download:

Kernel-Spoofer-main.rar

Full analysis: https://app.any.run/tasks/b12545ca-b9e1-42ed-b85b-8363270f587d
Verdict: Malicious activity
Analysis date: January 27, 2022, 16:28:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

08416935B6A5576AD544FAB148983AF2

SHA1:

9D9EDC12810BB5291CC646964C850EED1E3F5351

SHA256:

A3945EE6756066BC2988EB39B5B624EC1DE55BD5EBFD8D43C427A60DF199B943

SSDEEP:

6144:rsy7iLQmUho0I8YuR0DbKR0NYFSwPe5Efa3BIU1cLn0:rs9QbrjYeYKKdqe5ERUmL0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • kdmapper.sln.exe (PID: 4040)
      • kdmapper.exe (PID: 964)

    • Changes the autorun value in the registry

      • kdmapper.sln.exe (PID: 4040)
      • kdmapper.exe (PID: 964)

    • Actions looks like stealing of personal data

      • kdmapper.sln.exe (PID: 4040)
      • kdmapper.exe (PID: 964)

    • Runs app for hidden code execution

      • kdmapper.exe (PID: 964)
      • kdmapper.sln.exe (PID: 4040)

  • SUSPICIOUS

    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 2852)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2852)

    • Application launched itself

      • WinRAR.exe (PID: 1536)

    • Checks supported languages

      • WinRAR.exe (PID: 1536)
      • WinRAR.exe (PID: 2852)
      • kdmapper.sln.exe (PID: 4040)
      • cmd.exe (PID: 3116)
      • kdmapper.exe (PID: 964)
      • cmd.exe (PID: 600)
      • WMIC.exe (PID: 3260)
      • WMIC.exe (PID: 2760)

    • Reads the computer name

      • WinRAR.exe (PID: 1536)
      • WinRAR.exe (PID: 2852)
      • kdmapper.sln.exe (PID: 4040)
      • kdmapper.exe (PID: 964)
      • WMIC.exe (PID: 3260)
      • WMIC.exe (PID: 2760)

    • Starts CMD.EXE for commands execution

      • kdmapper.sln.exe (PID: 4040)
      • kdmapper.exe (PID: 964)

    • Uses WMIC.EXE to obtain a system information

      • cmd.exe (PID: 3116)
      • cmd.exe (PID: 600)

  • INFO

    • Manual execution by user

      • kdmapper.sln.exe (PID: 4040)
      • kdmapper.exe (PID: 964)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
53
Monitored processes
8
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs winrar.exe kdmapper.sln.exe cmd.exe no specs wmic.exe no specs kdmapper.exe cmd.exe no specs wmic.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
600"cmd.exe"C:\Windows\system32\cmd.exe—kdmapper.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
964"C:\Users\admin\Desktop\kernel spoofer\kdmapper.exe" C:\Users\admin\Desktop\kernel spoofer\kdmapper.exe
Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Description:
Visual Studio 2019
Exit code:
3762504530
Version:
1.0.0.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\desktop\kernel spoofer\kdmapper.exe
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
1536"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Kernel-Spoofer-main.rar"C:\Program Files\WinRAR\WinRAR.exe—Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2760wmic csproduct get uuidC:\Windows\System32\Wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
2852"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIa1536.5746\kernel spoofer.rar"C:\Program Files\WinRAR\WinRAR.exe
WinRAR.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\winrar\winrar.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3116"cmd.exe"C:\Windows\system32\cmd.exe—kdmapper.sln.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3260wmic csproduct get uuidC:\Windows\System32\Wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
4040"C:\Users\admin\Desktop\kernel spoofer\kdmapper.sln.exe" C:\Users\admin\Desktop\kernel spoofer\kdmapper.sln.exe
Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Description:
Visual Studio 2019
Exit code:
3762504530
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\kernel spoofer\kdmapper.sln.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
2 545
Read events
2 514
Write events
31
Delete events
0

Modification events

(PID) Process:(1536) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1536) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1536) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1536) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(1536) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(1536) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Kernel-Spoofer-main.rar
(PID) Process:(1536) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1536) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1536) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1536) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
1
Suspicious files
1
Text files
18
Unknown types
0

Dropped files

PID
Process
Filename
Type
2852WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2852.5930\kernel spoofer\driver.htext
MD5:—
SHA256:—
1536WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa1536.5746\kernel spoofer.rarcompressed
MD5:—
SHA256:—
2852WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2852.5930\kernel spoofer\intel_driver.cpptext
MD5:—
SHA256:—
2852WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2852.5930\kernel spoofer\kdmapper.hpptext
MD5:—
SHA256:—
2852WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2852.5930\kernel spoofer\kdmapper.cpptext
MD5:—
SHA256:—
2852WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2852.5930\kernel spoofer\intel_driver_resource.hpptext
MD5:11D3DE70F8AA7957223E0C37AD75DC0F
SHA256:6D5CFDAF7C93BE0810FE27BC34EEFA76A52A959A17609DADA4715204FA6B2BE5
2852WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2852.5930\kernel spoofer\kdmapper.sln.exeexecutable
MD5:4C54C65D11164C2A6E78A1F63B84A9EE
SHA256:C037A5D10708E627038FAE99F993C8481A7BC045D2E10B57F2FF6F0ED668AF7A
2852WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2852.5930\kernel spoofer\kdmapper.vcxprojxml
MD5:—
SHA256:—
2852WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2852.5930\kernel spoofer\intel_driver.hpptext
MD5:—
SHA256:—
2852WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2852.5930\kernel spoofer\kdmapper.vcxproj.filtersxml
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Kernel-Spoofer-main.rar