File name:

async_modified.zip

Full analysis: https://app.any.run/tasks/32e8f5b7-d2b4-48c0-8d45-7ac467c987c1
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: November 23, 2024, 22:22:43
OS: Windows 11 Professional (build: 22000, 64 bit)
Tags:
arch-exec
anydesk
tool
adware
asyncrat
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

E37FA9593121CC84AEB257F51E83F2F6

SHA1:

BDE5DDE707A62B66EDF968890AF7EF49B637675F

SHA256:

D9A3252D8AA1CE8786FD29D68C4D77018A61C51073AAFF82DB00AE5355704110

SSDEEP:

393216:/35Q4iemP/9W78wdMkf5e2ARlTEsYOR7ceR:xv7zdn5ePRN3R7cY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • ADWARE has been detected (SURICATA)

      • AnyDesk.exe (PID: 6208)

    • ASYNCRAT has been detected (YARA)

      • Stub.exe (PID: 5776)

  • SUSPICIOUS

    • Executes application which crashes

      • Stub.exe (PID: 5776)
      • BackProxyUI.exe (PID: 1056)

    • ANYDESK has been found

      • AnyDesk.exe (PID: 1028)

    • Found AnyDesk certificate that may have been compromised

      • AnyDesk.exe (PID: 6208)
      • AnyDesk.exe (PID: 1784)

    • Application launched itself

      • AnyDesk.exe (PID: 1028)

    • Reads the Internet Settings

      • AnyDesk.exe (PID: 1784)
      • OpenWith.exe (PID: 2808)
      • OpenWith.exe (PID: 3432)

    • Executable content was dropped or overwritten

      • AnyDesk.exe (PID: 6208)

    • Access to an unwanted program domain was detected

      • AnyDesk.exe (PID: 6208)

    • Potential Corporate Privacy Violation

      • AnyDesk.exe (PID: 6208)

  • INFO

    • Checks supported languages

      • Stub.exe (PID: 5776)
      • BackProxyUI.exe (PID: 1056)
      • AnyDesk.exe (PID: 1028)
      • AnyDesk.exe (PID: 6208)
      • AnyDesk.exe (PID: 1784)

    • Manual execution by a user

      • cmd.exe (PID: 6464)
      • Stub.exe (PID: 5776)
      • BackProxyUI.exe (PID: 1056)
      • AnyDesk.exe (PID: 1028)
      • WinRAR.exe (PID: 2400)
      • OpenWith.exe (PID: 3432)
      • OpenWith.exe (PID: 2808)

    • Reads the computer name

      • Stub.exe (PID: 5776)
      • BackProxyUI.exe (PID: 1056)
      • AnyDesk.exe (PID: 1028)
      • AnyDesk.exe (PID: 1784)
      • AnyDesk.exe (PID: 6208)

    • The process uses the downloaded file

      • AnyDesk.exe (PID: 1028)

    • Process checks whether UAC notifications are on

      • AnyDesk.exe (PID: 1028)

    • Creates files or folders in the user directory

      • AnyDesk.exe (PID: 1028)
      • WerFault.exe (PID: 5904)
      • WerFault.exe (PID: 1220)

    • Reads CPU info

      • AnyDesk.exe (PID: 1028)

    • Reads the machine GUID from the registry

      • AnyDesk.exe (PID: 6208)

    • Reads security settings of Internet Explorer

      • OpenWith.exe (PID: 2808)
      • OpenWith.exe (PID: 3432)

    • Checks proxy server information

      • AnyDesk.exe (PID: 1784)
      • WerFault.exe (PID: 1220)
      • WerFault.exe (PID: 5904)

    • Reads Microsoft Office registry keys

      • OpenWith.exe (PID: 3432)
      • OpenWith.exe (PID: 2808)

    • Reads the software policy settings

      • WerFault.exe (PID: 5904)
      • WerFault.exe (PID: 1220)

    • Reads the Internet Settings

      • WerFault.exe (PID: 1220)
      • WerFault.exe (PID: 5904)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0002
ZipCompression: Deflated
ZipModifyDate: 2023:02:10 08:09:24
ZipCRC: 0x471efb00
ZipCompressedSize: 37369
ZipUncompressedSize: 237056
ZipFileName: async_modified/BackProxyUI.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
131
Monitored processes
13
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe no specs cmd.exe no specs conhost.exe no specs #ASYNCRAT stub.exe werfault.exe backproxyui.exe werfault.exe anydesk.exe no specs #ADWARE anydesk.exe anydesk.exe no specs winrar.exe no specs openwith.exe no specs openwith.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
252\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.22000.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
1028"C:\Users\admin\Desktop\AnyDesk.exe" C:\Users\admin\Desktop\AnyDesk.exe—explorer.exe
User:
admin
Company:
AnyDesk Software GmbH
Integrity Level:
MEDIUM
Description:
AnyDesk
Version:
7.1.7
Modules
Images
c:\users\admin\desktop\anydesk.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64base.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64con.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
1056"C:\Users\admin\Desktop\BackProxyUI.exe" C:\Users\admin\Desktop\BackProxyUI.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
BackProxyUI
Exit code:
3762504530
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\backproxyui.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64base.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64con.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
1220C:\Windows\SysWOW64\WerFault.exe -u -p 5776 -s 792C:\Windows\SysWOW64\WerFault.exe
Stub.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.22000.653 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64base.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64con.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
1600"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\async_modified.zipC:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1784"C:\Users\admin\Desktop\AnyDesk.exe" --local-controlC:\Users\admin\Desktop\AnyDesk.exe—AnyDesk.exe
User:
admin
Company:
AnyDesk Software GmbH
Integrity Level:
MEDIUM
Description:
AnyDesk
Version:
7.1.7
Modules
Images
c:\users\admin\desktop\anydesk.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64base.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64con.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
2400"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\BackupCertificate.zipC:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
2808"C:\Windows\System32\OpenWith.exe" C:\Users\admin\Desktop\System.Data.SQLite.dll.configC:\Windows\System32\OpenWith.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Exit code:
2147943623
Version:
10.0.22000.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
3432"C:\Windows\System32\OpenWith.exe" C:\Users\admin\Desktop\desktop.iniC:\Windows\System32\OpenWith.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Exit code:
2147943623
Version:
10.0.22000.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
5776"C:\Users\admin\Desktop\Stub.exe" C:\Users\admin\Desktop\Stub.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3762504530
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\stub.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64base.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64con.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
Total events
17 555
Read events
17 535
Write events
20
Delete events
0

Modification events

(PID) Process:(1600) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1600) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1600) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(1600) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(1600) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\async_modified.zip
(PID) Process:(1600) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1600) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1600) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1600) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2400) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
Executable files
2
Suspicious files
4
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
5904WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_BackProxyUI.exe_477aaf8d7f38de298b1c8b7a64ef51344e3fbe6_9c733296_f7583022-3bb4-4c97-81c8-444dc04abce3\Report.wer —
MD5:—
SHA256:—
5904WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\BackProxyUI.exe.1056.dmp —
MD5:—
SHA256:—
1220WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Stub.exe_6450a6e7d5d44cb43cc147722c2a43a784981f1_f7fb6c67_5b33455a-32d4-4da3-96fd-1348ab509739\Report.wer —
MD5:—
SHA256:—
1220WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\Stub.exe.5776.dmp —
MD5:—
SHA256:—
1220WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER.af63e832-0459-4948-a4e7-8d8e823afdc8.tmp.dmpbinary
MD5:712F3830C6907DA0248CCB727AB83915
SHA256:F8EF33CB5E142DCA7E7C14D74E83BFBE0520B8A849BADBAFDBEC947177FE1C9E
1220WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER.a1f7ac76-b40d-4013-b59b-819f87df7b31.tmp.xmlxml
MD5:232E02D791CBA35E5292E354FDD80FF2
SHA256:3A531CEB56E99912CA0100BA22878A05573093550D5AD3F6EEAAD70CD780F92C
5904WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER.847014b8-5a82-477f-a99c-08e62f721263.tmp.dmpbinary
MD5:8D153CACFFE83EEB76A9B7A446946BD6
SHA256:125F7B8EDFDBD9606681DCF3B8F01B6AA754FACF2EA31F269CAB61C40A5576D5
1220WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER.649141a3-c097-4671-a7b9-f34a50f4e441.tmp.WERInternalMetadata.xmlxml
MD5:28515B39E24391E3BA08C9A24FBFE0CC
SHA256:2A3D50AD1C96C3D64B032E5DE034F6FFA440C9623661DDDB5471391ACD7737C2
5904WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER.a336ecda-23dc-439c-90af-23cd63a3cd72.tmp.WERInternalMetadata.xmlxml
MD5:78C32BE118A9185E3F42AFB591B57927
SHA256:8D9A0FD98C69256357DBCED7CCC4F83695C5D4A963D0B80998F8D396EAFDC4EA
1028AnyDesk.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\DGE9UMLCL8JD9NKS172A.tempbinary
MD5:279CF40A79F61B90C2E2EAD431C0C0EE
SHA256:526CD866C3E9E765392A648A4D887466C160133EABD07D130606AA5C2129A0A7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
30
TCP/UDP connections
55
DNS requests
39
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
304
199.232.210.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f9a4bd63d3afea63
unknown
—
—
whitelisted
4980
MoUsoCoreWorker.exe
GET
304
199.232.210.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?4bee9aca38d7fab2
unknown
—
—
whitelisted
1296
svchost.exe
GET
200
2.18.121.71:80
http://www.msftconnecttest.com/connecttest.txt
unknown
—
—
whitelisted
5488
firefox.exe
POST
200
2.16.202.121:80
http://r10.o.lencr.org/
unknown
—
—
whitelisted
5488
firefox.exe
POST
200
192.229.221.95:80
http://ocsp.digicert.com/
unknown
—
—
whitelisted
5488
firefox.exe
POST
200
2.16.202.121:80
http://r10.o.lencr.org/
unknown
—
—
whitelisted
5488
firefox.exe
POST
200
2.16.202.121:80
http://r10.o.lencr.org/
unknown
—
—
whitelisted
—
—
HEAD
200
23.213.164.137:443
https://fs.microsoft.com/fs/windows/config.json
unknown
—
—
—
6208
AnyDesk.exe
POST
—
18.245.86.79:80
http://api.playanext.com/httpapi
unknown
—
—
whitelisted
2860
svchost.exe
GET
304
199.232.214.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?bdb78aa50ddaee77
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
52.109.76.240:443
officeclient.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
239.255.255.250:1900
—
—
—
whitelisted
5488
firefox.exe
34.120.208.123:443
incoming.telemetry.mozilla.org
GOOGLE-CLOUD-PLATFORM
US
whitelisted
—
—
34.149.100.209:443
firefox.settings.services.mozilla.com
GOOGLE
US
whitelisted
5488
firefox.exe
34.149.100.209:443
firefox.settings.services.mozilla.com
GOOGLE
US
whitelisted
—
—
34.120.208.123:443
incoming.telemetry.mozilla.org
GOOGLE-CLOUD-PLATFORM
US
whitelisted
—
—
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1296
svchost.exe
2.18.121.71:80
—
AKAMAI-AS
FR
unknown
—
—
199.232.210.172:80
ctldl.windowsupdate.com
FASTLY
US
whitelisted

DNS requests

Domain
IP
Reputation
officeclient.microsoft.com
  • 52.109.76.240
whitelisted
firefox.settings.services.mozilla.com
  • 34.149.100.209
whitelisted
incoming.telemetry.mozilla.org
  • 34.120.208.123
whitelisted
telemetry-incoming.r53-2.services.mozilla.com
  • 34.120.208.123
whitelisted
prod.remote-settings.prod.webservices.mozgcp.net
  • 34.149.100.209
whitelisted
google.com
  • 216.58.206.46
whitelisted
ctldl.windowsupdate.com
  • 199.232.210.172
  • 199.232.214.172
whitelisted
r10.o.lencr.org
  • 2.16.202.121
  • 95.101.54.131
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
fp2e7a.wpc.phicdn.net
  • 192.229.221.95
  • 2606:2800:233:fa02:67b:9ff6:6107:833
whitelisted

Threats

PID
Process
Class
Message
1296
svchost.exe
Misc activity
ET INFO Microsoft Connection Test
6208
AnyDesk.exe
Potential Corporate Privacy Violation
ET USER_AGENTS AnyDesk Remote Desktop Software User-Agent
6208
AnyDesk.exe
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] Driver Updater Setup Process
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
async_modified.zip