File name:

11182517.zip

Full analysis: https://app.any.run/tasks/015dd60d-0ad4-4b62-89ba-1d001d5c1427
Verdict: Malicious activity
Analysis date: December 11, 2024, 12:22:28
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

0D535B136872AE33D07D5A0B3033B52B

SHA1:

6C541C3148D5E596417499324ED1882503D0E503

SHA256:

D1CD63692388FE83010C2344B9896D8881FE2D9145B193E0D46D68D6B1647377

SSDEEP:

49152:dRvdee19VJv/Z2epyA4t6Ymy8teyePuC1QB/jI8lUSeu9Y/MJHmQrKHdkPTR/Z0u:zvge19/nZ1z4uteye3QRDlU460wQuHGh

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 5128)

    • Executing a file with an untrusted certificate

      • Reminder.exe (PID: 6528)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 5128)

  • INFO

    • The sample compiled with english language support

      • WinRAR.exe (PID: 5128)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 5128)

    • The process uses the downloaded file

      • WinRAR.exe (PID: 5128)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2009:10:23 01:12:38
ZipCRC: 0x5d307c39
ZipCompressedSize: 100625
ZipUncompressedSize: 218408
ZipFileName: DRRC.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
131
Monitored processes
2
Malicious processes
0
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe reminder.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
5128"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\11182517.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
6528"C:\Users\admin\AppData\Local\Temp\Rar$EXa5128.7792\Reminder.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa5128.7792\Reminder.exe—WinRAR.exe
User:
admin
Company:
CyberLink
Integrity Level:
MEDIUM
Description:
UCRD Reminder
Exit code:
1
Version:
5.5.4222
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa5128.7792\reminder.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
Total events
1 956
Read events
1 947
Write events
9
Delete events
0

Modification events

(PID) Process:(5128) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(5128) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(5128) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(5128) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\11182517.zip
(PID) Process:(5128) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(5128) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(5128) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(5128) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(5128) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Viewer
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF9C0000009C0000005C04000085020000
Executable files
4
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
5128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa5128.7792\MUITransfer.dllexecutable
MD5:E0B3BE099E35A65A19D051DCFEB5140D
SHA256:DA3AF887C981E629459C66817BF01DC52DB2DF7D2A0D396F30C7D7903BE70AB8
5128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa5128.7792\DRRC.dllexecutable
MD5:8BC04131284899C49A41A800ED9E607B
SHA256:AE0A5EC03740F8A4DE4AA2EA9E653AACCF94446367E414E60A7D4411C6363E0A
5128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa5128.7792\Reminder.exeexecutable
MD5:00709FBE66779C91CD008EE2ACD93B4D
SHA256:323E65027845BDA9953E48981BC8BF41133A8ACA6C8EFC94154992745EF0A6B1
5128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa5128.7203\MUITransfer.dllexecutable
MD5:E0B3BE099E35A65A19D051DCFEB5140D
SHA256:DA3AF887C981E629459C66817BF01DC52DB2DF7D2A0D396F30C7D7903BE70AB8
5128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa5128.7792\ucrdinfo.datbinary
MD5:56873A862343408C583682DC3DC1BE20
SHA256:DDD5897AB9CFE2915421D3D482215CEA8EBFF3759C26ACA5E50F3DE7891BE7DD
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
33
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3040
svchost.exe
GET
200
23.48.23.166:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
3040
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6604
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7076
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7076
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3040
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3508
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4712
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5064
SearchApp.exe
104.126.37.136:443
www.bing.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3040
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3040
svchost.exe
23.48.23.166:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
3040
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5064
SearchApp.exe
104.126.37.137:443
www.bing.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 4.231.128.59
  • 40.127.240.158
  • 51.124.78.146
whitelisted
www.bing.com
  • 104.126.37.136
  • 104.126.37.137
  • 104.126.37.146
  • 104.126.37.184
  • 104.126.37.144
  • 104.126.37.130
  • 104.126.37.185
  • 104.126.37.128
  • 104.126.37.139
whitelisted
google.com
  • 142.250.184.238
whitelisted
crl.microsoft.com
  • 23.48.23.166
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
login.live.com
  • 20.190.160.22
  • 40.126.32.76
  • 40.126.32.138
  • 20.190.160.20
  • 40.126.32.134
  • 40.126.32.72
  • 40.126.32.136
  • 20.190.160.17
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
go.microsoft.com
  • 23.218.210.69
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
11182517.zip