File name:

Lazy AIO Advanced Multi Checker 123 Modules.rar

Full analysis: https://app.any.run/tasks/30713198-a579-4658-a169-74db278a4812
Verdict: Malicious activity
Analysis date: January 20, 2024, 18:14:15
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

B26F73FD91AE83710F896C046C1D26A6

SHA1:

2D539EA94F1667DDA663127103212516E29962EA

SHA256:

B3EA800E9EFD9F3A353387C7A7D48CD6C4B0AAF10ABE971C9DD30F9C31DB6DB5

SSDEEP:

98304:Uxq8fi8yjsBD+Gq78sEIJhTQfkxVP/bIJRSyKn3NrxYff7x3MvK1hIoeyJivlowm:5ODzFamCWwUmFi3vyg

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Adds path to the Windows Defender exclusion list

      • Lazy AIO.exe (PID: 712)
      • LZMYBCTLTD.exe (PID: 2432)
      • LZMYBCTLTD.exe (PID: 3040)
      • Lazy AIO.exe (PID: 3360)
      • LZMYBCTLTD.exe (PID: 3848)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 2080)
      • WinRAR.exe (PID: 2476)

    • Reads the Internet Settings

      • Lazy AIO.exe (PID: 1344)
      • Lazy AIO.exe (PID: 712)
      • powershell.exe (PID: 1732)
      • powershell.exe (PID: 2168)
      • LZMYBCTLTD.exe (PID: 2432)
      • powershell.exe (PID: 2396)
      • powershell.exe (PID: 2560)
      • LZMYBCTLTD.exe (PID: 3040)
      • powershell.exe (PID: 3032)
      • powershell.exe (PID: 3224)
      • powershell.exe (PID: 3424)
      • powershell.exe (PID: 2764)
      • LZMYBCTLTD.exe (PID: 3848)
      • Lazy AIO.exe (PID: 3360)
      • powershell.exe (PID: 560)
      • powershell.exe (PID: 4028)

    • Application launched itself

      • Lazy AIO.exe (PID: 1344)

    • Reads the BIOS version

      • Lazy AIO.exe (PID: 1344)
      • Lazy AIO.exe (PID: 712)
      • LZMYBCTLTD.exe (PID: 2432)
      • LZMYBCTLTD.exe (PID: 3040)
      • LZMYBCTLTD.exe (PID: 3848)
      • Lazy AIO.exe (PID: 3360)

    • Starts POWERSHELL.EXE for commands execution

      • Lazy AIO.exe (PID: 712)
      • LZMYBCTLTD.exe (PID: 2432)
      • LZMYBCTLTD.exe (PID: 3040)
      • Lazy AIO.exe (PID: 3360)
      • LZMYBCTLTD.exe (PID: 3848)

    • Script adds exclusion path to Windows Defender

      • Lazy AIO.exe (PID: 712)
      • LZMYBCTLTD.exe (PID: 2432)
      • LZMYBCTLTD.exe (PID: 3040)
      • Lazy AIO.exe (PID: 3360)
      • LZMYBCTLTD.exe (PID: 3848)

    • Using PowerShell to operate with local accounts

      • powershell.exe (PID: 2168)
      • powershell.exe (PID: 1732)
      • powershell.exe (PID: 2396)
      • powershell.exe (PID: 2560)
      • powershell.exe (PID: 3032)
      • powershell.exe (PID: 3224)
      • powershell.exe (PID: 3424)
      • powershell.exe (PID: 2764)
      • powershell.exe (PID: 560)
      • powershell.exe (PID: 4028)

    • Starts CMD.EXE for commands execution

      • Lazy AIO.exe (PID: 712)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 2576)

    • Executing commands from a ".bat" file

      • Lazy AIO.exe (PID: 712)

    • The process executes via Task Scheduler

      • LZMYBCTLTD.exe (PID: 3040)
      • LZMYBCTLTD.exe (PID: 3848)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2080)
      • WinRAR.exe (PID: 2476)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 2080)
      • WinRAR.exe (PID: 2476)

    • Manual execution by a user

      • WinRAR.exe (PID: 2080)
      • Lazy AIO.exe (PID: 3360)
      • WinRAR.exe (PID: 2476)

    • Reads the computer name

      • Lazy AIO.exe (PID: 1344)
      • Lazy AIO.exe (PID: 712)
      • LZMYBCTLTD.exe (PID: 2432)
      • LZMYBCTLTD.exe (PID: 3040)
      • Lazy AIO.exe (PID: 3360)
      • LZMYBCTLTD.exe (PID: 3848)

    • Checks supported languages

      • Lazy AIO.exe (PID: 712)
      • Lazy AIO.exe (PID: 1344)
      • LZMYBCTLTD.exe (PID: 2432)
      • Lazy AIO.exe (PID: 3360)
      • LZMYBCTLTD.exe (PID: 3040)
      • LZMYBCTLTD.exe (PID: 3848)

    • Process checks whether UAC notifications are on

      • Lazy AIO.exe (PID: 712)
      • LZMYBCTLTD.exe (PID: 2432)
      • LZMYBCTLTD.exe (PID: 3040)
      • LZMYBCTLTD.exe (PID: 3848)
      • Lazy AIO.exe (PID: 3360)

    • Creates files in the program directory

      • Lazy AIO.exe (PID: 712)

    • Create files in a temporary directory

      • Lazy AIO.exe (PID: 712)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
79
Monitored processes
22
Malicious processes
8
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs winrar.exe lazy aio.exe no specs lazy aio.exe powershell.exe no specs powershell.exe no specs cmd.exe no specs timeout.exe no specs lzmybctltd.exe no specs powershell.exe no specs powershell.exe no specs schtasks.exe no specs winrar.exe lzmybctltd.exe no specs powershell.exe no specs powershell.exe no specs lazy aio.exe powershell.exe no specs powershell.exe no specs lzmybctltd.exe no specs powershell.exe no specs powershell.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
128"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Lazy AIO Advanced Multi Checker 123 Modules.rar"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
560"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\admin\AppData\Roaming'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—LZMYBCTLTD.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
712"C:\Users\admin\AppData\Local\Temp\Rar$EXb2080.46923\Lazy AIO Advanced Multi Checker 123 Modules\Lazy AIO.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb2080.46923\Lazy AIO Advanced Multi Checker 123 Modules\Lazy AIO.exe
Lazy AIO.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Logon Application
Exit code:
0
Version:
10.0.17134.1
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb2080.46923\lazy aio advanced multi checker 123 modules\lazy aio.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1344"C:\Users\admin\AppData\Local\Temp\Rar$EXb2080.46923\Lazy AIO Advanced Multi Checker 123 Modules\Lazy AIO.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb2080.46923\Lazy AIO Advanced Multi Checker 123 Modules\Lazy AIO.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Logon Application
Exit code:
1
Version:
10.0.17134.1
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb2080.46923\lazy aio advanced multi checker 123 modules\lazy aio.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1384timeout 3 C:\Windows\System32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
timeout - pauses command processing
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
1424"C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /RL HIGHEST /tn "LZMYBCTLTD" /tr C:\ProgramData\active\LZMYBCTLTD.exe /fC:\Windows\System32\schtasks.exe—LZMYBCTLTD.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1732"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—Lazy AIO.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2080"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Lazy AIO Advanced Multi Checker 123 Modules.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2168"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\admin\AppData\Roaming'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—Lazy AIO.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2396"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\admin\AppData\Roaming'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—LZMYBCTLTD.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
Total events
11 176
Read events
10 925
Write events
251
Delete events
0

Modification events

(PID) Process:(128) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2080) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
6
Suspicious files
23
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa128.45949\Lazy AIO Advanced Multi Checker 123 Modules.rar —
MD5:—
SHA256:—
2080WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2080.46923\Lazy AIO Advanced Multi Checker 123 Modules\Data\Configuration.cfg —
MD5:—
SHA256:—
2080WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2080.46923\Lazy AIO Advanced Multi Checker 123 Modules\Lazy AIO.exe —
MD5:—
SHA256:—
712Lazy AIO.exeC:\ProgramData\active\LZMYBCTLTD.exe —
MD5:—
SHA256:—
2476WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2476.3199\Lazy AIO Advanced Multi Checker 123 Modules\Data\Configuration.cfg —
MD5:—
SHA256:—
2476WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2476.3199\Lazy AIO Advanced Multi Checker 123 Modules\Lazy AIO.exe —
MD5:—
SHA256:—
1732powershell.exeC:\Users\admin\AppData\Local\Temp\ns055mtn.kff.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
1732powershell.exeC:\Users\admin\AppData\Local\Temp\bm3e2nbp.whr.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
2080WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2080.46923\Lazy AIO Advanced Multi Checker 123 Modules\updater.inibinary
MD5:BDB71E725923415AD118571A96A58F9C
SHA256:CDFD1E0DB31EF98BE246AC26C14CBD47B24A11F85DD255FE55F93F8FB9FCAB11
2080WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2080.46923\Lazy AIO Advanced Multi Checker 123 Modules\License.dlltext
MD5:B08A5C34CF0A06615DA2CA89010D8B4F
SHA256:04CC5B3B49A7E9E9B6C66C7BE59A20992BF2653746B5D43829C383FB233F88FA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Lazy AIO Advanced Multi Checker 123 Modules.rar