File name:

Internet Download Manager 6.41.22 Repack.rar

Full analysis: https://app.any.run/tasks/a27b7173-dbeb-491a-9776-23b723d5a5e9
Verdict: Malicious activity
Analysis date: November 06, 2023, 22:36:22
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

99883734598CE72149194447EBFBA7B7

SHA1:

E84E030CB34533AD8536EE19321E9C0FED20EB53

SHA256:

AB5449E81325B035A208B4DC6609E9CD30672578F27B548FD26A03E490C683FD

SSDEEP:

98304:/oIwxZGWYyCwrnLzyHldo2Fm2SS3ynQK7RGd5g0j0M9p6hCJNSemM/k3RxWjkjhs:CBi81L5c8hA6hrHsi+/QnSBP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Registers / Runs the DLL via REGSVR32.EXE

      • nsE585.tmp (PID: 4064)
      • nsE662.tmp (PID: 3028)
      • nsE74E.tmp (PID: 3588)
      • nsE5F4.tmp (PID: 4048)

    • Drops the executable file immediately after the start

      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)

    • Creates a writable file the system directory

      • rundll32.exe (PID: 2380)

    • Starts NET.EXE for service management

      • net.exe (PID: 1152)
      • Uninstall.exe (PID: 1756)

  • SUSPICIOUS

    • Reads the Internet Settings

      • cmd.exe (PID: 3488)
      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)
      • Uninstall.exe (PID: 1756)
      • runonce.exe (PID: 1600)

    • Checks Windows Trust Settings

      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)

    • The process creates files with name similar to system file names

      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)

    • Process drops legitimate windows executable

      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)

    • Starts application with an unusual extension

      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)

    • Uses RUNDLL32.EXE to load library

      • Uninstall.exe (PID: 1756)

    • Creates or modifies Windows services

      • Uninstall.exe (PID: 1756)

    • Drops a system driver (possible attempt to evade defenses)

      • rundll32.exe (PID: 2380)
      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)

    • Starts CMD.EXE for commands execution

      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)
      • cmd.exe (PID: 1996)
      • cmd.exe (PID: 3548)

    • Executing commands from ".cmd" file

      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)

    • Creates/Modifies COM task schedule object

      • Uninstall.exe (PID: 1756)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 1988)
      • cmd.exe (PID: 1996)
      • cmd.exe (PID: 1600)
      • cmd.exe (PID: 3548)

    • Get information on the list of running processes

      • cmd.exe (PID: 1996)
      • cmd.exe (PID: 3548)

    • Probably obfuscated PowerShell command line is found

      • cmd.exe (PID: 1996)
      • cmd.exe (PID: 3548)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 1996)
      • cmd.exe (PID: 3548)

    • Powershell version downgrade attack

      • powershell.exe (PID: 2176)
      • powershell.exe (PID: 3940)

    • Reads settings of System Certificates

      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)

    • Reads security settings of Internet Explorer

      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)

    • Application launched itself

      • cmd.exe (PID: 3548)
      • cmd.exe (PID: 1996)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 3548)
      • cmd.exe (PID: 1996)

  • INFO

    • Checks supported languages

      • mode.com (PID: 3668)
      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)
      • nsE585.tmp (PID: 4064)
      • nsE662.tmp (PID: 3028)
      • nsE5F4.tmp (PID: 4048)
      • nsE7CC.tmp (PID: 3672)
      • idmBroker.exe (PID: 3820)
      • nsE83A.tmp (PID: 1528)
      • Uninstall.exe (PID: 1756)
      • nsE74E.tmp (PID: 3588)
      • wmpnscfg.exe (PID: 3704)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3448)
      • rundll32.exe (PID: 2380)

    • Manual execution by a user

      • cmd.exe (PID: 3488)
      • wmpnscfg.exe (PID: 3704)

    • Reads the computer name

      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)
      • Uninstall.exe (PID: 1756)
      • wmpnscfg.exe (PID: 3704)

    • Checks proxy server information

      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)

    • Create files in a temporary directory

      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)

    • Reads Environment values

      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)

    • Creates files in the driver directory

      • rundll32.exe (PID: 2380)

    • Reads the time zone

      • runonce.exe (PID: 1600)

    • Checks operating system version

      • cmd.exe (PID: 1996)
      • cmd.exe (PID: 3548)

    • Reads the machine GUID from the registry

      • wmpnscfg.exe (PID: 3704)
      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)

    • Creates files in the program directory

      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)

    • Creates files or folders in the user directory

      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
14 162
Monitored processes
14 110
Malicious processes
7
Suspicious processes
1

Behavior graph

Click at the process to see the details

Process information

PID
CMD
Path
Indicators
Parent process
120C:\Windows\system32\cmd.exe /S /D /c" echo {CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}"C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
120findstr /r "{.*-.*-.*-.*-.*}" C:\Windows\System32\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (QGREP) Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
120C:\Windows\system32\cmd.exe /S /D /c" echo {CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}"C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
120C:\Windows\system32\cmd.exe /S /D /c" echo {CAFEEFAC-0014-0002-0021-ABCDEFFEDCBA}"C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
120C:\Windows\system32\cmd.exe /S /D /c" echo {CAFEEFAC-0013-0001-0081-ABCDEFFEDCBA}"C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
120findstr /i "LocalServer32 InProcServer32 InProcHandler32" C:\Windows\System32\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (QGREP) Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
120findstr /i "LocalServer32 InProcServer32 InProcHandler32" C:\Windows\System32\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (QGREP) Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
120C:\Windows\system32\cmd.exe /S /D /c" echo {CAFEEFAC-0015-0000-0072-ABCDEFFEDCBB}"C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
120C:\Windows\system32\cmd.exe /S /D /c" echo {CAFEEFAC-0015-0000-0084-ABCDEFFEDCBB}"C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
120C:\Windows\system32\cmd.exe /S /D /c" echo {CAFEEFAC-0016-0000-0052-ABCDEFFEDCBB}"C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
103 578
Read events
103 388
Write events
180
Delete events
10

Modification events

(PID) Process:(3448) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17A\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3488) cmd.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3488) cmd.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
59
Suspicious files
41
Text files
126
Unknown types
0

Dropped files

PID
Process
Filename
Type
3908Internet.Download.Manager.v6.41.22.exeC:\Program Files\Internet Download Manager\IDMFType.datbinary
MD5:EFFB169483778024B3686508B30ED1FF
SHA256:A21F4D385269A38E5E63F5245D00F6DE864D56392AB40F139DEC0FC9039A8F04
3908Internet.Download.Manager.v6.41.22.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419binary
MD5:F2D5747658D34C1999C83B56DA51B7EF
SHA256:536C0F6A76C024DDAB8BD1195BCAB0A764D32D886496DE63113457BD86528E99
3448WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3448.18369\Internet Download Manager 6.41.22 Repack\INSTALL RUS.cmdtext
MD5:F39B7D41014C023BB27798F020DA7F4D
SHA256:BDD9AA9B1F7EAD4F0B6623C11345697757E173BF84B69FC2286FC4B3BA49A4DE
3448WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3448.18369\Internet Download Manager 6.41.22 Repack\Internet.Download.Manager.v6.41.22.exeexecutable
MD5:4D1EA61E3B02F80B9BF0466508BF658C
SHA256:A4D23CF83F2DB84C40E7AF48BFCF31E336D7E49E16B8C1F3AA0796AA9D6A8FA2
3908Internet.Download.Manager.v6.41.22.exeC:\Users\admin\AppData\Local\Temp\InetTest.txtimage
MD5:9B35F9D2BDBD5129EB5FC172A7745B7E
SHA256:FEFE2E856F60023FA08D628749FDB8904E0BD70DA486C98C3BD5AD17A05DC11F
3908Internet.Download.Manager.v6.41.22.exeC:\Users\admin\AppData\Local\Temp\nssD73C.tmp\Activate.cmdtext
MD5:AB5791F9756264C6B1E5CA806E9456B4
SHA256:74BEC5C7F8C5969781680FA95A720D3EEA39BCF641551087215E1937D1F34FE7
3908Internet.Download.Manager.v6.41.22.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:C6D68A0FB1E5D30621815561984E378D
SHA256:A158A9D946A1A78BA9C6B5232BA39D1ECD90E70EF1B4A86BCA76E06D7E475C25
3908Internet.Download.Manager.v6.41.22.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\59D76868C250B3240414CE3EFBB12518_D78D7CA70E2FBC2DFE25625025346DC3binary
MD5:850CDEB6C5235B02B7110A9D6B344515
SHA256:3A2E30D822F08B2F471BFD9CFEB3F857542F78616EFCD30AED657D92BB601937
3908Internet.Download.Manager.v6.41.22.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
3908Internet.Download.Manager.v6.41.22.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\GFR2QDVZ.txttext
MD5:2FB7A59C7ADE29418FFFA4A303E2BF71
SHA256:8C6BE061D7F70CC2CFC3519431E345ABBE3DDCD737D4F8E2757B1C8EF9608ED2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
7
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3908
Internet.Download.Manager.v6.41.22.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEApLZ%2FIHC8DN5kEsAY%2BwbeY%3D
unknown
binary
471 b
unknown
3908
Internet.Download.Manager.v6.41.22.exe
GET
200
178.79.242.0:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?92d1d979084caa85
unknown
compressed
4.66 Kb
unknown
3908
Internet.Download.Manager.v6.41.22.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D
unknown
binary
471 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3908
Internet.Download.Manager.v6.41.22.exe
169.61.27.133:443
www.internetdownloadmanager.com
SOFTLAYER
US
unknown
3908
Internet.Download.Manager.v6.41.22.exe
178.79.242.0:80
ctldl.windowsupdate.com
LLNW
DE
whitelisted
3908
Internet.Download.Manager.v6.41.22.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
www.internetdownloadmanager.com
  • 169.61.27.133
whitelisted
ctldl.windowsupdate.com
  • 178.79.242.0
  • 95.140.236.128
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
internetdownloadmanager.com
  • 169.61.27.133
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Internet Download Manager 6.41.22 Repack.rar