File name:

malwar.7z

Full analysis: https://app.any.run/tasks/086e4a32-8835-4aea-8bc3-bb3ae849f31a
Verdict: Malicious activity
Analysis date: December 23, 2024, 12:11:38
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
evasion
upx
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

3FFBF553AB5143E3608EC1F5F06586FA

SHA1:

95373B7C7E845868D13F541BAD947EBCDC2DBDF7

SHA256:

BCCC23AFE6C9EE225AEC02A2FE4E44C4D6CE537B44282C73BBBDADF5CE2A9184

SSDEEP:

1536:7YrZXWz+8dL3Mc0eF3APerQ5gdel/RBR8:clWzprMXcAyclpBR8

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • UAC/LUA settings modification

      • malwar.exe (PID: 7052)
      • malwar.exe (PID: 1616)

    • Changes Security Center notification settings

      • malwar.exe (PID: 1616)
      • malwar.exe (PID: 7052)

  • SUSPICIOUS

    • Reads Internet Explorer settings

      • CCleaner64.exe (PID: 6068)

    • Searches for installed software

      • CCleaner64.exe (PID: 6068)
      • CCleaner64.exe (PID: 6088)

    • Application launched itself

      • CCleaner64.exe (PID: 6068)

    • Executable content was dropped or overwritten

      • CCleaner64.exe (PID: 6088)
      • CCleaner64.exe (PID: 6068)

    • Checks Windows Trust Settings

      • CCleaner64.exe (PID: 6088)
      • CCleaner64.exe (PID: 6068)

    • Reads security settings of Internet Explorer

      • CCleaner64.exe (PID: 6068)
      • CCleaner64.exe (PID: 6088)
      • ShellExperienceHost.exe (PID: 4640)

    • The process verifies whether the antivirus software is installed

      • CCleaner64.exe (PID: 6088)

    • Checks for external IP

      • CCleaner64.exe (PID: 6068)

  • INFO

    • The process uses the downloaded file

      • WinRAR.exe (PID: 5464)
      • CCleaner64.exe (PID: 6068)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 5464)

    • Manual execution by a user

      • CCleaner64.exe (PID: 6068)
      • malwar.exe (PID: 7052)
      • malwar.exe (PID: 1616)

    • Checks supported languages

      • malwar.exe (PID: 7052)
      • CCleaner64.exe (PID: 6088)
      • malwar.exe (PID: 1616)
      • CCleaner64.exe (PID: 6068)
      • ShellExperienceHost.exe (PID: 4640)

    • UPX packer has been detected

      • malwar.exe (PID: 7052)
      • malwar.exe (PID: 1616)

    • Reads the computer name

      • malwar.exe (PID: 7052)
      • ShellExperienceHost.exe (PID: 4640)
      • CCleaner64.exe (PID: 6068)

    • Sends debugging messages

      • CCleaner64.exe (PID: 6068)
      • CCleaner64.exe (PID: 6088)

    • Reads Environment values

      • CCleaner64.exe (PID: 6068)
      • CCleaner64.exe (PID: 6088)

    • The sample compiled with english language support

      • CCleaner64.exe (PID: 6068)
      • CCleaner64.exe (PID: 6088)

    • Reads the machine GUID from the registry

      • CCleaner64.exe (PID: 6068)
      • CCleaner64.exe (PID: 6088)

    • Reads product name

      • CCleaner64.exe (PID: 6068)
      • CCleaner64.exe (PID: 6088)

    • Reads CPU info

      • CCleaner64.exe (PID: 6068)
      • CCleaner64.exe (PID: 6088)

    • Checks proxy server information

      • CCleaner64.exe (PID: 6068)

    • Reads the software policy settings

      • CCleaner64.exe (PID: 6068)

    • Process checks computer location settings

      • CCleaner64.exe (PID: 6068)

    • Creates files or folders in the user directory

      • CCleaner64.exe (PID: 6068)

    • Creates files in the program directory

      • CCleaner64.exe (PID: 6088)
      • CCleaner64.exe (PID: 6068)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)

EXIF

ZIP

FileVersion: 7z v0.04
ModifyDate: 2024:12:23 12:09:15+00:00
ArchivedFileName: malwar.bin
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
138
Monitored processes
6
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe malwar.exe no specs malwar.exe shellexperiencehost.exe no specs ccleaner64.exe ccleaner64.exe

Process information

PID
CMD
Path
Indicators
Parent process
1616"C:\Users\admin\Desktop\malwar.exe" C:\Users\admin\Desktop\malwar.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\desktop\malwar.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
4640"C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mcaC:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Shell Experience Host
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\shellexperiencehost_cw5n1h2txyewy\shellexperiencehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\dxgi.dll
5464"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\malwar.7zC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
6068"C:\Program Files\CCleaner\CCleaner64.exe" C:\Program Files\CCleaner\CCleaner64.exe
explorer.exe
User:
admin
Company:
Piriform Software Ltd
Integrity Level:
HIGH
Description:
CCleaner
Exit code:
0
Version:
6.20.0.10897
Modules
Images
c:\program files\ccleaner\ccleaner64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
6088"C:\Program Files\CCleaner\CCleaner64.exe" /monitorC:\Program Files\CCleaner\CCleaner64.exe
CCleaner64.exe
User:
admin
Company:
Piriform Software Ltd
Integrity Level:
HIGH
Description:
CCleaner
Version:
6.20.0.10897
Modules
Images
c:\program files\ccleaner\ccleaner64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
7052"C:\Users\admin\Desktop\malwar.exe" C:\Users\admin\Desktop\malwar.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\malwar.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
21 835
Read events
21 647
Write events
135
Delete events
53

Modification events

(PID) Process:(5464) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(5464) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(5464) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(5464) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\malwar.7z
(PID) Process:(5464) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(5464) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(5464) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(5464) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(5464) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(7052) malwar.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center
Operation:writeName:AntiVirusOverride
Value:
1
Executable files
6
Suspicious files
16
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
7052malwar.exeC:\Windows\system.inibinary
MD5:B4CD9C8D9CC5590673F1C2A0D468E111
SHA256:E808C205D92D5401F478F7AA5F288BF61C49EE468745DCE1BB6A0969C64C167A
5464WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb5464.22465\malwar.binexecutable
MD5:FDC5590AF1F907D895B5DC5421C94EF2
SHA256:D9731E7748B49C037AF6B91AD4A90509FAC873A9857AFDB63737EEC8CEC2D718
6068CCleaner64.exeC:\Program Files\CCleaner\gcapi_dll.dllexecutable
MD5:F17F96322F8741FE86699963A1812897
SHA256:8B6CE3A640E2D6F36B0001BE2A1ABB765AE51E62C314A15911E75138CBB544BB
6068CCleaner64.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\ccupdate631_free[1].exe —
MD5:—
SHA256:—
6068CCleaner64.exeC:\Program Files\CCleaner\temp_ccupdate\ccupdate631_free.exe —
MD5:—
SHA256:—
6068CCleaner64.exeC:\Program Files\CCleaner\gcapi_17349559536068.dllexecutable
MD5:F17F96322F8741FE86699963A1812897
SHA256:8B6CE3A640E2D6F36B0001BE2A1ABB765AE51E62C314A15911E75138CBB544BB
6068CCleaner64.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccc0fa1b9f86f7b3.customDestinations-msbinary
MD5:F38E769E5ECBA7D79D828952B71E17B4
SHA256:99A58807BB48B1B5996E5ADE5415BB18E33629CB769ABFBB447801FE99B74B8A
6068CCleaner64.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:F8E8FDC0CF7A3E4E26ABE9834B76D49A
SHA256:C35318985777620C60E2665F6326B7664FBD92E48D8393C8B988534ACFCA7F17
6068CCleaner64.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199binary
MD5:E935BC5762068CAF3E24A2683B1B8A88
SHA256:A8ACCFCFEB51BD73DF23B91F4D89FF1A9EB7438EF5B12E8AFDA1A6FF1769E89D
6068CCleaner64.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:7DC3D9421F1F2B9F4BAEA9403BC300F4
SHA256:803CD7C3796A86569DF1966BF9FE83350D30C267608157630647A80435A02E4A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
44
DNS requests
27
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1596
svchost.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6320
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7152
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6068
CCleaner64.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
unknown
—
—
whitelisted
6068
CCleaner64.exe
GET
200
2.16.168.113:80
http://ncc.avast.com/ncc.txt
unknown
—
—
whitelisted
6068
CCleaner64.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAXfj0A2M0oL7zuU%2F%2F2jetU%3D
unknown
—
—
whitelisted
6088
CCleaner64.exe
GET
200
2.16.168.113:80
http://ncc.avast.com/ncc.txt
unknown
—
—
whitelisted
1596
svchost.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1596
svchost.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1596
svchost.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5064
SearchApp.exe
2.23.209.182:443
www.bing.com
Akamai International B.V.
GB
whitelisted
5064
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1176
svchost.exe
40.126.32.74:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1176
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 2.16.241.19
  • 2.16.241.12
whitelisted
www.microsoft.com
  • 88.221.169.152
  • 184.30.21.171
whitelisted
google.com
  • 142.250.185.110
whitelisted
www.bing.com
  • 2.23.209.182
  • 2.23.209.183
  • 2.23.209.135
  • 2.23.209.185
  • 2.23.209.137
  • 2.23.209.187
  • 2.23.209.186
  • 2.23.209.181
  • 2.23.209.133
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.32.74
  • 40.126.32.138
  • 40.126.32.133
  • 40.126.32.76
  • 20.190.160.14
  • 40.126.32.72
  • 40.126.32.136
  • 20.190.160.20
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted

Threats

PID
Process
Class
Message
6068
CCleaner64.exe
Misc activity
ET INFO Observed External IP Lookup Domain (ip-info .ff .avast .com) in TLS SNI
2192
svchost.exe
Misc activity
ET INFO External IP Lookup Service in DNS Query (ip-info .ff .avast .com)
Process
Message
CCleaner64.exe
[2024-12-23 12:12:33.045] [error ] [settings ] [ 6068: 6780] [000000: 0] Failed to get program directory Exception: Unable to determine program folder of product 'piriform-cc'! Code: 0x000000c0 (192)
CCleaner64.exe
[2024-12-23 12:12:33.046] [error ] [ini_access ] [ 6068: 6780] [000000: 0] Incorrect ini_accessor configuration! Fixing relative input path to avoid recursion. Input was: Setup
CCleaner64.exe
Failed to open log file 'C:\Program Files\CCleaner'
CCleaner64.exe
OnLanguage - en
CCleaner64.exe
[2024-12-23 12:12:33.768] [error ] [settings ] [ 6068: 5556] [D2EC45: 356] Failed to get program directory Exception: Unable to determine program folder of product 'piriform-cc'! Code: 0x000000c0 (192)
CCleaner64.exe
[2024-12-23 12:12:33.796] [error ] [Burger ] [ 6068: 5556] [904E07: 253] [23.2.1118.0] [BurgerReporter.cpp] [253] asw::standalone_svc::BurgerReporter::BurgerSwitch: Could not read property BURGER_SETTINGS_PANCAKE_HOSTNAME (0x00000003)
CCleaner64.exe
[2024-12-23 12:12:33.796] [error ] [Burger ] [ 6068: 5556] [904E07: 253] [23.2.1118.0] [BurgerReporter.cpp] [253] asw::standalone_svc::BurgerReporter::BurgerSwitch: Could not read property BURGER_SETTINGS_PANCAKE_HOSTNAME (0x00000003)
CCleaner64.exe
file:///tis/optimizer.tis(1131) : warning :'await' should be used only inside 'async' or 'event'
CCleaner64.exe
file:///tis/optimizer.tis(1288) : warning :'async' does not contain any 'await'
CCleaner64.exe
startCheckingLicense()
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
malwar.7z