Analysis date (UTC): 13 February 2022, 23:20Analysis environment: Windows 7 Pro, build 7601, x86

https://mega.nz/folder/WjwWCTxL#VnUs3pni1tSwtvUt7oqoBA/file/Lvh2UTZT

MD5:3517BD1541DA8C8A5FAE1224CD5F4C8D

SHA1:AD182B2CC98054B3EA7A34A513AD0AAC3218B2B9

SHA256:A2F0CE500788779209F2226E6916E91BD4D1618571918BF58AD87BEBFCFC9560

Analysis result

Threat level:Malicious activity

Full analysis:Analysis https://mega.nz/folder/WjwWCTxL#VnUs3pni1tSwtvUt7oqoBA/file/Lvh2UTZT Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Application was dropped or rewritten from another process

TMACv6.0.7_Setup.exe (PID: 2268)
TMACv6.0.7_Setup.exe (PID: 4080)

SUSPICIOUS

Executable content was dropped or overwritten

chrome.exe (PID: 3536)
WinRAR.exe (PID: 3892)

Drops a file with a compile date too recent

chrome.exe (PID: 3536)

Drops a file that was compiled in debug mode

chrome.exe (PID: 3536)

Reads Microsoft Outlook installation path

chrome.exe (PID: 3888)

Checks supported languages

WinRAR.exe (PID: 1400)
WinRAR.exe (PID: 4080)
WinRAR.exe (PID: 2352)
WinRAR.exe (PID: 3748)
WinRAR.exe (PID: 3892)
WinRAR.exe (PID: 624)
WinRAR.exe (PID: 1384)
TMACv6.0.7_Setup.exe (PID: 4080)
WinRAR.exe (PID: 4068)
WinRAR.exe (PID: 3400)
WinRAR.exe (PID: 3824)
WinRAR.exe (PID: 3480)
WinRAR.exe (PID: 444)
WinRAR.exe (PID: 3884)

Reads the computer name

WinRAR.exe (PID: 1400)
WinRAR.exe (PID: 4080)
WinRAR.exe (PID: 2352)
WinRAR.exe (PID: 3748)
WinRAR.exe (PID: 624)
WinRAR.exe (PID: 1384)
WinRAR.exe (PID: 3892)
WinRAR.exe (PID: 3400)
WinRAR.exe (PID: 3824)
WinRAR.exe (PID: 444)
WinRAR.exe (PID: 3480)
WinRAR.exe (PID: 3884)
WinRAR.exe (PID: 4068)

Application launched itself

WinRAR.exe (PID: 4080)
WinRAR.exe (PID: 624)

INFO

Checks supported languages

chrome.exe (PID: 3536)
chrome.exe (PID: 3700)
chrome.exe (PID: 3908)
chrome.exe (PID: 3608)
chrome.exe (PID: 2796)
chrome.exe (PID: 592)
chrome.exe (PID: 3952)
chrome.exe (PID: 1956)
chrome.exe (PID: 2748)
chrome.exe (PID: 3304)
chrome.exe (PID: 3284)
chrome.exe (PID: 1284)
chrome.exe (PID: 1852)
chrome.exe (PID: 3104)
chrome.exe (PID: 3524)
chrome.exe (PID: 2812)
chrome.exe (PID: 3840)
chrome.exe (PID: 468)
chrome.exe (PID: 3248)
chrome.exe (PID: 3452)
chrome.exe (PID: 2996)
chrome.exe (PID: 2684)
chrome.exe (PID: 3004)
chrome.exe (PID: 1400)
chrome.exe (PID: 3952)
chrome.exe (PID: 2548)
chrome.exe (PID: 2660)
chrome.exe (PID: 3888)
chrome.exe (PID: 4004)
chrome.exe (PID: 4040)
chrome.exe (PID: 2668)
chrome.exe (PID: 1844)

Application launched itself

chrome.exe (PID: 3536)

Reads the computer name

chrome.exe (PID: 3608)
chrome.exe (PID: 3536)
chrome.exe (PID: 592)
chrome.exe (PID: 3952)
chrome.exe (PID: 3700)
chrome.exe (PID: 2684)
chrome.exe (PID: 1400)
chrome.exe (PID: 3952)
chrome.exe (PID: 4004)
chrome.exe (PID: 3888)
chrome.exe (PID: 1844)

Reads settings of System Certificates

chrome.exe (PID: 3700)
chrome.exe (PID: 3536)

Reads the hosts file

chrome.exe (PID: 3536)
chrome.exe (PID: 3700)

Checks Windows Trust Settings

chrome.exe (PID: 3536)

Reads the date of Windows installation

chrome.exe (PID: 1400)

Manual execution by user

WinRAR.exe (PID: 1400)
WinRAR.exe (PID: 4080)
WinRAR.exe (PID: 624)
WinRAR.exe (PID: 4068)
WinRAR.exe (PID: 1384)
WinRAR.exe (PID: 3824)
WinRAR.exe (PID: 3400)
WinRAR.exe (PID: 3480)
WinRAR.exe (PID: 444)
WinRAR.exe (PID: 3884)

Dropped object may contain Bitcoin addresses

WinRAR.exe (PID: 4068)

Dropped object may contain TOR URL's

WinRAR.exe (PID: 4068)

Threats

No threats detected