URL:

https://files.catbox.moe/gj3cze.zip

Full analysis: https://app.any.run/tasks/21896fc2-d041-4537-9d26-d5704730d715
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: April 06, 2024, 11:05:02
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
adware
DownloadAssistant
Indicators:
MD5:

3A15A9F681BC1961C7D8F063AFF0C94A

SHA1:

CFD8C953DCB2C70BDCC9672C3117DAD0C99981F5

SHA256:

CE98D77A3F3A3A64BE088B1C2257DC785369E6AEA5D183124D55E411862B0EAC

SSDEEP:

3:N8MW3pMV:2MWZMV

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • aimware_gUpAgVvtpN.exe (PID: 968)
      • aimware_gUpAgVvtpN.exe (PID: 3444)
      • aimware_gUpAgVvtpN.tmp (PID: 2128)

    • DOWNLOADASSISTANT has been detected (SURICATA)

      • argmusicmanager.exe (PID: 1404)

  • SUSPICIOUS

    • Reads the Windows owner or organization settings

      • aimware_gUpAgVvtpN.tmp (PID: 2128)

    • Process drops legitimate windows executable

      • aimware_gUpAgVvtpN.tmp (PID: 2128)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 2120)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 2120)

    • Manual execution by a user

      • explorer.exe (PID: 2168)
      • aimware_gUpAgVvtpN.exe (PID: 968)
      • WinRAR.exe (PID: 2968)

    • The process uses the downloaded file

      • iexplore.exe (PID: 2120)
      • WinRAR.exe (PID: 2968)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 2968)

    • Checks supported languages

      • aimware_gUpAgVvtpN.exe (PID: 968)
      • aimware_gUpAgVvtpN.tmp (PID: 2384)
      • aimware_gUpAgVvtpN.exe (PID: 3444)
      • aimware_gUpAgVvtpN.tmp (PID: 2128)
      • argmusicmanager.exe (PID: 1404)

    • Create files in a temporary directory

      • aimware_gUpAgVvtpN.exe (PID: 968)
      • aimware_gUpAgVvtpN.exe (PID: 3444)
      • aimware_gUpAgVvtpN.tmp (PID: 2128)

    • Reads the computer name

      • aimware_gUpAgVvtpN.tmp (PID: 2384)
      • aimware_gUpAgVvtpN.tmp (PID: 2128)
      • argmusicmanager.exe (PID: 1404)

    • Creates files or folders in the user directory

      • aimware_gUpAgVvtpN.tmp (PID: 2128)

    • Creates a software uninstall entry

      • aimware_gUpAgVvtpN.tmp (PID: 2128)

    • Reads the machine GUID from the registry

      • argmusicmanager.exe (PID: 1404)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
51
Monitored processes
9
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe explorer.exe no specs winrar.exe no specs aimware_gupagvvtpn.exe no specs aimware_gupagvvtpn.tmp no specs aimware_gupagvvtpn.exe aimware_gupagvvtpn.tmp no specs #DOWNLOADASSISTANT argmusicmanager.exe

Process information

PID
CMD
Path
Indicators
Parent process
968"C:\Users\admin\Downloads\gj3cze\aimware_gUpAgVvtpN.exe" C:\Users\admin\Downloads\gj3cze\aimware_gUpAgVvtpN.exe—explorer.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
ARG Music Manager Setup
Version:
Modules
Images
c:\users\admin\downloads\gj3cze\aimware_gupagvvtpn.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
1404"C:\Users\admin\AppData\Local\ARG Music Manager\argmusicmanager.exe" a5088ccac2240d2f198122353675aef9C:\Users\admin\AppData\Local\ARG Music Manager\argmusicmanager.exe
aimware_gUpAgVvtpN.tmp
User:
admin
Integrity Level:
HIGH
Description:
Chasys Draw IES Converter
Version:
5, 30, 1, 0
Modules
Images
c:\users\admin\appdata\local\arg music manager\argmusicmanager.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2120"C:\Program Files\Internet Explorer\iexplore.exe" "https://files.catbox.moe/gj3cze.zip"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2128"C:\Users\admin\AppData\Local\Temp\is-9GFI2.tmp\aimware_gUpAgVvtpN.tmp" /SL5="$90244,4523108,56832,C:\Users\admin\Downloads\gj3cze\aimware_gUpAgVvtpN.exe" /SPAWNWND=$60268 /NOTIFYWND=$13016C C:\Users\admin\AppData\Local\Temp\is-9GFI2.tmp\aimware_gUpAgVvtpN.tmp—aimware_gUpAgVvtpN.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Version:
51.52.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-9gfi2.tmp\aimware_gupagvvtpn.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
2168"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2384"C:\Users\admin\AppData\Local\Temp\is-04QVL.tmp\aimware_gUpAgVvtpN.tmp" /SL5="$13016C,4523108,56832,C:\Users\admin\Downloads\gj3cze\aimware_gUpAgVvtpN.exe" C:\Users\admin\AppData\Local\Temp\is-04QVL.tmp\aimware_gUpAgVvtpN.tmp—aimware_gUpAgVvtpN.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Version:
51.52.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-04qvl.tmp\aimware_gupagvvtpn.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
2968"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Downloads\gj3cze.zip" C:\Users\admin\Downloads\gj3cze\C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3276"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2120 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3444"C:\Users\admin\Downloads\gj3cze\aimware_gUpAgVvtpN.exe" /SPAWNWND=$60268 /NOTIFYWND=$13016C C:\Users\admin\Downloads\gj3cze\aimware_gUpAgVvtpN.exe
aimware_gUpAgVvtpN.tmp
User:
admin
Company:
Integrity Level:
HIGH
Description:
ARG Music Manager Setup
Version:
Modules
Images
c:\users\admin\downloads\gj3cze\aimware_gupagvvtpn.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
Total events
23 052
Read events
22 916
Write events
108
Delete events
28

Modification events

(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31098898
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31098898
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
12
Suspicious files
6
Text files
6
Unknown types
5

Dropped files

PID
Process
Filename
Type
3276iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:—
SHA256:—
3276iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751binary
MD5:—
SHA256:—
3276iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751binary
MD5:—
SHA256:—
3276iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\gj3cze[1].zipcompressed
MD5:—
SHA256:—
2120iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776binary
MD5:—
SHA256:—
2120iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776binary
MD5:—
SHA256:—
2120iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\urlblockindex[1].binbinary
MD5:—
SHA256:—
2120iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver98A1.tmpxml
MD5:—
SHA256:—
2120iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\versionlist.xmlxml
MD5:—
SHA256:—
2120iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF1183F3C5A3FA9612.TMPbinary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
18
DNS requests
11
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3276
iexplore.exe
GET
304
173.222.108.147:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?92967c53a8c0ec29
unknown
—
—
unknown
3276
iexplore.exe
GET
304
173.222.108.210:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?36ca310eb28aaa33
unknown
—
—
unknown
2120
iexplore.exe
GET
304
2.19.126.137:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?e55f0cb727843010
unknown
—
—
unknown
2120
iexplore.exe
GET
304
2.19.126.163:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?dca56d26e7d9ce15
unknown
—
—
unknown
3276
iexplore.exe
GET
200
104.75.89.31:80
http://x1.c.lencr.org/
unknown
—
—
unknown
2120
iexplore.exe
GET
304
2.19.126.137:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?4ad9b1827f1f75f1
unknown
—
—
unknown
2120
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
1080
svchost.exe
GET
200
2.19.126.137:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?0754c686571bd23f
unknown
—
—
unknown
1404
argmusicmanager.exe
POST
—
172.67.164.12:80
http://soneservice.shop/new/net_api
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3276
iexplore.exe
108.181.20.37:443
files.catbox.moe
TELUS Communications
CA
unknown
3276
iexplore.exe
173.222.108.147:80
ctldl.windowsupdate.com
Akamai International B.V.
CH
unknown
3276
iexplore.exe
173.222.108.210:80
ctldl.windowsupdate.com
Akamai International B.V.
CH
unknown
3276
iexplore.exe
104.75.89.31:80
x1.c.lencr.org
AKAMAI-AS
DE
unknown
2120
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
EDGECAST
US
whitelisted
2120
iexplore.exe
2.19.126.137:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
2120
iexplore.exe
2.19.126.163:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
files.catbox.moe
  • 108.181.20.37
malicious
ctldl.windowsupdate.com
  • 173.222.108.147
  • 173.222.108.210
  • 2.19.126.137
  • 2.19.126.163
whitelisted
x1.c.lencr.org
  • 104.75.89.31
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
soneservice.shop
  • 172.67.164.12
  • 104.21.74.224
unknown

Threats

PID
Process
Class
Message
3276
iexplore.exe
Potentially Bad Traffic
ET INFO Observed File Sharing Service Download Domain (files .catbox .moe in TLS SNI)
3276
iexplore.exe
Potentially Bad Traffic
ET INFO Observed File Sharing Service Download Domain (files .catbox .moe in TLS SNI)
3276
iexplore.exe
Potential Corporate Privacy Violation
POLICY [ANY.RUN] Downloading from a file sharing service is observed
1404
argmusicmanager.exe
Misc activity
ADWARE [ANY.RUN] DownloadAssistant
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://files.catbox.moe/gj3cze.zip