File name:

WorldBox_God_Simulatorwww.steamsunlocked.com.zip

Full analysis: https://app.any.run/tasks/150219b6-fd0e-4ffe-b837-d6762ef35d93
Verdict: Malicious activity
Analysis date: December 27, 2024, 14:23:17
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

415E086055270A0E20050F144F448212

SHA1:

EFC26AB3F9AE2A6099A830B04DDEEAA8A69F9506

SHA256:

D69AC8014DFBD225E688B8B48116F86C7F8A4F9BDE1129A9FCCAC794708A5860

SSDEEP:

98304:GbKQsMfYqyyYeb3O+3zRj8+sA2hVQWKHP7TRsaoEiQj8To7uQXMYCU/3qiQiQAzC:GlHuqTngnJOXgm9/sw8

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 628)

    • Antivirus name has been found in the command line (generic signature)

      • MpCmdRun.exe (PID: 4120)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WorldBox God Simulator_4tQ8-M1.exe (PID: 4540)
      • WorldBox God Simulator_4tQ8-M1.exe (PID: 2572)

    • Reads security settings of Internet Explorer

      • WorldBox God Simulator_4tQ8-M1.tmp (PID: 1876)
      • WinRAR.exe (PID: 628)

    • Executing commands from a ".bat" file

      • WinRAR.exe (PID: 628)

    • Starts CMD.EXE for commands execution

      • WinRAR.exe (PID: 628)

  • INFO

    • Checks supported languages

      • WorldBox God Simulator_4tQ8-M1.tmp (PID: 1876)
      • WorldBox God Simulator_4tQ8-M1.exe (PID: 4540)
      • WorldBox God Simulator_4tQ8-M1.exe (PID: 2572)
      • WorldBox God Simulator_4tQ8-M1.tmp (PID: 4308)
      • MpCmdRun.exe (PID: 4120)

    • Create files in a temporary directory

      • WorldBox God Simulator_4tQ8-M1.exe (PID: 4540)
      • WorldBox God Simulator_4tQ8-M1.exe (PID: 2572)
      • MpCmdRun.exe (PID: 4120)

    • Manual execution by a user

      • WorldBox God Simulator_4tQ8-M1.exe (PID: 4540)

    • Reads the computer name

      • WorldBox God Simulator_4tQ8-M1.tmp (PID: 1876)
      • WorldBox God Simulator_4tQ8-M1.tmp (PID: 4308)
      • MpCmdRun.exe (PID: 4120)

    • Process checks computer location settings

      • WorldBox God Simulator_4tQ8-M1.tmp (PID: 1876)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 628)

    • The process uses the downloaded file

      • WinRAR.exe (PID: 628)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2023:08:03 18:46:14
ZipCRC: 0xa79e357d
ZipCompressedSize: 13972727
ZipUncompressedSize: 14502992
ZipFileName: WorldBox God Simulator_4tQ8-M1.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
125
Monitored processes
8
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe worldbox god simulator_4tq8-m1.exe worldbox god simulator_4tq8-m1.tmp no specs worldbox god simulator_4tq8-m1.exe worldbox god simulator_4tq8-m1.tmp no specs cmd.exe no specs conhost.exe no specs mpcmdrun.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
628"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\WorldBox_God_Simulatorwww.steamsunlocked.com.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1876"C:\Users\admin\AppData\Local\Temp\is-MNRR4.tmp\WorldBox God Simulator_4tQ8-M1.tmp" /SL5="$702E2,13603942,780800,C:\Users\admin\Desktop\WorldBox God Simulator_4tQ8-M1.exe" C:\Users\admin\AppData\Local\Temp\is-MNRR4.tmp\WorldBox God Simulator_4tQ8-M1.tmp—WorldBox God Simulator_4tQ8-M1.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-mnrr4.tmp\worldbox god simulator_4tq8-m1.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
2324\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2572"C:\Users\admin\Desktop\WorldBox God Simulator_4tQ8-M1.exe" /SPAWNWND=$602A0 /NOTIFYWND=$702E2 C:\Users\admin\Desktop\WorldBox God Simulator_4tQ8-M1.exe
WorldBox God Simulator_4tQ8-M1.tmp
User:
admin
Company:
Integrity Level:
HIGH
Description:
AKSIUM AUDIT, OOO Download Manager
Version:
3.334.90
Modules
Images
c:\users\admin\desktop\worldbox god simulator_4tq8-m1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4120"C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\admin\AppData\Local\Temp\Rar$VR628.29651"C:\Program Files\Windows Defender\MpCmdRun.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Malware Protection Command Line Utility
Exit code:
2
Version:
4.18.1909.6 (WinBuild.160101.0800)
Modules
Images
c:\program files\windows defender\mpcmdrun.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
4308"C:\Users\admin\AppData\Local\Temp\is-P1GCS.tmp\WorldBox God Simulator_4tQ8-M1.tmp" /SL5="$602D2,13603942,780800,C:\Users\admin\Desktop\WorldBox God Simulator_4tQ8-M1.exe" /SPAWNWND=$602A0 /NOTIFYWND=$702E2 C:\Users\admin\AppData\Local\Temp\is-P1GCS.tmp\WorldBox God Simulator_4tQ8-M1.tmp—WorldBox God Simulator_4tQ8-M1.exe
User:
admin
Company:
Integrity Level:
HIGH
Description:
Setup/Uninstall
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-p1gcs.tmp\worldbox god simulator_4tq8-m1.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
4540"C:\Users\admin\Desktop\WorldBox God Simulator_4tQ8-M1.exe" C:\Users\admin\Desktop\WorldBox God Simulator_4tQ8-M1.exe
explorer.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
AKSIUM AUDIT, OOO Download Manager
Version:
3.334.90
Modules
Images
c:\users\admin\desktop\worldbox god simulator_4tq8-m1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
5392C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\Rar$VR628.29651\Rar$Scan74292.bat" "C:\Windows\System32\cmd.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
Total events
1 805
Read events
1 796
Write events
9
Delete events
0

Modification events

(PID) Process:(628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\WorldBox_God_Simulatorwww.steamsunlocked.com.zip
(PID) Process:(628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\VirusScan
Operation:writeName:DefScanner
Value:
Windows Defender
Executable files
3
Suspicious files
0
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
4540WorldBox God Simulator_4tQ8-M1.exeC:\Users\admin\AppData\Local\Temp\is-MNRR4.tmp\WorldBox God Simulator_4tQ8-M1.tmpexecutable
MD5:669677FDA69FAD1E66FF28FE36EC5FBA
SHA256:3F400A7B565CAD7A3A7823E8DC24942F965B062A67F6A212CC5A2B256C85B096
4120MpCmdRun.exeC:\Users\admin\AppData\Local\Temp\MpCmdRun.logtext
MD5:C0EA85876E06FDDEEDE2080A5505D829
SHA256:23FC334CF314074D1BC33979516691BF4128F899F246F9E87490E8F6422A88CB
2572WorldBox God Simulator_4tQ8-M1.exeC:\Users\admin\AppData\Local\Temp\is-P1GCS.tmp\WorldBox God Simulator_4tQ8-M1.tmpexecutable
MD5:669677FDA69FAD1E66FF28FE36EC5FBA
SHA256:3F400A7B565CAD7A3A7823E8DC24942F965B062A67F6A212CC5A2B256C85B096
628WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR628.29651\Rar$Scan74292.battext
MD5:0AC11F105985490153F153E0025DE29F
SHA256:FA09FC831694E0F7E412D82D48C26380F9A3A3E8E6CFF2A3F93DD7A5EC6BAB4F
628WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR628.29651\WorldBox_God_Simulatorwww.steamsunlocked.com.zip\WorldBox God Simulator_4tQ8-M1.exeexecutable
MD5:98F37B09DADC616079B92A6C5AFDD066
SHA256:1F4F7B787EE329059E4DE4487BA5C17C7C6CA3BE95B72C9873FC9380632FA1F9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
19
DNS requests
6
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2380
svchost.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.215.121.133:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2380
svchost.exe
GET
200
23.215.121.133:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2380
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
192.168.100.255:138
—
—
—
whitelisted
2380
svchost.exe
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2380
svchost.exe
23.215.121.133:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4712
MoUsoCoreWorker.exe
23.215.121.133:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2380
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
whitelisted
google.com
  • 142.250.184.206
whitelisted
crl.microsoft.com
  • 2.16.241.12
  • 2.16.241.19
whitelisted
www.microsoft.com
  • 23.215.121.133
whitelisted
self.events.data.microsoft.com
  • 104.208.16.89
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
WorldBox_God_Simulatorwww.steamsunlocked.com.zip