| File name: | Release.zip |
| Full analysis: | https://app.any.run/tasks/856f8a49-c962-4ea3-981b-496c7bf77aa1 |
| Verdict: | Malicious activity |
| Analysis date: | July 07, 2025, 20:11:45 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v2.0 to extract, compression method=store |
| MD5: | D459FA0623C351FCFE2FE0415F8A6931 |
| SHA1: | 611305EB6F6475CC9CFC4C770AEEDCCE31E91441 |
| SHA256: | CC8DBF584846F175A7B619D2C6F47146D7A9285B85F4ED0C073159BCE2678FB7 |
| SSDEEP: | 49152:4MKx5rVr9/42M88Ke0bzwFPuoxR6KWReICzrQ9lW6Z3rohDZDG9n4Hr9CYc3zgVf:VKTVr9/RuFPuYgKWRebzrQ9lW6hriDZN |
MALICIOUS
Generic archive extractor
- WinRAR.exe (PID: 7156)
SUSPICIOUS
Application launched itself
- WinRAR.exe (PID: 7156)
Reads security settings of Internet Explorer
- WinRAR.exe (PID: 7156)
Starts POWERSHELL.EXE for commands execution
- cmd.exe (PID: 4724)
INFO
Script raised an exception (POWERSHELL)
- powershell.exe (PID: 2780)
- powershell.exe (PID: 1760)
- powershell.exe (PID: 5900)
- powershell.exe (PID: 6876)
- powershell.exe (PID: 2064)
- powershell.exe (PID: 6284)
- powershell.exe (PID: 4644)
- powershell.exe (PID: 2348)
- powershell.exe (PID: 1984)
- powershell.exe (PID: 3564)
- powershell.exe (PID: 3608)
Executable content was dropped or overwritten
- WinRAR.exe (PID: 3396)
Manual execution by a user
- cmd.exe (PID: 4724)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .zip | | | ZIP compressed archive (100) |
|---|
EXIF
ZIP
| ZipRequiredVersion: | 20 |
|---|---|
| ZipBitFlag: | - |
| ZipCompression: | None |
| ZipModifyDate: | 2025:07:07 22:10:40 |
| ZipCRC: | 0x00000000 |
| ZipCompressedSize: | - |
| ZipUncompressedSize: | - |
| ZipFileName: | Release/ |
Total processes
165
Monitored processes
28
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 188 | powershell -command "$path='C:\Windows\System32\ApplicationFrameHost.exe'; $bytes = [System.IO.File]::ReadAllBytes($path); if ($bytes[0x3c..0x3f] -eq 0x4d,0x5a,0x90,0x00) { $zone = $path+'.manifest'; $xml = '<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="requireAdministrator" uiAccess="false"/></requestedPrivileges></security></trustInfo></assembly>'; [System.IO.File]::WriteAllText($zone, $xml); }" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows PowerShell Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1480 | powershell -command "$path='C:\Windows\System32\appidtel.exe'; $bytes = [System.IO.File]::ReadAllBytes($path); if ($bytes[0x3c..0x3f] -eq 0x4d,0x5a,0x90,0x00) { $zone = $path+'.manifest'; $xml = '<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="requireAdministrator" uiAccess="false"/></requestedPrivileges></security></trustInfo></assembly>'; [System.IO.File]::WriteAllText($zone, $xml); }" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows PowerShell Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1760 | powershell -command "$p = 'C:\Windows\System32\AppHostRegistrationVerifier.exe'; $s = Get-Item $p; $s = $s.GetType().InvokeMember('SetAccessControl', 'InvokeMethod', $null, $s, @()); $acl = $s.GetAccessControl(); $rule = New-Object System.Security.AccessControl.FileSystemAccessRule('Everyone','FullControl','Allow'); $acl.AddAccessRule($rule); $s.SetAccessControl($acl);" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows PowerShell Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1984 | powershell -command "$p = 'C:\Windows\System32\AggregatorHost.exe'; $s = Get-Item $p; $s = $s.GetType().InvokeMember('SetAccessControl', 'InvokeMethod', $null, $s, @()); $acl = $s.GetAccessControl(); $rule = New-Object System.Security.AccessControl.FileSystemAccessRule('Everyone','FullControl','Allow'); $acl.AddAccessRule($rule); $s.SetAccessControl($acl);" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows PowerShell Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2064 | powershell -command "$p = 'C:\Windows\System32\appidcertstorecheck.exe'; $s = Get-Item $p; $s = $s.GetType().InvokeMember('SetAccessControl', 'InvokeMethod', $null, $s, @()); $acl = $s.GetAccessControl(); $rule = New-Object System.Security.AccessControl.FileSystemAccessRule('Everyone','FullControl','Allow'); $acl.AddAccessRule($rule); $s.SetAccessControl($acl);" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows PowerShell Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2348 | powershell -command "$path='C:\Windows\System32\AggregatorHost.exe'; $bytes = [System.IO.File]::ReadAllBytes($path); if ($bytes[0x3c..0x3f] -eq 0x4d,0x5a,0x90,0x00) { $zone = $path+'.manifest'; $xml = '<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="requireAdministrator" uiAccess="false"/></requestedPrivileges></security></trustInfo></assembly>'; [System.IO.File]::WriteAllText($zone, $xml); }" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows PowerShell Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2348 | powershell -command "$p = 'C:\Windows\System32\appidtel.exe'; $s = Get-Item $p; $s = $s.GetType().InvokeMember('SetAccessControl', 'InvokeMethod', $null, $s, @()); $acl = $s.GetAccessControl(); $rule = New-Object System.Security.AccessControl.FileSystemAccessRule('Everyone','FullControl','Allow'); $acl.AddAccessRule($rule); $s.SetAccessControl($acl);" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows PowerShell Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2468 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2716 | powershell -command "$path='C:\Windows\System32\ApplySettingsTemplateCatalog.exe'; $bytes = [System.IO.File]::ReadAllBytes($path); if ($bytes[0x3c..0x3f] -eq 0x4d,0x5a,0x90,0x00) { $zone = $path+'.manifest'; $xml = '<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="requireAdministrator" uiAccess="false"/></requestedPrivileges></security></trustInfo></assembly>'; [System.IO.File]::WriteAllText($zone, $xml); }" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows PowerShell Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2780 | powershell -command "$p = 'C:\Windows\System32\alg.exe'; $s = Get-Item $p; $s = $s.GetType().InvokeMember('SetAccessControl', 'InvokeMethod', $null, $s, @()); $acl = $s.GetAccessControl(); $rule = New-Object System.Security.AccessControl.FileSystemAccessRule('Everyone','FullControl','Allow'); $acl.AddAccessRule($rule); $s.SetAccessControl($acl);" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows PowerShell Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
97 305
Read events
97 258
Write events
34
Delete events
13
Modification events
| (PID) Process: | (7156) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 3 |
Value: C:\Users\admin\Desktop\preferences.zip | |||
| (PID) Process: | (7156) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\chromium_ext.zip | |||
| (PID) Process: | (7156) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\omni_23_10_2024_.zip | |||
| (PID) Process: | (7156) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\Release.zip | |||
| (PID) Process: | (7156) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (7156) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (7156) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (7156) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (7156) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (7156) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
Executable files
1
Suspicious files
1
Text files
46
Unknown types
1
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3564 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_hmsi1ejf.e3t.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 6148 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_mbcgmc5x.1d0.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 6748 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_qfpcpvut.ioa.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 3396 | WinRAR.exe | C:\Release\Temp base.pdb | pdb | |
MD5:867A1DC4F02CCA4DAD5079BCDE20EA76 | SHA256:E2FE782E0BEA795FDD1B25730CE2A649DA9D0FDA21B6FF4F798E607A6D81CB44 | |||
| 4644 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_sukdtjg0.vqf.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 3396 | WinRAR.exe | C:\Release\imgui.ini | text | |
MD5:9B1539431B2AD1B386B275252E9CCE51 | SHA256:24CB6F9AB027B03A7CB0D155FF245C37A55C17C525AD3D3A6C4351B4FEFB6AD7 | |||
| 1984 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_1vspc11i.kyu.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 6748 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ixsckzy3.2hx.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 4644 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ztilduwx.ajw.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 3396 | WinRAR.exe | C:\Release\fixx.bat | text | |
MD5:AD1DA5F03DEBA7EE38B7100BA4442C1D | SHA256:C3C5C3BB12897557C09833858860AFC6B0C5A6E89757FBF9BA6083C090A1F4E0 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
22
DNS requests
17
Threats
1
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1268 | svchost.exe | GET | 200 | 23.48.23.180:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
1268 | svchost.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
4168 | svchost.exe | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
5348 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
5348 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
5944 | MoUsoCoreWorker.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
1268 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4832 | RUXIMICS.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
1268 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
1268 | svchost.exe | 23.48.23.180:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
1268 | svchost.exe | 184.30.21.171:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
4168 | svchost.exe | 20.190.160.3:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4168 | svchost.exe | 2.17.190.73:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
nexusrules.officeapps.live.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | Unknown Traffic | ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW) |