: 496)
      • Заявка на рассчет.exe (PID: 2384)
      • Заявка на рассчет.exe (PID: 7132)
      • Заявка на рассчет.exe (PID: 2800)
      • Заявка на рассчет.exe (PID: 2240)
      • Заявка на рассчет.exe (PID: 6080)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 7476)

    • Create files in a temporary directory

      • Заявка на рассчет.exe (PID: 2384)
      • powershell.exe (PID: 7196)
      • 7za.exe (PID: 4980)

    • Reads the computer name

      • Заявка на рассчет.exe (PID: 2384)
      • 7za.exe (PID: 5344)
      • powrprof.exe (PID: 1072)
      • wsc_proxy.exe (PID: 5280)
      • 7za.exe (PID: 4980)
      • enc-build.exe (PID: 7732)
      • browser.exe (PID: 7932)
      • Everything.exe (PID: 6700)
      • browser.exe (PID: 7968)
      • browser.exe (PID: 4164)
      • browser.exe (PID: 2616)

    • Process checks computer location settings

      • Заявка на рассчет.exe (PID: 2384)

    • Checks supported languages

      • Заявка на рассчет.exe (PID: 2384)
      • 7za.exe (PID: 5344)
      • wsc_proxy.exe (PID: 5280)
      • powrprof.exe (PID: 1072)
      • enc-build.exe (PID: 7732)
      • 7za.exe (PID: 4980)
      • browser.exe (PID: 7932)
      • Everything.exe (PID: 6700)
      • browser.exe (PID: 7968)
      • browser.exe (PID: 4164)
      • browser.exe (PID: 2616)

    • Reads the software policy settings

      • powershell.exe (PID: 7196)
      • slui.exe (PID: 7644)

    • Checks whether the specified file exists (POWERSHELL)

      • powershell.exe (PID: 7196)

    • Reads security settings of Internet Explorer

      • powershell.exe (PID: 7196)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 7196)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 7196)

    • The sample compiled with english language support

      • powershell.exe (PID: 7196)
      • 7za.exe (PID: 5344)
      • enc-build.exe (PID: 7732)
      • powershell.exe (PID: 7624)
      • powershell.exe (PID: 684)
      • 7za.exe (PID: 6592)
      • 7za.exe (PID: 7656)
      • 7za.exe (PID: 5352)
      • 7za.exe (PID: 7464)
      • enc-build.exe (PID: 3976)
      • enc-build.exe (PID: 5376)

    • Creates files in the program directory

      • 7za.exe (PID: 5344)
      • powrprof.exe (PID: 1072)
      • wsc_proxy.exe (PID: 5280)

    • Uses string replace method (POWERSHELL)

      • powershell.exe (PID: 7196)

    • Reads CPU info

      • wsc_proxy.exe (PID: 5280)

    • Reads the machine GUID from the registry

      • wsc_proxy.exe (PID: 5280)

    • Process checks whether UAC notifications are on

      • enc-build.exe (PID: 7732)
      • browser.exe (PID: 4164)
      • browser.exe (PID: 2616)
      • browser.exe (PID: 7968)
      • browser.exe (PID: 7932)

    • Creates files or folders in the user directory

      • enc-build.exe (PID: 7732)
      • browser.exe (PID: 7932)

    • EVERYTHING mutex has been found

      • Everything.exe (PID: 6700)

    • Themida protector has been detected

      • browser.exe (PID: 7932)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)

EXIF

ZIP

FileVersion: RAR v5
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
392
Monitored processes
245
Malicious processes
20
Suspicious processes
3

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe rundll32.exe no specs заявка на рассчет.exe no specs заявка на рассчет.exe cmd.exe no specs conhost.exe no specs powershell.exe reg.exe no specs 7za.exe cmd.exe no specs powrprof.exe no specs find.exe no specs wsc_proxy.exe werfault.exe no specs #GENERIC 7za.exe #GENERIC enc-build.exe #MIMIC browser.exe everything.exe no specs browser.exe no specs #MIMIC browser.exe no specs #MIMIC browser.exe no specs powercfg.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs conhost.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs conhost.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs systray.exe no specs slui.exe systray.exe no specs systray.exe no specs timeout.exe no specs systray.exe no specs заявка на рассчет.exe no specs systray.exe no specs заявка на рассчет.exe заявка на рассчет.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe заявка на рассчет.exe cmd.exe no specs conhost.exe no specs powershell.exe systray.exe no specs systray.exe no specs systray.exe no specs systray.exe no specs bcdedit.exe no specs bcdedit.exe no specs conhost.exe no specs conhost.exe no specs wbadmin.exe no specs wbadmin.exe no specs conhost.exe no specs conhost.exe no specs wbengine.exe no specs vdsldr.exe no specs vds.exe no specs everything.exe no specs reg.exe no specs 7za.exe cmd.exe no specs powrprof.exe no specs find.exe no specs wsc_proxy.exe werfault.exe no specs reg.exe no specs 7za.exe cmd.exe no specs powrprof.exe no specs find.exe no specs cmd.exe no specs powrprof.exe no specs #GENERIC 7za.exe enc-build.exe #GENERIC 7za.exe enc-build.exe enc-build.exe no specs enc-build.exe no specs enc-build.exe no specs notepad.exe no specs wevtutil.exe no specs wevtutil.exe no specs wevtutil.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs ping.exe no specs enc-build.exe no specs enc-build.exe no specs enc-build.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs conhost.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powershell.exe no specs powershell.exe no specs conhost.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs bcdedit.exe no specs bcdedit.exe no specs wbadmin.exe no specs wbadmin.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs bcdedit.exe no specs bcdedit.exe no specs wbadmin.exe no specs wbadmin.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs wbengine.exe no specs vdsldr.exe no specs notepad.exe no specs wevtutil.exe no specs wevtutil.exe no specs wevtutil.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs notepad.exe no specs wevtutil.exe no specs wevtutil.exe no specs wevtutil.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs vds.exe no specs ping.exe no specs timeout.exe no specs ping.exe no specs timeout.exe no specs cmd.exe no specs powrprof.exe no specs wsc_proxy.exe werfault.exe no specs cmd.exe no specs cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
208C:\WINDOWS\System32\Systray.exe "C:\WINDOWS\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mcaC:\Windows\System32\systray.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Systray .exe stub
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\systray.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
496"C:\Users\admin\Desktop\проверка сотрудников от инспектора ИФНС Михайловой А.А. - Copy\Заявка на рассчет.exe" C:\Users\admin\Desktop\проверка сотрудников от инспектора ИФНС Михайловой А.А. - Copy\Заявка на рассчет.exe—explorer.exe
User:
admin
Company:
Oleg N. Scherbakov
Integrity Level:
MEDIUM
Description:
7z Setup SFX (x86)
Exit code:
3221226540
Version:
1.6.0.2712
Modules
Images
c:\users\admin\desktop\проверка сотрудников от инспектора ифнс михайловой а.а. - copy\заявка на рассчет.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
516wevtutil.exe cl systemC:\Windows\SysWOW64\wevtutil.exe—browser.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Eventing Command Line Utility
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\wevtutil.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcp_win.dll
632\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powercfg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
644\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powercfg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
644\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powercfg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
644bcdedit.exe /set {default} recoveryenabled noC:\Windows\System32\bcdedit.exe—enc-build.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Boot Configuration Data Editor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\bcdedit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cryptsp.dll
684C:\WINDOWS\Sysnative\WindowsPowerShell\v1.0\powershell.exe -nop -c iex ([io.file]::ReadAllText($env:0))C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
720C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\7ZipSfx.000\setup.cmd" "C:\Windows\SysWOW64\cmd.exe—Заявка на рассчет.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
724"C:\Users\admin\AppData\Local\Temp\7ZipSfx.001\enc-build.exe" -e ul2C:\Users\admin\AppData\Local\Temp\7ZipSfx.001\enc-build.exe—enc-build.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\7zipsfx.001\enc-build.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
81 524
Read events
81 036
Write events
406
Delete events
82

Modification events

(PID) Process:(7476) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(7476) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(7476) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(7476) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(7476) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\проверка сотрудников от инспектора ИФНС Михайловой А.А. - Copy.rar
(PID) Process:(7476) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7476) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(7476) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(7476) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(7476) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:15
Value:
Executable files
31
Suspicious files
303
Text files
133
Unknown types
0

Dropped files

PID
Process
Filename
Type
2384Заявка на рассчет.exeC:\Users\admin\AppData\Local\Temp\7ZipSfx.000\data2.binbinary
MD5:ECAA33C3BEB177A77203C15327664C7C
SHA256:BDBB11CCBC9D25C6F67061CE7E974DEA1C0B123D9F9E5EF00F4909B066113149
2384Заявка на рассчет.exeC:\Users\admin\AppData\Local\Temp\7ZipSfx.000\data1.binbinary
MD5:BB55784F918EF99341666C12E555F00A
SHA256:6B24DB89BA00FE599D70FE94BDDBB152C79AF68C6A43A69183A626FB0FF78A9F
7196powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_rdivd5jn.45c.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7680WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_wsc_proxy.exe_8f2abd6f60f384cf977b16326994fd952572ba6_34f0dcf9_0e419edd-f5aa-4d74-92bd-a4ed77a018a7\Report.wer —
MD5:—
SHA256:—
2384Заявка на рассчет.exeC:\Users\admin\AppData\Local\Temp\7ZipSfx.000\setup.cmdtext
MD5:425A42CEC8281D5B497772C6BD8C98E3
SHA256:CC385D802CAD9774A457E44E087DBB17CA82CFAE21A1297AE9C2292120C8E9E9
720cmd.exeC:\Users\admin\AppData\Local\Temp\7ZipSfx.000\data2.bincompressed
MD5:BE15468A70664A938315DCDA64F44904
SHA256:1437135A4C7E380FED05438544B2B50121754EDD7CFCBE1B7CADAB60A214F432
7196powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:7F76A260DAA2F8EA5CEE36FD6BE86DA6
SHA256:ECF2C73601EAEB852F467D6BF7C8B2B0C01E695540CD5482DDBC50E1E1602274
2384Заявка на рассчет.exeC:\Users\admin\AppData\Local\Temp\7ZipSfx.000\data3.binbinary
MD5:C7A214D2C8FE74CA2584FCBC267525F3
SHA256:95E3A5E0C232F467788BC3E9B9A5F1EA44A5D0AEBED6B4463C3D154D8ADF0535
7196powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_tjsrbtmo.ar0.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7476WinRAR.exeC:\Users\admin\Desktop\проверка сотрудников от инспектора ИФНС Михайловой А.А. - Copy\Заявка на рассчет.exeexecutable
MD5:6B6334F5ECA53435D4BC9274A5B3AE85
SHA256:4FCD3363ACEFFC3F95362DF1394AC59E0307470969BDD29085715BAD8665973E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
22
DNS requests
14
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
8156
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
8156
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
8156
SIHClient.exe
4.175.87.197:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 142.250.186.142
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted
nexusrules.officeapps.live.com
  • 52.111.243.31
whitelisted
login.live.com
  • 20.190.160.17
  • 40.126.32.140
  • 20.190.160.130
  • 20.190.160.128
  • 40.126.32.133
  • 20.190.160.4
  • 20.190.160.5
  • 20.190.160.65
whitelisted

Threats

No threats detected
Process
Message
wsc_proxy.exe
[2025-05-16 04:15:35.294] [error ] [crashguard ] [ 5280: 5960] [E9669F: 103] Dump path 'C:\ProgramData\Avast Software\Avast\log' does not exist. Directory should be already created.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
проверка сотрудников от инспектора ИФНС Михайловой А.А. - Copy.rar