File name:

Internet Download Manager 6.41.22 Repack.rar

Full analysis: https://app.any.run/tasks/a27b7173-dbeb-491a-9776-23b723d5a5e9
Verdict: Malicious activity
Analysis date: November 06, 2023, 22:36:22
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

99883734598CE72149194447EBFBA7B7

SHA1:

E84E030CB34533AD8536EE19321E9C0FED20EB53

SHA256:

AB5449E81325B035A208B4DC6609E9CD30672578F27B548FD26A03E490C683FD

SSDEEP:

98304:/oIwxZGWYyCwrnLzyHldo2Fm2SS3ynQK7RGd5g0j0M9p6hCJNSemM/k3RxWjkjhs:CBi81L5c8hA6hrHsi+/QnSBP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Registers / Runs the DLL via REGSVR32.EXE

      • nsE585.tmp (PID: 4064)
      • nsE5F4.tmp (PID: 4048)
      • nsE662.tmp (PID: 3028)
      • nsE74E.tmp (PID: 3588)

    • Starts NET.EXE for service management

      • Uninstall.exe (PID: 1756)
      • net.exe (PID: 1152)

    • Creates a writable file the system directory

      • rundll32.exe (PID: 2380)

    • Drops the executable file immediately after the start

      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)

  • SUSPICIOUS

    • Reads the Internet Settings

      • cmd.exe (PID: 3488)
      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)
      • Uninstall.exe (PID: 1756)
      • runonce.exe (PID: 1600)

    • Checks Windows Trust Settings

      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)

    • Reads security settings of Internet Explorer

      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)

    • Reads settings of System Certificates

      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)

    • The process creates files with name similar to system file names

      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)

    • Drops a system driver (possible attempt to evade defenses)

      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)
      • rundll32.exe (PID: 2380)

    • Process drops legitimate windows executable

      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)

    • Starts application with an unusual extension

      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)

    • Uses RUNDLL32.EXE to load library

      • Uninstall.exe (PID: 1756)

    • Creates or modifies Windows services

      • Uninstall.exe (PID: 1756)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 1996)
      • cmd.exe (PID: 1988)
      • cmd.exe (PID: 1600)
      • cmd.exe (PID: 3548)

    • Executing commands from ".cmd" file

      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)

    • Creates/Modifies COM task schedule object

      • Uninstall.exe (PID: 1756)

    • Starts CMD.EXE for commands execution

      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)
      • cmd.exe (PID: 3548)
      • cmd.exe (PID: 1996)

    • Get information on the list of running processes

      • cmd.exe (PID: 1996)
      • cmd.exe (PID: 3548)

    • Powershell version downgrade attack

      • powershell.exe (PID: 2176)
      • powershell.exe (PID: 3940)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 3548)
      • cmd.exe (PID: 1996)

    • Probably obfuscated PowerShell command line is found

      • cmd.exe (PID: 3548)
      • cmd.exe (PID: 1996)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 1996)
      • cmd.exe (PID: 3548)

    • Application launched itself

      • cmd.exe (PID: 1996)
      • cmd.exe (PID: 3548)

  • INFO

    • Checks supported languages

      • mode.com (PID: 3668)
      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)
      • nsE7CC.tmp (PID: 3672)
      • nsE585.tmp (PID: 4064)
      • nsE5F4.tmp (PID: 4048)
      • nsE662.tmp (PID: 3028)
      • nsE74E.tmp (PID: 3588)
      • nsE83A.tmp (PID: 1528)
      • idmBroker.exe (PID: 3820)
      • Uninstall.exe (PID: 1756)
      • wmpnscfg.exe (PID: 3704)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3448)
      • rundll32.exe (PID: 2380)

    • Manual execution by a user

      • cmd.exe (PID: 3488)
      • wmpnscfg.exe (PID: 3704)

    • Checks proxy server information

      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)

    • Reads the computer name

      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)
      • Uninstall.exe (PID: 1756)
      • wmpnscfg.exe (PID: 3704)

    • Create files in a temporary directory

      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)

    • Reads the machine GUID from the registry

      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)
      • wmpnscfg.exe (PID: 3704)

    • Reads Environment values

      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)

    • Creates files in the program directory

      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)

    • Creates files or folders in the user directory

      • Internet.Download.Manager.v6.41.22.exe (PID: 3908)

    • Reads the time zone

      • runonce.exe (PID: 1600)

    • Checks operating system version

      • cmd.exe (PID: 1996)
      • cmd.exe (PID: 3548)

    • Creates files in the driver directory

      • rundll32.exe (PID: 2380)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
14 162
Monitored processes
14 110
Malicious processes
7
Suspicious processes
1

Behavior graph

Click at the process to see the details

Process information

PID
CMD
Path
Indicators
Parent process
120C:\Windows\system32\cmd.exe /S /D /c" echo {CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}"C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
120findstr /r "{.*-.*-.*-.*-.*}" C:\Windows\System32\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (QGREP) Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
120C:\Windows\system32\cmd.exe /S /D /c" echo {CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}"C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
120C:\Windows\system32\cmd.exe /S /D /c" echo {CAFEEFAC-0014-0002-0021-ABCDEFFEDCBA}"C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
120C:\Windows\system32\cmd.exe /S /D /c" echo {CAFEEFAC-0013-0001-0081-ABCDEFFEDCBA}"C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
120findstr /i "LocalServer32 InProcServer32 InProcHandler32" C:\Windows\System32\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (QGREP) Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
120findstr /i "LocalServer32 InProcServer32 InProcHandler32" C:\Windows\System32\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (QGREP) Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
120C:\Windows\system32\cmd.exe /S /D /c" echo {CAFEEFAC-0015-0000-0072-ABCDEFFEDCBB}"C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
120C:\Windows\system32\cmd.exe /S /D /c" echo {CAFEEFAC-0015-0000-0084-ABCDEFFEDCBB}"C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
120C:\Windows\system32\cmd.exe /S /D /c" echo {CAFEEFAC-0016-0000-0052-ABCDEFFEDCBB}"C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
103 578
Read events
103 388
Write events
180
Delete events
10

Modification events

(PID) Process:(3448) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17A\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3488) cmd.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3488) cmd.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
59
Suspicious files
41
Text files
126
Unknown types
0

Dropped files

PID
Process
Filename
Type
3448WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3448.18369\Internet Download Manager 6.41.22 Repack\INSTALL ENG.cmdtext
MD5:DF74597570985D3C02E1DA320A525D17
SHA256:34416054EDC7F65F6245092E11096586D57529468DFE1EF07117EC7C14775002
3448WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3448.18369\Internet Download Manager 6.41.22 Repack\INSTALL UKR.cmdtext
MD5:0591936FDD18B61463F9D942305D2511
SHA256:B6539F364D8E05A426BEBC690B1C07B168FAE66676257C03E40BF77DAE5A4274
3448WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3448.18369\Internet Download Manager 6.41.22 Repack\INSTALL RUS.cmdtext
MD5:F39B7D41014C023BB27798F020DA7F4D
SHA256:BDD9AA9B1F7EAD4F0B6623C11345697757E173BF84B69FC2286FC4B3BA49A4DE
3908Internet.Download.Manager.v6.41.22.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419binary
MD5:AFBD1116F40C54CA8BE577BDF3512888
SHA256:86C693E6757476C83D7DBF16E2BE68A81E2B11C6B09C157B4D84E430F11AE82F
3908Internet.Download.Manager.v6.41.22.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\59D76868C250B3240414CE3EFBB12518_D78D7CA70E2FBC2DFE25625025346DC3binary
MD5:850CDEB6C5235B02B7110A9D6B344515
SHA256:3A2E30D822F08B2F471BFD9CFEB3F857542F78616EFCD30AED657D92BB601937
3908Internet.Download.Manager.v6.41.22.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\idman_logos[1].pngimage
MD5:9B35F9D2BDBD5129EB5FC172A7745B7E
SHA256:FEFE2E856F60023FA08D628749FDB8904E0BD70DA486C98C3BD5AD17A05DC11F
3908Internet.Download.Manager.v6.41.22.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\GFR2QDVZ.txttext
MD5:2FB7A59C7ADE29418FFFA4A303E2BF71
SHA256:8C6BE061D7F70CC2CFC3519431E345ABBE3DDCD737D4F8E2757B1C8EF9608ED2
3908Internet.Download.Manager.v6.41.22.exeC:\Users\admin\AppData\Local\Temp\nssD73C.tmp\System.dllexecutable
MD5:8CF2AC271D7679B1D68EEFC1AE0C5618
SHA256:6950991102462D84FDC0E3B0AE30C95AF8C192F77CE3D78E8D54E6B22F7C09BA
3908Internet.Download.Manager.v6.41.22.exeC:\Users\admin\AppData\Local\Temp\InetTest.txtimage
MD5:9B35F9D2BDBD5129EB5FC172A7745B7E
SHA256:FEFE2E856F60023FA08D628749FDB8904E0BD70DA486C98C3BD5AD17A05DC11F
3448WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3448.18369\Internet Download Manager 6.41.22 Repack\Internet.Download.Manager.v6.41.22.exeexecutable
MD5:4D1EA61E3B02F80B9BF0466508BF658C
SHA256:A4D23CF83F2DB84C40E7AF48BFCF31E336D7E49E16B8C1F3AA0796AA9D6A8FA2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
7
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3908
Internet.Download.Manager.v6.41.22.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEApLZ%2FIHC8DN5kEsAY%2BwbeY%3D
unknown
binary
471 b
unknown
3908
Internet.Download.Manager.v6.41.22.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D
unknown
binary
471 b
unknown
3908
Internet.Download.Manager.v6.41.22.exe
GET
200
178.79.242.0:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?92d1d979084caa85
unknown
compressed
4.66 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3908
Internet.Download.Manager.v6.41.22.exe
169.61.27.133:443
www.internetdownloadmanager.com
SOFTLAYER
US
unknown
3908
Internet.Download.Manager.v6.41.22.exe
178.79.242.0:80
ctldl.windowsupdate.com
LLNW
DE
whitelisted
3908
Internet.Download.Manager.v6.41.22.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
www.internetdownloadmanager.com
  • 169.61.27.133
whitelisted
ctldl.windowsupdate.com
  • 178.79.242.0
  • 95.140.236.128
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
internetdownloadmanager.com
  • 169.61.27.133
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Internet Download Manager 6.41.22 Repack.rar