File name:

MS.Disk.Repair.Tool.zip

Full analysis: https://app.any.run/tasks/5bb6bb01-4fa0-4858-a41e-ca085b230481
Verdict: Malicious activity
Analysis date: September 05, 2025, 21:05:58
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

488554F510F38068FE8E187BD7705D36

SHA1:

89DE9E7D1D4E85D31ABE852F40B5624ED89BBCDC

SHA256:

D4773E2F812F771974BBC35FB7E5068A12286A6DDAB7794C18395DD276D84287

SSDEEP:

24576:6L8VEFnTKqVtJCb31oAvvm1OItdQEnHZFLjoKsidg/CxqAg2Pcr21cL/fsfpyEiN:6L8VEFnewtJ+31oAvvm1OItqEnHZFLjG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • MS.Disk.Repair.Tool.exe (PID: 3100)
      • VGAuthService.exe (PID: 856)
      • WmiPrvSE.exe (PID: 3932)
      • vm3dservice.exe (PID: 440)
      • vmtoolsd.exe (PID: 2384)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 3460)
      • MS.Disk.Repair.Tool.exe (PID: 3100)
      • VGAuthService.exe (PID: 856)
      • WmiPrvSE.exe (PID: 3932)
      • vm3dservice.exe (PID: 440)

    • Starts a Microsoft application from unusual location

      • MS.Disk.Repair.Tool.exe (PID: 3100)
      • VGAuthService.exe (PID: 856)
      • vm3dservice.exe (PID: 440)
      • WmiPrvSE.exe (PID: 3932)
      • vmtoolsd.exe (PID: 2384)

    • Executable content was dropped or overwritten

      • MS.Disk.Repair.Tool.exe (PID: 3100)
      • VGAuthService.exe (PID: 856)
      • WmiPrvSE.exe (PID: 3932)
      • vm3dservice.exe (PID: 440)
      • vmtoolsd.exe (PID: 2384)

  • INFO

    • The sample compiled with english language support

      • WinRAR.exe (PID: 3460)
      • MS.Disk.Repair.Tool.exe (PID: 3100)
      • VGAuthService.exe (PID: 856)
      • WmiPrvSE.exe (PID: 3932)
      • vm3dservice.exe (PID: 440)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3460)

    • Checks supported languages

      • MS.Disk.Repair.Tool.exe (PID: 3100)
      • VGAuthService.exe (PID: 856)
      • WmiPrvSE.exe (PID: 3932)
      • vm3dservice.exe (PID: 440)
      • wmpnetwk.exe (PID: 2508)
      • vmtoolsd.exe (PID: 2384)

    • Manual execution by a user

      • MS.Disk.Repair.Tool.exe (PID: 3100)

    • Reads the computer name

      • MS.Disk.Repair.Tool.exe (PID: 3100)
      • wmpnetwk.exe (PID: 2508)

    • Launching a file from a Registry key

      • MS.Disk.Repair.Tool.exe (PID: 3100)
      • VGAuthService.exe (PID: 856)
      • vm3dservice.exe (PID: 440)
      • WmiPrvSE.exe (PID: 3932)
      • vmtoolsd.exe (PID: 2384)

    • Create files in a temporary directory

      • MS.Disk.Repair.Tool.exe (PID: 3100)
      • VGAuthService.exe (PID: 856)
      • WmiPrvSE.exe (PID: 3932)
      • vm3dservice.exe (PID: 440)
      • vmtoolsd.exe (PID: 2384)

    • Reads the machine GUID from the registry

      • wmpnetwk.exe (PID: 2508)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2025:09:06 07:01:16
ZipCRC: 0xed40ae33
ZipCompressedSize: 678297
ZipUncompressedSize: 756224
ZipFileName: MS.Disk.Repair.Tool.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
136
Monitored processes
7
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe ms.disk.repair.tool.exe vgauthservice.exe wmiprvse.exe vm3dservice.exe vmtoolsd.exe wmpnetwk.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
440C:\Users\admin\AppData\Local\Temp\IXP002.TMP\vm3dservice.exeC:\Users\admin\AppData\Local\Temp\IXP002.TMP\vm3dservice.exe
WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Win32 Cabinet Self-Extractor
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\users\admin\appdata\local\temp\ixp002.tmp\vm3dservice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
856C:\Users\admin\AppData\Local\Temp\IXP000.TMP\VGAuthService.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\VGAuthService.exe
MS.Disk.Repair.Tool.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Win32 Cabinet Self-Extractor
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\vgauthservice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2384C:\Users\admin\AppData\Local\Temp\IXP003.TMP\vmtoolsd.exeC:\Users\admin\AppData\Local\Temp\IXP003.TMP\vmtoolsd.exe
vm3dservice.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Win32 Cabinet Self-Extractor
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\users\admin\appdata\local\temp\ixp003.tmp\vmtoolsd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2508C:\Users\admin\AppData\Local\Temp\IXP004.TMP\wmpnetwk.exeC:\Users\admin\AppData\Local\Temp\IXP004.TMP\wmpnetwk.exe—vmtoolsd.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\ixp004.tmp\wmpnetwk.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
3100"C:\Users\admin\Desktop\MS.Disk.Repair.Tool.exe" C:\Users\admin\Desktop\MS.Disk.Repair.Tool.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Win32 Cabinet Self-Extractor
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\users\admin\desktop\ms.disk.repair.tool.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
3460"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\MS.Disk.Repair.Tool.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
3932C:\Users\admin\AppData\Local\Temp\IXP001.TMP\WmiPrvSE.exeC:\Users\admin\AppData\Local\Temp\IXP001.TMP\WmiPrvSE.exe
VGAuthService.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Win32 Cabinet Self-Extractor
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\users\admin\appdata\local\temp\ixp001.tmp\wmiprvse.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
1 507
Read events
1 484
Write events
23
Delete events
0

Modification events

(PID) Process:(3460) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(3460) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(3460) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(3460) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\MS.Disk.Repair.Tool.zip
(PID) Process:(3460) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3460) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3460) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3460) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3460) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
(PID) Process:(3460) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:name
Value:
256
Executable files
6
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2508wmpnetwk.exe\Device\Harddisk0\DR0 —
MD5:—
SHA256:—
3100MS.Disk.Repair.Tool.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\VGAuthService.exeexecutable
MD5:7D39E6B69B8B325CED6C62A9481E3A3D
SHA256:117A14B20F880E58A3596C8A79AE788E95ADA71795379C51F7CD179244275CE6
440vm3dservice.exeC:\Users\admin\AppData\Local\Temp\IXP003.TMP\vmtoolsd.exeexecutable
MD5:F94930EDC26388B89809F1A828C47B99
SHA256:0A1E4E68301B61B65B16D081CFDB280EF50450D7ACC1E7FB8093748433F77E90
3932WmiPrvSE.exeC:\Users\admin\AppData\Local\Temp\IXP002.TMP\vm3dservice.exeexecutable
MD5:AF43D7470D9922C301A3E78890D4C452
SHA256:3E673EE52895E18BE40B8D2ACEDB9EF814BC2FF2A9CE2E0ADAE305613669C1E4
3460WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3460.1304\MS.Disk.Repair.Tool.exeexecutable
MD5:B48C2106919BECF73DB4B2A3042DC321
SHA256:38F013689151E7CBA861ED43BDFE8FBC334CD31E30DF6189C60CABB6EC6B9726
2384vmtoolsd.exeC:\Users\admin\AppData\Local\Temp\IXP004.TMP\wmpnetwk.exeexecutable
MD5:1F9BC199AF57163D601D5A3AEB77DDA5
SHA256:AF1DCCB6467D93D40A9C60F62B8C6033C86FF62C285BF1100135925DB6FEF545
856VGAuthService.exeC:\Users\admin\AppData\Local\Temp\IXP001.TMP\WmiPrvSE.exeexecutable
MD5:A1EA97BC6478E0007E6CB7215645D32C
SHA256:7F03E2CBF63BED8418F7962FDE58AC78655476ABE0EE383DC1BEB2BD61C9B609
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
20
DNS requests
6
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6024
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
whitelisted
google.com
  • 172.217.23.110
whitelisted
self.events.data.microsoft.com
  • 13.89.178.27
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
MS.Disk.Repair.Tool.zip