File name:

RunAsTI-master.zip

Full analysis: https://app.any.run/tasks/9ab9456f-bc01-41af-a7d4-c25df325ea93
Verdict: Malicious activity
Analysis date: December 29, 2023, 19:11:22
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

EE6E2702BF5889749740A8D310776E4D

SHA1:

FD3291F4E2473189CF69BE6D7CDA57A349FEB129

SHA256:

A829BD71DC30486EC7CEB7E44B84684F0A745077FB922060F235A5CD5E2195D6

SSDEEP:

98304:3xH/crdz4VMhrhwwOsETppQM3JtD80H1fCi/Bvc8mFtsC9OJHG78xG7x+y9LcFtf:Weh5hx/L+q

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • cmd.exe (PID: 2452)

  • SUSPICIOUS

    • Reads the Internet Settings

      • RunAsTI32.exe (PID: 2248)

    • Starts CMD.EXE for commands execution

      • RunAsTI32.exe (PID: 452)
      • RunFromToken32.exe (PID: 984)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 2472)

  • INFO

    • Checks supported languages

      • RunAsTI32.exe (PID: 2248)
      • RunAsTI32.exe (PID: 452)
      • RunFromToken32.exe (PID: 984)

    • Reads mouse settings

      • RunAsTI32.exe (PID: 2248)
      • RunAsTI32.exe (PID: 452)
      • RunFromToken32.exe (PID: 984)

    • Manual execution by a user

      • RunAsTI32.exe (PID: 2248)

    • Application launched itself

      • RunAsTI32.exe (PID: 2248)

    • Reads the computer name

      • RunAsTI32.exe (PID: 2248)
      • RunAsTI32.exe (PID: 452)
      • RunFromToken32.exe (PID: 984)

    • Drops the executable file immediately after the start

      • RunAsTI32.exe (PID: 452)
      • WinRAR.exe (PID: 128)

    • Create files in a temporary directory

      • RunAsTI32.exe (PID: 452)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2019:09:28 01:42:02
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: RunAsTI-master/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
56
Monitored processes
8
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs runasti32.exe no specs runasti32.exe cmd.exe no specs sc.exe no specs runfromtoken32.exe cmd.exe regedit.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
128"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\RunAsTI-master.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
452"C:\Users\admin\Desktop\RunAsTI-master\RunAsTI-master\RunAsTI32.exe" !C:\Users\admin\Desktop\RunAsTI-master\RunAsTI-master\RunAsTI32.exe
RunAsTI32.exe
User:
admin
Integrity Level:
HIGH
Description:
Start program with same privileges as TrustedInstaller
Exit code:
0
Version:
1.0.0.1
Modules
Images
c:\users\admin\desktop\runasti-master\runasti-master\runasti32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\version.dll
984C:\Users\admin\AppData\Local\Temp\RunFromToken32.exe trustedinstaller.exe 1 cmd.exeC:\Users\admin\AppData\Local\Temp\RunFromToken32.exe
RunAsTI32.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Description:
Start a program based on the privileges from a given process' token
Exit code:
0
Version:
1.0.0.3
Modules
Images
c:\users\admin\appdata\local\temp\runfromtoken32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\version.dll
2248"C:\Users\admin\Desktop\RunAsTI-master\RunAsTI-master\RunAsTI32.exe" C:\Users\admin\Desktop\RunAsTI-master\RunAsTI-master\RunAsTI32.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Start program with same privileges as TrustedInstaller
Exit code:
0
Version:
1.0.0.1
Modules
Images
c:\users\admin\desktop\runasti-master\runasti-master\runasti32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\version.dll
2452cmd.exeC:\Windows\System32\cmd.exe
RunFromToken32.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2472cmd.exe /c sc start trustedinstallerC:\Windows\System32\cmd.exe—RunAsTI32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2560sc start trustedinstallerC:\Windows\System32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2728regeditC:\Windows\regedit.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Registry Editor
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\regedit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
1 531
Read events
1 222
Write events
22
Delete events
287

Modification events

(PID) Process:(128) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2248) RunAsTI32.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
3
Suspicious files
0
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
128WinRAR.exeC:\Users\admin\desktop\RunAsTI-master\RunAsTI-master\RunAsTI.au3text
MD5:3E16493C4DE00472602DE91E48986CB9
SHA256:6B5ED8AB26C41D00B731BA13FD24681EEFBB0F0966D11CD94158BCFF38F07374
128WinRAR.exeC:\Users\admin\desktop\RunAsTI-master\RunAsTI-master\LICENSE.mdtext
MD5:0CC0F65A3B9749B2070F2CBDFB426336
SHA256:54E72028E80627A0687E9DF6947B1100EFB0B68E7824486A8D8E7F2632B5066B
128WinRAR.exeC:\Users\admin\desktop\RunAsTI-master\RunAsTI-master\RunAsTI32.exeexecutable
MD5:214AFA30F54EE551FBFB640F6ABC32F5
SHA256:07E1FA6A80739C9939EAFB80C4D575FF1CD9A5680B7CEE401636F9AFD856887F
128WinRAR.exeC:\Users\admin\desktop\RunAsTI-master\RunAsTI-master\.gitignoretext
MD5:69E7DD8DBF58A60418B04DDB157AD1A5
SHA256:A5E54048202DEF346FCD461496AAAF0B42D313153BEE1D54F46242E7B4ED9D20
128WinRAR.exeC:\Users\admin\desktop\RunAsTI-master\RunAsTI-master\readme.txttext
MD5:C8FECDE0137BC4EAEC69BF5C0A275A8A
SHA256:4C15AF9475A822EA88390AC77B0FD8755127CA063F0FD01C78DF5EBBF16CE41C
128WinRAR.exeC:\Users\admin\desktop\RunAsTI-master\RunAsTI-master\.gitattributestext
MD5:C4F364B364A2AC980A1DBF9D9A73A0E1
SHA256:DCC4E04A9952FF446B9D78C624D80379B0F20F5817A89B9B2B1AB8B55B82FD52
128WinRAR.exeC:\Users\admin\desktop\RunAsTI-master\RunAsTI-master\RunFromToken.au3text
MD5:9B8A3B85C206CAAD62E0BD6D0E324351
SHA256:0F854A55C48BE095F561B23A0072A7EDC23E76C527EF5C277B7083DA2C090B38
128WinRAR.exeC:\Users\admin\desktop\RunAsTI-master\RunAsTI-master\RunAsTI64.exeexecutable
MD5:9B9F954F38F4987F1735F2A4AE15DDE0
SHA256:BF365D7D5BC3076E5A7F41BB9F0B9E9BEB58AE900BFFCB3BBB10B575C08D66DB
452RunAsTI32.exeC:\Users\admin\AppData\Local\Temp\RunFromToken32.exeexecutable
MD5:8887B3255DA610CA0F8D1299D4BF81C1
SHA256:CED0065E87327DADAB17851E225E20ACCDA606E8BD93B60048B4AF04AD6A913F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
RunAsTI-master.zip