File name:

SQL Injector v1.03 + MD5 Hash Decryptor (PREMIUM).7z

Full analysis: https://app.any.run/tasks/ad117eef-cd5d-410b-9f5b-7719994cdf98
Verdict: Malicious activity
Analysis date: March 30, 2024, 11:37:11
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

60492AD4233F7F1FFE92D84F8FB7F42B

SHA1:

13F66996505062FC343D21843FC2A382728D8365

SHA256:

D46CA596437C9D1378EE83E00C8E923591AA03CD611CB6150B07B08413570607

SSDEEP:

98304:rBbJqZjoY0tv3EuKORyduS5fqJPfMZomIXaaKg0CviM:rBlq8F3/KAydVjZUXa5gF/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • w36y2M0QX7.exe (PID: 748)
      • WinRAR.exe (PID: 2120)
      • MD5 Hash Decryptor.exe (PID: 2960)
      • w36y2M0QX7.exe (PID: 1792)
      • cmd.exe (PID: 2984)

    • Adds path to the Windows Defender exclusion list

      • MD5 Hash Decryptor.exe (PID: 2960)

  • SUSPICIOUS

    • Executed via WMI

      • schtasks.exe (PID: 3324)
      • schtasks.exe (PID: 2724)
      • schtasks.exe (PID: 2744)
      • schtasks.exe (PID: 2788)
      • schtasks.exe (PID: 1308)
      • schtasks.exe (PID: 1772)
      • schtasks.exe (PID: 2240)
      • schtasks.exe (PID: 1844)
      • schtasks.exe (PID: 880)
      • schtasks.exe (PID: 568)
      • schtasks.exe (PID: 1848)
      • schtasks.exe (PID: 680)
      • schtasks.exe (PID: 3556)
      • schtasks.exe (PID: 1780)
      • schtasks.exe (PID: 1404)
      • schtasks.exe (PID: 3520)
      • schtasks.exe (PID: 2020)
      • schtasks.exe (PID: 316)
      • schtasks.exe (PID: 2588)
      • schtasks.exe (PID: 2568)
      • schtasks.exe (PID: 552)
      • schtasks.exe (PID: 2584)
      • schtasks.exe (PID: 2640)
      • schtasks.exe (PID: 2348)
      • schtasks.exe (PID: 984)
      • schtasks.exe (PID: 1036)
      • schtasks.exe (PID: 1216)
      • schtasks.exe (PID: 1592)
      • schtasks.exe (PID: 3172)
      • schtasks.exe (PID: 3260)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 2120)
      • MD5 Hash Decryptor.exe (PID: 2960)
      • w36y2M0QX7.exe (PID: 748)
      • w36y2M0QX7.exe (PID: 1792)
      • cmd.exe (PID: 2984)

    • Starts CMD.EXE for commands execution

      • MD5 Hash Decryptor.exe (PID: 2960)
      • w36y2M0QX7.exe (PID: 748)

    • The process creates files with name similar to system file names

      • w36y2M0QX7.exe (PID: 748)
      • w36y2M0QX7.exe (PID: 1792)

    • The executable file from the user directory is run by the CMD process

      • w36y2M0QX7.exe (PID: 1792)

    • Executing commands from a ".bat" file

      • w36y2M0QX7.exe (PID: 748)

    • Reads the Internet Settings

      • MD5 Hash Decryptor.exe (PID: 2960)
      • w36y2M0QX7.exe (PID: 748)
      • w36y2M0QX7.exe (PID: 1792)
      • cmd.exe (PID: 2984)

    • Probably delay the execution using 'w32tm.exe'

      • cmd.exe (PID: 3028)

    • Starts itself from another location

      • w36y2M0QX7.exe (PID: 1792)

    • The process executes VB scripts

      • cmd.exe (PID: 2984)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • wscript.exe (PID: 4092)
      • wscript.exe (PID: 1172)

    • Uses WMI to retrieve WMI-managed resources (SCRIPT)

      • wscript.exe (PID: 4092)

    • Checks whether a specific file exists (SCRIPT)

      • wscript.exe (PID: 1172)

    • Executes WMI query (SCRIPT)

      • wscript.exe (PID: 4092)

  • INFO

    • Reads the machine GUID from the registry

      • w36y2M0QX7.exe (PID: 748)
      • w36y2M0QX7.exe (PID: 1792)
      • cmd.exe (PID: 2984)

    • Reads the computer name

      • MD5 Hash Decryptor.exe (PID: 2960)
      • w36y2M0QX7.exe (PID: 748)
      • SQL Injector Premium v1.03.exe (PID: 3092)
      • w36y2M0QX7.exe (PID: 1792)
      • cmd.exe (PID: 2984)

    • Creates files in the program directory

      • w36y2M0QX7.exe (PID: 748)
      • w36y2M0QX7.exe (PID: 1792)

    • Checks supported languages

      • SQL Injector Premium v1.03.exe (PID: 3092)
      • w36y2M0QX7.exe (PID: 748)
      • MD5 Hash Decryptor.exe (PID: 2960)
      • w36y2M0QX7.exe (PID: 1792)
      • cmd.exe (PID: 2984)

    • Reads Environment values

      • w36y2M0QX7.exe (PID: 748)
      • w36y2M0QX7.exe (PID: 1792)
      • cmd.exe (PID: 2984)

    • Create files in a temporary directory

      • SQL Injector Premium v1.03.exe (PID: 3092)
      • w36y2M0QX7.exe (PID: 748)
      • cmd.exe (PID: 2984)

    • Creates files or folders in the user directory

      • MD5 Hash Decryptor.exe (PID: 2960)

    • Reads product name

      • w36y2M0QX7.exe (PID: 748)
      • w36y2M0QX7.exe (PID: 1792)
      • cmd.exe (PID: 2984)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
85
Monitored processes
43
Malicious processes
7
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe no specs sql injector premium v1.03.exe no specs md5 hash decryptor.exe no specs md5 hash decryptor.exe cmd.exe no specs cmd.exe no specs w36y2m0qx7.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs cmd.exe no specs w32tm.exe no specs w36y2m0qx7.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs cmd.exe no specs wscript.exe no specs wscript.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2120"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\SQL Injector v1.03 + MD5 Hash Decryptor (PREMIUM).7z"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3092"C:\Users\admin\AppData\Local\Temp\Rar$EXa2120.13974\SQL Injector v1.03 + MD5 Hash Decryptor (PREMIUM)\SQL Injector Premium v1.03.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2120.13974\SQL Injector v1.03 + MD5 Hash Decryptor (PREMIUM)\SQL Injector Premium v1.03.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2120.13974\sql injector v1.03 + md5 hash decryptor (premium)\sql injector premium v1.03.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
4044"C:\Users\admin\AppData\Local\Temp\Rar$EXa2120.16387\SQL Injector v1.03 + MD5 Hash Decryptor (PREMIUM)\MD5 Hash Decryptor.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2120.16387\SQL Injector v1.03 + MD5 Hash Decryptor (PREMIUM)\MD5 Hash Decryptor.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2120.16387\sql injector v1.03 + md5 hash decryptor (premium)\md5 hash decryptor.exe
c:\windows\system32\ntdll.dll
2960"C:\Users\admin\AppData\Local\Temp\Rar$EXa2120.16387\SQL Injector v1.03 + MD5 Hash Decryptor (PREMIUM)\MD5 Hash Decryptor.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2120.16387\SQL Injector v1.03 + MD5 Hash Decryptor (PREMIUM)\MD5 Hash Decryptor.exe
WinRAR.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2120.16387\sql injector v1.03 + md5 hash decryptor (premium)\md5 hash decryptor.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3724"C:\Windows\System32\cmd.exe" powershell.exe Add-MpPreference -ExclusionPath "C:\Users\admin\AppData\Roaming"C:\Windows\System32\cmd.exe—MD5 Hash Decryptor.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1656"C:\Windows\System32\cmd.exe" powershell.exe Add-MpPreference -ExclusionPath C:\C:\Windows\System32\cmd.exe—MD5 Hash Decryptor.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
748"C:\Users\admin\AppData\Roaming\w36y2M0QX7.exe" C:\Users\admin\AppData\Roaming\w36y2M0QX7.exe—MD5 Hash Decryptor.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
1.1.1o
Modules
Images
c:\users\admin\appdata\roaming\w36y2m0qx7.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3324schtasks.exe /create /tn "SQL Injector Premium v1.03S" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows NT\TableTextService\en-US\SQL Injector Premium v1.03.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2724schtasks.exe /create /tn "SQL Injector Premium v1.03" /sc ONLOGON /tr "'C:\Program Files\Windows NT\TableTextService\en-US\SQL Injector Premium v1.03.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2744schtasks.exe /create /tn "SQL Injector Premium v1.03S" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows NT\TableTextService\en-US\SQL Injector Premium v1.03.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
Total events
16 282
Read events
16 200
Write events
82
Delete events
0

Modification events

(PID) Process:(2120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2120) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(2120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(2120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\SQL Injector v1.03 + MD5 Hash Decryptor (PREMIUM).7z
(PID) Process:(2120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
21
Suspicious files
0
Text files
32
Unknown types
0

Dropped files

PID
Process
Filename
Type
2120WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2120.13974\SQL Injector v1.03 + MD5 Hash Decryptor (PREMIUM)\build\build.cfgtext
MD5:—
SHA256:—
2120WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2120.13974\SQL Injector v1.03 + MD5 Hash Decryptor (PREMIUM)\build\form1.button1.OnMouseDown.phptext
MD5:—
SHA256:—
2120WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2120.13974\SQL Injector v1.03 + MD5 Hash Decryptor (PREMIUM)\build\form1.button3.OnClick.phptext
MD5:—
SHA256:—
2120WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2120.13974\SQL Injector v1.03 + MD5 Hash Decryptor (PREMIUM)\build\form1.timer1.OnTimer.phptext
MD5:—
SHA256:—
2120WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2120.13974\SQL Injector v1.03 + MD5 Hash Decryptor (PREMIUM)\build\icon.icoimage
MD5:—
SHA256:—
2120WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2120.13974\SQL Injector v1.03 + MD5 Hash Decryptor (PREMIUM)\build\sql.button1.OnClick.phptext
MD5:—
SHA256:—
2120WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2120.13974\SQL Injector v1.03 + MD5 Hash Decryptor (PREMIUM)\Form1.dfmtext
MD5:—
SHA256:—
2120WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2120.13974\SQL Injector v1.03 + MD5 Hash Decryptor (PREMIUM)\INSTRUCTIONS (HOW TO LAUNCH).txttext
MD5:—
SHA256:—
2120WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2120.13974\SQL Injector v1.03 + MD5 Hash Decryptor (PREMIUM)\Login.dfmtext
MD5:—
SHA256:—
2120WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2120.13974\SQL Injector v1.03 + MD5 Hash Decryptor (PREMIUM)\php.initext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
unknown
—
—
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
SQL Injector v1.03 + MD5 Hash Decryptor (PREMIUM).7z