File name:

Internet Download Manager 6.41.22 Repack.rar

Full analysis: https://app.any.run/tasks/a27b7173-dbeb-491a-9776-23b723d5a5e9
Verdict: Malicious activity
Analysis date: November 06, 2023, 22:36:22
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

99883734598CE72149194447EBFBA7B7

SHA1:

E84E030CB34533AD8536EE19321E9C0FED20EB53

SHA256:

AB5449E81325B035A208B4DC6609E9CD30672578F27B548FD26A03E490C683FD

SSDEEP:

98304:/oIwxZGWYyCwrnLzyHldo2Fm2SS3ynQK7RGd5g0j0M9p6hCJNSemM/k3RxWjkjhs:CBi81L5c8hA6hrHsi+/QnSBP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Registers / Runs the DLL via REGSVR32.EXE

      • nsE585.tmp (PID: 4064)
      • nsE5F4.tmp (PID: 4048)
      • nsE662.tmp (PID: 3028)
      • nsE74E.tmp (PID: 3588)

    • Creates a writable file the system directory

      • rundll32.exe (PID: 2380)

    • Drops the executable file immediately after the start

      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)

    • Starts NET.EXE for service management

      • Uninstall.exe (PID: 1756)
      • net.exe (PID: 1152)

  • SUSPICIOUS

    • Reads the Internet Settings

      • cmd.exe (PID: 3488)
      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)
      • Uninstall.exe (PID: 1756)
      • runonce.exe (PID: 1600)

    • Checks Windows Trust Settings

      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)

    • The process creates files with name similar to system file names

      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)

    • Process drops legitimate windows executable

      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)

    • Starts application with an unusual extension

      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)

    • Uses RUNDLL32.EXE to load library

      • Uninstall.exe (PID: 1756)

    • Drops a system driver (possible attempt to evade defenses)

      • rundll32.exe (PID: 2380)
      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)

    • Creates or modifies Windows services

      • Uninstall.exe (PID: 1756)

    • Creates/Modifies COM task schedule object

      • Uninstall.exe (PID: 1756)

    • Executing commands from ".cmd" file

      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 1988)
      • cmd.exe (PID: 1996)
      • cmd.exe (PID: 1600)
      • cmd.exe (PID: 3548)

    • Get information on the list of running processes

      • cmd.exe (PID: 1996)
      • cmd.exe (PID: 3548)

    • Probably obfuscated PowerShell command line is found

      • cmd.exe (PID: 1996)
      • cmd.exe (PID: 3548)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 1996)
      • cmd.exe (PID: 3548)

    • Starts CMD.EXE for commands execution

      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)
      • cmd.exe (PID: 1996)
      • cmd.exe (PID: 3548)

    • Powershell version downgrade attack

      • powershell.exe (PID: 2176)
      • powershell.exe (PID: 3940)

    • Reads security settings of Internet Explorer

      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)

    • Reads settings of System Certificates

      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 1996)
      • cmd.exe (PID: 3548)

    • Application launched itself

      • cmd.exe (PID: 1996)
      • cmd.exe (PID: 3548)

  • INFO

    • Reads the computer name

      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)
      • Uninstall.exe (PID: 1756)
      • wmpnscfg.exe (PID: 3704)

    • Create files in a temporary directory

      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)

    • Manual execution by a user

      • cmd.exe (PID: 3488)
      • wmpnscfg.exe (PID: 3704)

    • Checks supported languages

      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)
      • mode.com (PID: 3668)
      • nsE585.tmp (PID: 4064)
      • nsE5F4.tmp (PID: 4048)
      • nsE662.tmp (PID: 3028)
      • nsE74E.tmp (PID: 3588)
      • nsE7CC.tmp (PID: 3672)
      • nsE83A.tmp (PID: 1528)
      • Uninstall.exe (PID: 1756)
      • idmBroker.exe (PID: 3820)
      • wmpnscfg.exe (PID: 3704)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3448)
      • rundll32.exe (PID: 2380)

    • Checks proxy server information

      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)

    • Reads the machine GUID from the registry

      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)
      • wmpnscfg.exe (PID: 3704)

    • Creates files in the program directory

      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)

    • Creates files in the driver directory

      • rundll32.exe (PID: 2380)

    • Reads the time zone

      • runonce.exe (PID: 1600)

    • Checks operating system version

      • cmd.exe (PID: 1996)
      • cmd.exe (PID: 3548)

    • Creates files or folders in the user directory

      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)

    • Reads Environment values

      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
14 162
Monitored processes
14 110
Malicious processes
7
Suspicious processes
1

Behavior graph

Click at the process to see the details

Process information

PID
CMD
Path
Indicators
Parent process
120C:\Windows\system32\cmd.exe /S /D /c" echo {CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}"C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
120findstr /r "{.*-.*-.*-.*-.*}" C:\Windows\System32\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (QGREP) Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
120C:\Windows\system32\cmd.exe /S /D /c" echo {CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}"C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
120C:\Windows\system32\cmd.exe /S /D /c" echo {CAFEEFAC-0014-0002-0021-ABCDEFFEDCBA}"C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
120C:\Windows\system32\cmd.exe /S /D /c" echo {CAFEEFAC-0013-0001-0081-ABCDEFFEDCBA}"C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
120findstr /i "LocalServer32 InProcServer32 InProcHandler32" C:\Windows\System32\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (QGREP) Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
120findstr /i "LocalServer32 InProcServer32 InProcHandler32" C:\Windows\System32\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (QGREP) Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
120C:\Windows\system32\cmd.exe /S /D /c" echo {CAFEEFAC-0015-0000-0072-ABCDEFFEDCBB}"C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
120C:\Windows\system32\cmd.exe /S /D /c" echo {CAFEEFAC-0015-0000-0084-ABCDEFFEDCBB}"C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
120C:\Windows\system32\cmd.exe /S /D /c" echo {CAFEEFAC-0016-0000-0052-ABCDEFFEDCBB}"C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
103 578
Read events
103 388
Write events
180
Delete events
10

Modification events

(PID) Process:(3448) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17A\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3488) cmd.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3488) cmd.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
59
Suspicious files
41
Text files
126
Unknown types
0

Dropped files

PID
Process
Filename
Type
3448WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3448.18369\Internet Download Manager 6.41.22 Repack\INSTALL UKR.cmdtext
MD5:0591936FDD18B61463F9D942305D2511
SHA256:B6539F364D8E05A426BEBC690B1C07B168FAE66676257C03E40BF77DAE5A4274
3908Internet.Download.Manager.v6.41.22.exeC:\Users\admin\AppData\Local\Temp\nssD73C.tmp\INetC.dllexecutable
MD5:38F2B22967573A872426D05BDC1A1A70
SHA256:83005624A3C515E8E4454A416693BA0FBF384FF5EA0E1471F520DFAE790D4AB7
3908Internet.Download.Manager.v6.41.22.exeC:\Users\admin\AppData\Local\Temp\nssD73C.tmp\Activate.cmdtext
MD5:AB5791F9756264C6B1E5CA806E9456B4
SHA256:74BEC5C7F8C5969781680FA95A720D3EEA39BCF641551087215E1937D1F34FE7
3448WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3448.18369\Internet Download Manager 6.41.22 Repack\Internet.Download.Manager.v6.41.22.exeexecutable
MD5:4D1EA61E3B02F80B9BF0466508BF658C
SHA256:A4D23CF83F2DB84C40E7AF48BFCF31E336D7E49E16B8C1F3AA0796AA9D6A8FA2
3448WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3448.18369\Internet Download Manager 6.41.22 Repack\INSTALL ENG.cmdtext
MD5:DF74597570985D3C02E1DA320A525D17
SHA256:34416054EDC7F65F6245092E11096586D57529468DFE1EF07117EC7C14775002
3448WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3448.18369\Internet Download Manager 6.41.22 Repack\INSTALL RUS.cmdtext
MD5:F39B7D41014C023BB27798F020DA7F4D
SHA256:BDD9AA9B1F7EAD4F0B6623C11345697757E173BF84B69FC2286FC4B3BA49A4DE
3908Internet.Download.Manager.v6.41.22.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
3908Internet.Download.Manager.v6.41.22.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\idman_logos[1].pngimage
MD5:9B35F9D2BDBD5129EB5FC172A7745B7E
SHA256:FEFE2E856F60023FA08D628749FDB8904E0BD70DA486C98C3BD5AD17A05DC11F
3908Internet.Download.Manager.v6.41.22.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:C6D68A0FB1E5D30621815561984E378D
SHA256:A158A9D946A1A78BA9C6B5232BA39D1ECD90E70EF1B4A86BCA76E06D7E475C25
3908Internet.Download.Manager.v6.41.22.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419binary
MD5:F2D5747658D34C1999C83B56DA51B7EF
SHA256:536C0F6A76C024DDAB8BD1195BCAB0A764D32D886496DE63113457BD86528E99
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
7
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3908
Internet.Download.Manager.v6.41.22.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D
unknown
binary
471 b
unknown
3908
Internet.Download.Manager.v6.41.22.exe
GET
200
178.79.242.0:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?92d1d979084caa85
unknown
compressed
4.66 Kb
unknown
3908
Internet.Download.Manager.v6.41.22.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEApLZ%2FIHC8DN5kEsAY%2BwbeY%3D
unknown
binary
471 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3908
Internet.Download.Manager.v6.41.22.exe
169.61.27.133:443
www.internetdownloadmanager.com
SOFTLAYER
US
unknown
3908
Internet.Download.Manager.v6.41.22.exe
178.79.242.0:80
ctldl.windowsupdate.com
LLNW
DE
whitelisted
3908
Internet.Download.Manager.v6.41.22.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
www.internetdownloadmanager.com
  • 169.61.27.133
whitelisted
ctldl.windowsupdate.com
  • 178.79.242.0
  • 95.140.236.128
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
internetdownloadmanager.com
  • 169.61.27.133
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Internet Download Manager 6.41.22 Repack.rar