File name:

any run.zip

Full analysis: https://app.any.run/tasks/bccf951c-0c90-4b73-ba91-a44e760ba313
Verdict: Malicious activity
Analysis date: May 20, 2022, 22:00:51
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

D5580C9560F5FF87A09FC6100654D4E4

SHA1:

5F42337E5F30A7D73546BFBB399453D2328E5A8D

SHA256:

C33C4CC5639886BFF516F52872C773EC9D7D15B6CAAE3530753A0458B334C60B

SSDEEP:

196608:XH/djrRJhxwSAGm7eGfp4mFWjsa0e1y8ky+q:XVvfH2lpbafT+q

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Phsyletric.exe (PID: 3364)
      • aramaware.exe (PID: 2928)
      • Phsyletric.exe (PID: 2712)

    • Drops executable file immediately after starts

      • WinRAR.exe (PID: 2972)

  • SUSPICIOUS

    • Checks supported languages

      • WinRAR.exe (PID: 2972)
      • aramaware.exe (PID: 2928)
      • cmd.exe (PID: 1968)
      • Phsyletric.exe (PID: 3364)
      • cmd.exe (PID: 2720)
      • cmd.exe (PID: 2732)
      • cmd.exe (PID: 2712)
      • cmd.exe (PID: 1572)
      • cmd.exe (PID: 1728)
      • cmd.exe (PID: 1544)
      • cmd.exe (PID: 1104)
      • cmd.exe (PID: 2620)
      • cmd.exe (PID: 2544)
      • cmd.exe (PID: 1832)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2972)

    • Reads the computer name

      • WinRAR.exe (PID: 2972)
      • Phsyletric.exe (PID: 3364)

    • Uses REG.EXE to modify Windows registry

      • cmd.exe (PID: 1968)
      • cmd.exe (PID: 2712)

    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 2972)

    • Starts CMD.EXE for commands execution

      • aramaware.exe (PID: 2928)

    • Uses ICACLS.EXE to modify access control list

      • cmd.exe (PID: 1728)
      • cmd.exe (PID: 1544)

  • INFO

    • Checks supported languages

      • reg.exe (PID: 3380)
      • reg.exe (PID: 3316)
      • takeown.exe (PID: 3276)
      • icacls.exe (PID: 2344)
      • icacls.exe (PID: 2324)
      • takeown.exe (PID: 3520)

    • Reads the computer name

      • takeown.exe (PID: 3276)
      • takeown.exe (PID: 3520)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: aramaware.exe
ZipUncompressedSize: 616717
ZipCompressedSize: 186036
ZipCRC: 0x75455c4d
ZipModifyDate: 2022:05:12 13:09:21
ZipCompression: Deflated
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
68
Monitored processes
21
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start drop and start drop and start start winrar.exe aramaware.exe no specs phsyletric.exe no specs phsyletric.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs reg.exe no specs takeown.exe no specs reg.exe no specs takeown.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs icacls.exe no specs icacls.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1104C:\Windows\system32\cmd.exe /c assoc .bat=.htmlC:\Windows\system32\cmd.exe—aramaware.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
5
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1544C:\Windows\system32\cmd.exe /c icacls %WINDIR%\system32\dllcache\logonui.exe /Grant:r %UserName% :F C:\Windows\system32\cmd.exe—aramaware.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
87
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1572C:\Windows\system32\cmd.exe /c assoc .exe=.htmlC:\Windows\system32\cmd.exe—aramaware.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
5
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\cmd.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\gdi32.dll
1728C:\Windows\system32\cmd.exe /c icacls %WINDIR%\system32\logonui.exe /Grant:r %UserName% :F C:\Windows\system32\cmd.exe—aramaware.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
87
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1832C:\Windows\system32\cmd.exe /c del C:\WINDOWS\system32\logonui.exe /s/q C:\Windows\system32\cmd.exe—aramaware.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1968C:\Windows\system32\cmd.exe /c REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /fC:\Windows\system32\cmd.exe—aramaware.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\cmd.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2324icacls C:\Windows\system32\logonui.exe /Grant:r admin :F C:\Windows\system32\icacls.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Exit code:
87
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2344icacls C:\Windows\system32\dllcache\logonui.exe /Grant:r admin :F C:\Windows\system32\icacls.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Exit code:
87
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2544C:\Windows\system32\cmd.exe /c del C:\WINDOWS\system32\dllcache\logonui.exe /s/q C:\Windows\system32\cmd.exe—aramaware.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
2620C:\Windows\system32\cmd.exe /c assoc .vbs=.htmlC:\Windows\system32\cmd.exe—aramaware.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
5
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
1 408
Read events
1 379
Write events
29
Delete events
0

Modification events

(PID) Process:(2972) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2972) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2972) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2972) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2972) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2972) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\any run.zip
(PID) Process:(2972) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2972) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2972) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2972) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
16
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2972WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2972.22510\Sclerosis.exeexecutable
MD5:—
SHA256:—
2972WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2972.22510\Losinium.exeexecutable
MD5:3FAD30EF9BBB47488E86DEFA0F81ACAB
SHA256:69D2AD4DDD61C4B2E6FF350FD87B61DB5DE36218626812E69C4289DE5782CD0C
2972WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2972.22510\aramaware.exeexecutable
MD5:3ACDCDEE17825753CACC8DFD414E57D3
SHA256:82BB1809904786AFC0C13ABEC22A48B320581EC913BF5BBDDDD02FCE05EF77E8
2972WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2972.22510\Holzer.exeexecutable
MD5:C971C68B4E58CCC82802B21AE8488BC7
SHA256:CEDE0B15D88C20BC750B516858F8BF31EE472F6CBD01640840890736C4333CCE
2972WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2972.22510\quantizer.exeexecutable
MD5:1458480CF8803569195F934D47AC7481
SHA256:68D528F9AC891E920449188198A233B71B2860838AF4FB970B9966F941CE82CA
2972WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2972.23287\MEMZ.exeexecutable
MD5:A7BCF7EA8E9F3F36EBFB85B823E39D91
SHA256:3FF64F10603F0330FA2386FF99471CA789391ACE969BD0EC1C1B8CE1B4A6DB42
2972WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2972.22510\MEMZ.exeexecutable
MD5:A7BCF7EA8E9F3F36EBFB85B823E39D91
SHA256:3FF64F10603F0330FA2386FF99471CA789391ACE969BD0EC1C1B8CE1B4A6DB42
2972WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2972.23287\aramaware.exeexecutable
MD5:3ACDCDEE17825753CACC8DFD414E57D3
SHA256:82BB1809904786AFC0C13ABEC22A48B320581EC913BF5BBDDDD02FCE05EF77E8
2972WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2972.23287\Losinium.exeexecutable
MD5:3FAD30EF9BBB47488E86DEFA0F81ACAB
SHA256:69D2AD4DDD61C4B2E6FF350FD87B61DB5DE36218626812E69C4289DE5782CD0C
2972WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2972.23287\Mythlas.exeexecutable
MD5:1BCCDB1CBBDB299F4053DBAB4236DADC
SHA256:E65C793A31137AE75A6F30AE2933BD7CAE74FCD4330B6C8770C14466BC3A878F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
any run.zip