File name:

.crdownload

Full analysis: https://app.any.run/tasks/b8f97b54-724a-412c-ad9d-0a0b04d2c7fd
Verdict: Malicious activity
Analysis date: December 09, 2024, 14:30:57
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
arch-doc
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

B77B39C881C3D159A5041DB48702E262

SHA1:

E68446FF24594389894725F78948CC9168F25C75

SHA256:

BF791A2F43CE7856AD76C87F06CB323735A92ACB1A4F17F4C5A6EA93A973AB19

SSDEEP:

393216:DftZbByPqUuTwsmaIQCGW11pbESZaO2Dh1uswrCGj9I4A1TdD:pp4lds3IQCGi1mSZa1Dh1uswZWp1V

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 5096)

    • Antivirus name has been found in the command line (generic signature)

      • MpCmdRun.exe (PID: 3820)

  • SUSPICIOUS

    • Drops a system driver (possible attempt to evade defenses)

      • WinRAR.exe (PID: 5096)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 5096)

    • Starts CMD.EXE for commands execution

      • WinRAR.exe (PID: 5096)

    • Executing commands from a ".bat" file

      • WinRAR.exe (PID: 5096)

  • INFO

    • Manual execution by a user

      • install-filter.exe (PID: 4400)
      • rundll32.exe (PID: 3744)
      • OpenWith.exe (PID: 204)
      • notepad.exe (PID: 3612)

    • Checks supported languages

      • install-filter.exe (PID: 4400)
      • MpCmdRun.exe (PID: 3820)

    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 3612)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 5096)

    • Reads Microsoft Office registry keys

      • OpenWith.exe (PID: 204)

    • The process uses the downloaded file

      • WinRAR.exe (PID: 5096)

    • Reads the computer name

      • MpCmdRun.exe (PID: 3820)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)

EXIF

ZIP

FileVersion: 7z v0.04
ModifyDate: 2024:05:21 20:18:48+00:00
ArchivedFileName: data
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
117
Monitored processes
9
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe install-filter.exe no specs conhost.exe no specs notepad.exe no specs rundll32.exe no specs openwith.exe no specs cmd.exe no specs conhost.exe no specs mpcmdrun.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
204"C:\WINDOWS\System32\OpenWith.exe" C:\Users\admin\Desktop\8ae23cbdd3b5f3ee9037c7377ffa2dad8bf7c036.binC:\Windows\System32\OpenWith.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Exit code:
2147943623
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
2408\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—install-filter.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3524\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3612"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\Radme.txtC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
3744"C:\WINDOWS\System32\rundll32.exe" "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\admin\Desktop\SamFlash.jpgC:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
3820"C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\admin\AppData\Local\Temp\Rar$VR5096.982"C:\Program Files\Windows Defender\MpCmdRun.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Malware Protection Command Line Utility
Exit code:
2
Version:
4.18.1909.6 (WinBuild.160101.0800)
Modules
Images
c:\program files\windows defender\mpcmdrun.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
4400"C:\Users\admin\Desktop\install-filter.exe" C:\Users\admin\Desktop\install-filter.exe—explorer.exe
User:
admin
Company:
http://libusb-win32.sourceforge.net
Integrity Level:
MEDIUM
Description:
libusb-win32 - Install-Filter
Exit code:
4294967295
Version:
1.2.6.0
Modules
Images
c:\users\admin\desktop\install-filter.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
5096"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\b8f97b54-724a-412c-ad9d-0a0b04d2c7fd.7zC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
5888C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\Rar$VR5096.982\Rar$Scan14626.bat" "C:\Windows\System32\cmd.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
Total events
2 928
Read events
2 919
Write events
9
Delete events
0

Modification events

(PID) Process:(5096) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(5096) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(5096) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(5096) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\b8f97b54-724a-412c-ad9d-0a0b04d2c7fd.7z
(PID) Process:(5096) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(5096) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(5096) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(5096) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(5096) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\VirusScan
Operation:writeName:DefScanner
Value:
Windows Defender
Executable files
12
Suspicious files
12
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
5096WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR5096.982\b8f97b54-724a-412c-ad9d-0a0b04d2c7fd.7z\data\com.apkcompressed
MD5:8EA07466489E3346D473292B1167F1A8
SHA256:0230AC76554C86822131B8B1C63F8C4E125D6F2AA28319E890BB383167E30B92
5096WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR5096.982\b8f97b54-724a-412c-ad9d-0a0b04d2c7fd.7z\data\cam.apkjava
MD5:A8C5B0D86B8DD513BD20F5B9A9606882
SHA256:FE854C096AE40097E867272EBAC8C77C03662B361DD9C2F97223378E1EF443B1
5096WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR5096.982\b8f97b54-724a-412c-ad9d-0a0b04d2c7fd.7z\data\loader\079fc51e57460e4ea9ccc9c98d08ee4728a1109c.bino
MD5:406421ADD08D335160DE789BB1A5D100
SHA256:05AC3FCE76DBD7617D85B47CF322B75D6362EF1FFEB896639ED8B23FC0C11CE5
5096WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR5096.982\b8f97b54-724a-412c-ad9d-0a0b04d2c7fd.7z\data\frp.bino
MD5:E4276F6D395264B80B73D91EA4AE7F3F
SHA256:E8A17A001D62039B8CBB579E5423D3CD699D933E8BA60B437A0B654681C62F4C
5096WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR5096.982\b8f97b54-724a-412c-ad9d-0a0b04d2c7fd.7z\data\loader\66ff4d4b730cebb967383a650b7cefbd8d681c57.bino
MD5:E3597190D113411E1CBDE6B29D59DA94
SHA256:2107A6F06C1F19FF561B325F81F7D6B9A210C73BC3A77BA664EC841407E22D03
5096WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR5096.982\b8f97b54-724a-412c-ad9d-0a0b04d2c7fd.7z\data\loader\48a2c64ef41761a8d84c9b14b44c5a437f5c2250.bino
MD5:BDDE18137C9684CDF77381F66DBB803A
SHA256:5C41D24178E1C8F5CAFD29789B2391D97966C0F12CCECCF07C087E6CA7C38CC3
5096WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR5096.982\b8f97b54-724a-412c-ad9d-0a0b04d2c7fd.7z\SamFlash.exe —
MD5:—
SHA256:—
5096WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR5096.982\b8f97b54-724a-412c-ad9d-0a0b04d2c7fd.7z\data\loader\27f620d71722f964eb2ccc1c0fb7fcbd48d4e79e.bino
MD5:26120C829CBD2C34FDD9A6CC3E5780CA
SHA256:9AEC3E68331A3CD230DDF878A5A322E4C85812A6F4982B8EC86DF5207C2C6EB6
5096WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR5096.982\b8f97b54-724a-412c-ad9d-0a0b04d2c7fd.7z\data\loader\674ac4a88d37e0cc585f310e53df597d8ad88c43.bino
MD5:4FB68A5169EB4034271D18437F0CFD84
SHA256:EEFB3E649F71237C1E8C370D3C0F0A3D5EC29E9A6D9388522944422702CB6086
5096WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR5096.982\b8f97b54-724a-412c-ad9d-0a0b04d2c7fd.7z\data\loader\58e8fc27a8543e11fd2ccaf98fbe261448bc8aca.bino
MD5:94B32EC7ED7C0A4F57EE91A62694DCA0
SHA256:877B0017F1A17EEEB32C805FA2BD543078946B0F266EBD8CFE0A6C23889DE2CC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
21
DNS requests
7
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1684
svchost.exe
GET
200
2.16.164.18:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.16.164.18:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1684
svchost.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
104.126.37.155:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1684
svchost.exe
2.16.164.18:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4712
MoUsoCoreWorker.exe
2.16.164.18:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
1684
svchost.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4712
MoUsoCoreWorker.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 104.126.37.155
  • 104.126.37.130
  • 104.126.37.139
  • 104.126.37.128
  • 104.126.37.153
  • 104.126.37.152
  • 104.126.37.146
  • 104.126.37.154
  • 104.126.37.136
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.124.78.146
whitelisted
google.com
  • 142.250.186.110
whitelisted
crl.microsoft.com
  • 2.16.164.18
  • 2.16.164.114
  • 2.16.164.106
whitelisted
www.microsoft.com
  • 88.221.169.152
whitelisted
self.events.data.microsoft.com
  • 20.42.73.25
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
.crdownload