File name:

PCHunter V1.57.zip

Full analysis: https://app.any.run/tasks/6d46e0d2-31d9-4f60-b1ec-161ccded3795
Verdict: Malicious activity
Analysis date: July 18, 2024, 07:31:07
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=store
MD5:

1A4C5949F76EECF240DEA20C4687D577

SHA1:

74899A6EA4E1090B515A915CBFF025D263C86D96

SHA256:

A45A04C7C2536CB6646EBDEFAFB8F10722481478E29FEF70BD7136D86F0BFB44

SSDEEP:

98304:W1RjOPTccoMu35a54z4A1N2ZC8USkB5Qybrx4x+Q0Vv3P06Qbs4w4gkPrcdB8HsM:QSIULowuYesJbB

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3396)
      • pchunter32.exe (PID: 3476)

  • SUSPICIOUS

    • Creates or modifies Windows services

      • pchunter32.exe (PID: 3476)

    • Executable content was dropped or overwritten

      • pchunter32.exe (PID: 3476)

    • Reads security settings of Internet Explorer

      • pchunter32.exe (PID: 3476)

    • Drops a system driver (possible attempt to evade defenses)

      • pchunter32.exe (PID: 3476)

    • Reads the Internet Settings

      • pchunter32.exe (PID: 3476)

  • INFO

    • Manual execution by a user

      • pchunter32.exe (PID: 940)
      • pchunter32.exe (PID: 3476)

    • Checks supported languages

      • pchunter32.exe (PID: 3476)

    • Checks proxy server information

      • pchunter32.exe (PID: 3476)

    • Reads the computer name

      • pchunter32.exe (PID: 3476)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3396)

    • Reads the machine GUID from the registry

      • pchunter32.exe (PID: 3476)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2024:07:05 20:17:02
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: PCHunter V1.57/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe pchunter32.exe no specs pchunter32.exe

Process information

PID
CMD
Path
Indicators
Parent process
940"C:\Users\admin\Desktop\PCHunter V1.57\pchunter32.exe" C:\Users\admin\Desktop\PCHunter V1.57\pchunter32.exe—explorer.exe
User:
admin
Company:
安芯网盾（北京）科技有限公司
Integrity Level:
MEDIUM
Description:
系统信息查看工具
Exit code:
3221226540
Version:
1.0.5.7
Modules
Images
c:\users\admin\desktop\pchunter v1.57\pchunter32.exe
c:\windows\system32\ntdll.dll
3396"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\PCHunter V1.57.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3476"C:\Users\admin\Desktop\PCHunter V1.57\pchunter32.exe" C:\Users\admin\Desktop\PCHunter V1.57\pchunter32.exe
explorer.exe
User:
admin
Company:
安芯网盾（北京）科技有限公司
Integrity Level:
HIGH
Description:
系统信息查看工具
Version:
1.0.5.7
Modules
Images
c:\users\admin\desktop\pchunter v1.57\pchunter32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msimg32.dll
Total events
12 255
Read events
12 144
Write events
96
Delete events
15

Modification events

(PID) Process:(3396) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3396) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3396) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3396) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3396) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3396) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(3396) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\PCHunter V1.57.zip
(PID) Process:(3396) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3396) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3396) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
3
Suspicious files
0
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
3396WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3396.19965\PCHunter V1.57\pchunter64.exeexecutable
MD5:5E8E043EE6AD5D62DCDA7445367672C7
SHA256:ABC65D4E2093F98E1E8DE413670D77406D8908AA62E4A82063003EA746D9B3AA
3396WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3396.19965\PCHunter V1.57\readme_cn.txttext
MD5:17EED1B69E4A874D13EE9B0EB3308C3B
SHA256:BCEB68A1737A6A0D205F62F26EC455B1CCFCC0296217E1F0C9F6F9F249E6FCCD
3476pchunter32.exeC:\Users\admin\Desktop\PCHunter V1.57\pchunter32as.sysexecutable
MD5:04BEC0E9A29BFE8B2A1CF7FDB2754468
SHA256:9143EA546FF2E3D653A7366282C4F8B58603A4D5CE2C85900992147006776587
3396WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3396.19965\PCHunter V1.57\pchunter.ektext
MD5:0884B167EA0CDE09DAAD9558284627E8
SHA256:AD7F24985F24B042B4DF3BCEF68DE86849B9E93130155205DF76B0F724DFB4EA
3396WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3396.19965\PCHunter V1.57\pchunter32.exeexecutable
MD5:9EF5F699C9EA02542669FAB2AD832595
SHA256:F86BEE5F3B1B698B7C026A3B576CF570528C7E7120C394CC48A02A820661315F
3396WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3396.19965\PCHunter V1.57\readme.txttext
MD5:8492BE5F1D2B286C6D3B9D2CCCC54A6F
SHA256:26AF541364AE8C1FE10EB2AC447CDADC4AC37B981CF60A759188678C20431588
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
13
DNS requests
6
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1372
svchost.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1372
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1060
svchost.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?fbe613066ac7852b
unknown
—
—
whitelisted
1372
svchost.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?33775f6043c93e33
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
whitelisted
1372
svchost.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
239.255.255.250:3702
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1060
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
1372
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
1372
svchost.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
1372
svchost.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
1372
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.16.206
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
crl.microsoft.com
  • 2.16.241.19
  • 2.16.241.12
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
scan.anxinsec.com
  • —
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
PCHunter V1.57.zip