File name:

⇚New✷ƒiƪƐ✷Sετυρ⤖2025✷ṔḁṨṨẄṏṛḋ⇛.rar

Full analysis: https://app.any.run/tasks/131d5f59-7c82-47f6-b0d8-772d3f819976
Verdict: Malicious activity
Analysis date: March 24, 2025, 15:50:49
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

24E836A8F2670643AC5B542D67DC0E85

SHA1:

CDD3CDE23F86ADA81F49D7AF6EB861B41410D856

SHA256:

B885C6296CDB0003305ACC46F4DAF9168678D2216132C6328EC1E675899B0C52

SSDEEP:

196608:YTWO+DAL3pfYxmD9EmCFAWSP6EMcS+FVdUy3MTP:YWO+m3ixE5CFXSCEMcSUsIaP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Known privilege escalation attack

      • dllhost.exe (PID: 8096)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 7548)
      • FUll_ver_Set-Up_FilE.exe (PID: 456)

    • Executable content was dropped or overwritten

      • FUll_ver_Set-Up_FilE.exe (PID: 456)

    • Starts application with an unusual extension

      • FUll_ver_Set-Up_FilE.exe (PID: 456)
      • FUll_ver_Set-Up_FilE.exe (PID: 8168)

    • The process drops C-runtime libraries

      • FUll_ver_Set-Up_FilE.exe (PID: 456)

  • INFO

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 7836)
      • BackgroundTransferHost.exe (PID: 668)
      • BackgroundTransferHost.exe (PID: 8188)
      • BackgroundTransferHost.exe (PID: 8084)

    • Creates files or folders in the user directory

      • BackgroundTransferHost.exe (PID: 8084)

    • Reads the software policy settings

      • BackgroundTransferHost.exe (PID: 8084)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 7548)
      • FUll_ver_Set-Up_FilE.exe (PID: 456)

    • Manual execution by a user

      • FUll_ver_Set-Up_FilE.exe (PID: 456)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 7548)

    • Creates files in the program directory

      • FUll_ver_Set-Up_FilE.exe (PID: 456)

    • The sample compiled with russian language support

      • WinRAR.exe (PID: 7548)

    • Checks proxy server information

      • BackgroundTransferHost.exe (PID: 8084)

    • Checks supported languages

      • FUll_ver_Set-Up_FilE.exe (PID: 456)
      • more.com (PID: 1660)

    • Create files in a temporary directory

      • FUll_ver_Set-Up_FilE.exe (PID: 8168)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)

EXIF

ZIP

FileVersion: RAR v5
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
144
Monitored processes
15
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs full_ver_set-up_file.exe more.com no specs conhost.exe no specs CMSTPLUA full_ver_set-up_file.exe no specs msbuild.exe no specs more.com no specs conhost.exe no specs svchost.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
456"C:\Users\admin\Desktop\FUll_ver_Set-Up_FilE.exe" C:\Users\admin\Desktop\FUll_ver_Set-Up_FilE.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\users\admin\desktop\full_ver_set-up_file.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\users\admin\desktop\comn.dll
668"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
1660C:\WINDOWS\SysWOW64\more.comC:\Windows\SysWOW64\more.com—FUll_ver_Set-Up_FilE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
More Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\more.com
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\ulib.dll
4452C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5544\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—more.com
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5588"C:\WINDOWS\system32\svchost.exe"C:\Windows\SysWOW64\svchost.exe—MSBuild.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
7288C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe—FUll_ver_Set-Up_FilE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
MSBuild.exe
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\users\admin\appdata\local\temp\iinqkcro
c:\windows\syswow64\msi.dll
c:\windows\microsoft.net\framework\v4.0.30319\msbuild.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
7548"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\⇚New✷ƒiƪƐ✷Sετυρ⤖2025✷ṔḁṨṨẄṏṛḋ⇛.rarC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
7836"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
8056C:\WINDOWS\SysWOW64\more.comC:\Windows\SysWOW64\more.com—FUll_ver_Set-Up_FilE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
More Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\more.com
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
4 111
Read events
4 089
Write events
22
Delete events
0

Modification events

(PID) Process:(7548) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(7548) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(7548) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(7548) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\⇚New✷ƒiƪƐ✷Sετυρ⤖2025✷ṔḁṨṨẄṏṛḋ⇛.rar
(PID) Process:(7548) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7548) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(7548) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(7548) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(7836) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7836) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
Executable files
54
Suspicious files
17
Text files
79
Unknown types
0

Dropped files

PID
Process
Filename
Type
8084BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\c89ab5d4-e30f-4929-94a5-9d3772d3384c.down_data —
MD5:—
SHA256:—
7548WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb7548.28937\UpdateLogs\DisplayLanguageNames.zh_HK.txt —
MD5:—
SHA256:—
7548WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb7548.28937\UpdateLogs\build_trimpath_cgo.txttext
MD5:B8AE160D1782E6223E76EC47A59D9AE4
SHA256:5E152A0B43DAC652C8379E914B705F856903DCFE739DDDE9CB6406B0835DADF2
8084BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:4872BABAF39AA62B8D32695EBB7E9173
SHA256:2EE85DF86EE29BBEB3DCA81AA29B6DE204F605A2769B84C728A329178A2D0999
7548WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb7548.28937\UpdateLogs\cover_sync_atomic_import.txttext
MD5:E5A5060B8FE5F449F725811806DA8936
SHA256:A7EF5365ECCAFCC32E7348A9B13557EA84D3A43E4ACAEDA52F799FF093B83F60
8084BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:786FFB426902BA389709C9EAB371574D
SHA256:84BAEA6B9694CDE9ECA8B27CB45F58E9AC84A66D0CC4E40DF71639ED7FC56EEB
8084BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\0497932a-f8f1-4697-872f-51bad0228e3f.dbe20f7c-d743-430c-9235-625fb0e6ab38.down_metabinary
MD5:2FCBF28E0FEEA2C32AD085A924A01738
SHA256:5FE1776AA935C36440C174F056A0734862196D85091A5D57730A99EE7DCACA54
7548WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb7548.28937\UpdateLogs\#readme_zip_users.txttext
MD5:2EF0A97D6D07E95231A4A97EF0CA1CA2
SHA256:6DCB836ECC67489FB16C3DB0AE3195E69085AC4FD88D4C6DF3AF54D0C612FBFE
7548WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb7548.28937\UpdateLogs\8859-14.txttext
MD5:FA40746824C8B2361C6E7D390B16C468
SHA256:79143EE49AB465F2317B9D3ADE16F07EC6CF6314506426FA5B366A6E742FC15A
7548WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb7548.28937\UpdateLogs\fileline.txttext
MD5:D2ECB1A1B1387C4923216C044E97E2F1
SHA256:CFA533B05F1C4DF7685534FC88D9BC97A3E81EFC8EDADDD3EFDD3AF04CF2FD22
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
24
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.183:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
7728
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
8084
BackgroundTransferHost.exe
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
7728
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.183:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.190.159.64:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.54.109.203:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.159.64:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5332
backgroundTaskHost.exe
20.223.36.55:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.174
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.48.23.183
  • 23.48.23.174
  • 23.48.23.189
  • 23.48.23.185
  • 23.48.23.180
  • 23.48.23.179
  • 23.48.23.175
  • 23.48.23.188
  • 23.48.23.184
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
login.live.com
  • 20.190.159.64
  • 20.190.159.130
  • 40.126.31.129
  • 40.126.31.130
  • 20.190.159.75
  • 20.190.159.128
  • 40.126.31.71
  • 20.190.159.73
whitelisted
ocsp.digicert.com
  • 23.54.109.203
whitelisted
arc.msn.com
  • 20.223.36.55
whitelisted
www.bing.com
  • 104.126.37.186
  • 104.126.37.145
  • 104.126.37.136
  • 104.126.37.123
  • 104.126.37.128
  • 104.126.37.178
  • 104.126.37.137
  • 104.126.37.144
  • 104.126.37.139
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
www.microsoft.com
  • 23.219.150.101
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
⇚New✷ƒiƪƐ✷Sετυρ⤖2025✷ṔḁṨṨẄṏṛḋ⇛.rar