File name:

Purchase Order Pending Quantity.zip

Full analysis: https://app.any.run/tasks/0cf03bec-949b-4f4b-af69-ad755ac269c3
Verdict: Malicious activity
Analysis date: May 27, 2025, 10:01:38
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
arch-exec
inno
installer
delphi
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

AEBB1F67B1DD85D28DC4280C0D79F693

SHA1:

50C874EEA617A548AACEDE23A5782F175D770358

SHA256:

BDAE21952C4E6367FE534A9E5A3B3EB30D045DCB93129C6CE0435C3F0C8D90D3

SSDEEP:

24576:49lPOL1fH2jIMGTX+7hfD7GNRjuPlkadnECszgspSxb5PF6mCuZrV:49lPOL1fH2jIMG2hfD7GNNutkadnECsY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 2840)

    • Registers / Runs the DLL via REGSVR32.EXE

      • map_setup.tmp (PID: 2056)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • map_setup.tmp (PID: 2056)
      • map_setup.exe (PID: 2368)
      • map_setup.exe (PID: 972)

    • Process drops legitimate windows executable

      • map_setup.tmp (PID: 2056)

    • Reads the Windows owner or organization settings

      • map_setup.tmp (PID: 2056)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 2852)
      • regsvr32.exe (PID: 3668)
      • regsvr32.exe (PID: 3200)
      • regsvr32.exe (PID: 3248)
      • regsvr32.exe (PID: 3304)

    • The process drops C-runtime libraries

      • map_setup.tmp (PID: 2056)

    • Application launched itself

      • Purchase Order Pending Quantity.exe (PID: 3536)

  • INFO

    • Create files in a temporary directory

      • map_setup.exe (PID: 2368)
      • map_setup.exe (PID: 972)
      • map_setup.tmp (PID: 2056)
      • ShellExt.exe (PID: 3232)
      • mail_pot.exe (PID: 3384)

    • Reads the computer name

      • map_setup.tmp (PID: 1596)
      • map_setup.tmp (PID: 2056)
      • Purchase Order Pending Quantity.exe (PID: 1612)
      • Purchase Order Pending Quantity.exe (PID: 3536)
      • fakeDNS.exe (PID: 2928)
      • Purchase Order Pending Quantity.exe (PID: 2584)
      • Purchase Order Pending Quantity.exe (PID: 3560)
      • Purchase Order Pending Quantity.exe (PID: 2440)
      • Purchase Order Pending Quantity.exe (PID: 2276)
      • Purchase Order Pending Quantity.exe (PID: 2612)

    • Checks supported languages

      • map_setup.tmp (PID: 1596)
      • map_setup.tmp (PID: 2056)
      • map_setup.exe (PID: 972)
      • map_setup.exe (PID: 2368)
      • ShellExt.exe (PID: 3232)
      • fakeDNS.exe (PID: 2928)
      • Purchase Order Pending Quantity.exe (PID: 3536)
      • Purchase Order Pending Quantity.exe (PID: 1612)
      • mail_pot.exe (PID: 3384)
      • Purchase Order Pending Quantity.exe (PID: 2440)
      • Purchase Order Pending Quantity.exe (PID: 2276)
      • Purchase Order Pending Quantity.exe (PID: 2612)
      • Purchase Order Pending Quantity.exe (PID: 2584)
      • Purchase Order Pending Quantity.exe (PID: 3560)

    • Manual execution by a user

      • map_setup.exe (PID: 2368)
      • explorer.exe (PID: 3068)
      • cmd.exe (PID: 780)
      • Purchase Order Pending Quantity.exe (PID: 3536)
      • Purchase Order Pending Quantity.exe (PID: 1612)
      • fakeDNS.exe (PID: 2928)
      • mail_pot.exe (PID: 3384)
      • Purchase Order Pending Quantity.exe (PID: 3560)
      • Purchase Order Pending Quantity.exe (PID: 2440)
      • Purchase Order Pending Quantity.exe (PID: 2612)
      • Purchase Order Pending Quantity.exe (PID: 2584)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2840)

    • Compiled with Borland Delphi (YARA)

      • map_setup.tmp (PID: 1596)
      • map_setup.tmp (PID: 2056)

    • Detects InnoSetup installer (YARA)

      • map_setup.exe (PID: 972)
      • map_setup.exe (PID: 2368)
      • map_setup.tmp (PID: 1596)
      • map_setup.tmp (PID: 2056)

    • The sample compiled with english language support

      • map_setup.tmp (PID: 2056)
      • map_setup.exe (PID: 2368)
      • map_setup.exe (PID: 972)

    • Creates files in the program directory

      • map_setup.tmp (PID: 2056)

    • Reads mouse settings

      • regsvr32.exe (PID: 3668)
      • mail_pot.exe (PID: 3384)

    • Creates a software uninstall entry

      • map_setup.tmp (PID: 2056)

    • Reads the machine GUID from the registry

      • ShellExt.exe (PID: 3232)
      • mail_pot.exe (PID: 3384)
      • Purchase Order Pending Quantity.exe (PID: 3536)
      • Purchase Order Pending Quantity.exe (PID: 1612)
      • Purchase Order Pending Quantity.exe (PID: 3560)
      • Purchase Order Pending Quantity.exe (PID: 2440)
      • Purchase Order Pending Quantity.exe (PID: 2276)
      • Purchase Order Pending Quantity.exe (PID: 2584)
      • Purchase Order Pending Quantity.exe (PID: 2612)

    • Reads Microsoft Office registry keys

      • mail_pot.exe (PID: 3384)

    • Reads Environment values

      • fakeDNS.exe (PID: 2928)
      • Purchase Order Pending Quantity.exe (PID: 2276)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2021:11:28 19:55:50
ZipCRC: 0x3c9fb4fe
ZipCompressedSize: 523751
ZipUncompressedSize: 557056
ZipFileName: Purchase Order Pending Quantity.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
79
Monitored processes
30
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe map_setup.exe map_setup.tmp no specs map_setup.exe map_setup.tmp regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs shellext.exe no specs explorer.exe no specs fakedns.exe no specs mail_pot.exe no specs Network Common Connections Ui no specs cmd.exe no specs ping.exe no specs purchase order pending quantity.exe no specs purchase order pending quantity.exe purchase order pending quantity.exe no specs purchase order pending quantity.exe no specs purchase order pending quantity.exe no specs purchase order pending quantity.exe no specs purchase order pending quantity.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
780"C:\Windows\system32\cmd.exe" C:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
3221225547
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
972"C:\Users\admin\Desktop\map_setup.exe" /SPAWNWND=$3018A /NOTIFYWND=$3017C C:\Users\admin\Desktop\map_setup.exe
map_setup.tmp
User:
admin
Company:
Integrity Level:
HIGH
Description:
Malcode Analyst Pack Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\desktop\map_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
1596"C:\Users\admin\AppData\Local\Temp\is-A1IRP.tmp\map_setup.tmp" /SL5="$3017C,5995619,53248,C:\Users\admin\Desktop\map_setup.exe" C:\Users\admin\AppData\Local\Temp\is-A1IRP.tmp\map_setup.tmp—map_setup.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.49.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-a1irp.tmp\map_setup.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
1612"C:\Users\admin\Desktop\Purchase Order Pending Quantity.exe" C:\Users\admin\Desktop\Purchase Order Pending Quantity.exe
explorer.exe
User:
admin
Company:
Earthworks Garden Kare
Integrity Level:
HIGH
Description:
WpfClassProject
Exit code:
4294967295
Version:
5.4.0.0
Modules
Images
c:\users\admin\desktop\purchase order pending quantity.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2056"C:\Users\admin\AppData\Local\Temp\is-80GRE.tmp\map_setup.tmp" /SL5="$4018C,5995619,53248,C:\Users\admin\Desktop\map_setup.exe" /SPAWNWND=$3018A /NOTIFYWND=$3017C C:\Users\admin\AppData\Local\Temp\is-80GRE.tmp\map_setup.tmp
map_setup.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.49.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-80gre.tmp\map_setup.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
2276"C:\Users\admin\Desktop\Purchase Order Pending Quantity.exe"C:\Users\admin\Desktop\Purchase Order Pending Quantity.exe—Purchase Order Pending Quantity.exe
User:
admin
Company:
Earthworks Garden Kare
Integrity Level:
MEDIUM
Description:
WpfClassProject
Version:
5.4.0.0
Modules
Images
c:\users\admin\desktop\purchase order pending quantity.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2368"C:\Users\admin\Desktop\map_setup.exe" C:\Users\admin\Desktop\map_setup.exe
explorer.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Malcode Analyst Pack Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\desktop\map_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
2440"C:\Users\admin\Desktop\Purchase Order Pending Quantity.exe" C:\Users\admin\Desktop\Purchase Order Pending Quantity.exe—explorer.exe
User:
admin
Company:
Earthworks Garden Kare
Integrity Level:
MEDIUM
Description:
WpfClassProject
Exit code:
4294967295
Version:
5.4.0.0
Modules
Images
c:\users\admin\desktop\purchase order pending quantity.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2584"C:\Users\admin\Desktop\Purchase Order Pending Quantity.exe" C:\Users\admin\Desktop\Purchase Order Pending Quantity.exe—explorer.exe
User:
admin
Company:
Earthworks Garden Kare
Integrity Level:
MEDIUM
Description:
WpfClassProject
Exit code:
4294967295
Version:
5.4.0.0
Modules
Images
c:\users\admin\desktop\purchase order pending quantity.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2612"C:\Users\admin\Desktop\Purchase Order Pending Quantity.exe" C:\Users\admin\Desktop\Purchase Order Pending Quantity.exe—explorer.exe
User:
admin
Company:
Earthworks Garden Kare
Integrity Level:
MEDIUM
Description:
WpfClassProject
Version:
5.4.0.0
Modules
Images
c:\users\admin\desktop\purchase order pending quantity.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
11 163
Read events
10 728
Write events
289
Delete events
146

Modification events

(PID) Process:(2840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2840) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(2840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(2840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Purchase Order Pending Quantity.zip
(PID) Process:(2840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
91
Suspicious files
39
Text files
2 962
Unknown types
0

Dropped files

PID
Process
Filename
Type
2056map_setup.tmpC:\Sandsprite\MAP\is-SS3J8.tmpexecutable
MD5:F92285603B19A4928AF4B0B7CD5F2403
SHA256:6A23972E1C391BA2DADA01FEABCB7CDC8DF2DD3FCA80D7373DF08BE96B5D7A43
2056map_setup.tmpC:\Windows\vbUtypes.dllexecutable
MD5:EF09271336B4B2BF5846929CF0DA8623
SHA256:81776AA16A70F102E0F4BCF43713BE0BB4C09CD37086C091F91533EB6F2CFDF5
2056map_setup.tmpC:\Windows\is-MJCA9.tmpexecutable
MD5:473DB5D8A5FC1FB4B5A435BCA597C3A9
SHA256:81167418607AFD06660578E33E03995C49EA9BC29DB9095846B1022E5212F64A
2056map_setup.tmpC:\Windows\sppe3.dllexecutable
MD5:473DB5D8A5FC1FB4B5A435BCA597C3A9
SHA256:81167418607AFD06660578E33E03995C49EA9BC29DB9095846B1022E5212F64A
2056map_setup.tmpC:\Users\admin\AppData\Local\Temp\is-LF0UQ.tmp\_isetup\_shfoldr.dllexecutable
MD5:92DC6EF532FBB4A5C3201469A5B5EB63
SHA256:9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
972map_setup.exeC:\Users\admin\AppData\Local\Temp\is-80GRE.tmp\map_setup.tmpexecutable
MD5:9E30AB5E3F6B43F69F928E6B4FCFD604
SHA256:AFFBE7F0320F9602D8C51468ECB7BC7960DF4F62AB1A36C05AC2FE2816D175BA
2056map_setup.tmpC:\Users\admin\AppData\Local\Temp\is-LF0UQ.tmp\_isetup\_RegDLL.tmpexecutable
MD5:C594B792B9C556EA62A30DE541D2FB03
SHA256:5DCC1E0A197922907BCA2C4369F778BD07EE4B1BBBDF633E987A028A314D548E
2056map_setup.tmpC:\Windows\UTypes.dllexecutable
MD5:938945FCDB2D6A799D469F1290D55627
SHA256:3E8023501A9960A37BD8237E4497072E1A3C187BD3581D4ABCE9E10136993B56
2056map_setup.tmpC:\Windows\System32\MSWINSCK.OCXexecutable
MD5:E8A2190A9E8EE5E5D2E0B599BBF9DDA6
SHA256:80AB0B86DE58A657956B2A293BD9957F78E37E7383C86D6CD142208C153B6311
2056map_setup.tmpC:\Windows\is-GBTQF.tmpexecutable
MD5:764340407F32F1DE12C1388E3948C2BC
SHA256:766D9C112CE4D56C6BF80DC96110CFCC562D1F39D2730D7D863EFF01CE45226D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
5
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.110
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Purchase Order Pending Quantity.zip