File name:

HYDRA 1.8A PRO.7z

Full analysis: https://app.any.run/tasks/be09e059-7290-4d72-9684-57e358dd84f3
Verdict: Malicious activity
Analysis date: March 25, 2025, 00:10:13
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
winring0x64-sys
vuln-driver
arch-exec
arch-doc
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

AA96A11ABE1AE2735B92C2CA6EF954F9

SHA1:

99B6281B3624DDE990CD87A1DA7D8FC72BE0F46B

SHA256:

E26320635EE9A0E19F4019C29D6437784D4DE38564348BEDB49F992BA8EF6BDD

SSDEEP:

98304:TL86LrScbzPLAjqgPc6fQFXB3NTopjETVxsU4kvoqYaXB6D7NNt0GSxfgJKjH8rH:e61vZ9+f5B

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Vulnerable driver has been detected

      • WinRAR.exe (PID: 7412)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 6516)

    • Changes powershell execution policy (Bypass)

      • HYDRA.exe (PID: 7300)

  • SUSPICIOUS

    • Drops a system driver (possible attempt to evade defenses)

      • WinRAR.exe (PID: 7412)
      • HYDRA.exe (PID: 7300)

    • Creates files in the driver directory

      • HYDRA.exe (PID: 7300)

    • Executable content was dropped or overwritten

      • HYDRA.exe (PID: 7300)

    • Starts POWERSHELL.EXE for commands execution

      • HYDRA.exe (PID: 7300)

    • The process bypasses the loading of PowerShell profile settings

      • HYDRA.exe (PID: 7300)

    • Uses powercfg.exe to modify the power settings

      • HYDRA.exe (PID: 7300)

    • Executes as Windows Service

      • WmiApSrv.exe (PID: 7236)

    • The process checks if it is being run in the virtual environment

      • HYDRA.exe (PID: 7300)

  • INFO

    • The sample compiled with english language support

      • WinRAR.exe (PID: 7412)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 7412)

    • The sample compiled with japanese language support

      • WinRAR.exe (PID: 7412)

    • Manual execution by a user

      • HYDRA.exe (PID: 7300)
      • HYDRA.exe (PID: 8176)

    • Reads the computer name

      • HYDRA.exe (PID: 7300)

    • Checks supported languages

      • HYDRA.exe (PID: 7300)

    • Reads the machine GUID from the registry

      • HYDRA.exe (PID: 7300)

    • Reads the time zone

      • HYDRA.exe (PID: 7300)

    • Reads CPU info

      • HYDRA.exe (PID: 7300)

    • Reads the software policy settings

      • slui.exe (PID: 7632)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)

EXIF

ZIP

FileVersion: 7z v0.04
ModifyDate: 2024:08:31 06:24:12+00:00
ArchivedFileName: HYDRA 1.8A PRO
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
184
Monitored processes
48
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start THREAT winrar.exe sppextcomobj.exe no specs slui.exe rundll32.exe no specs hydra.exe no specs hydra.exe powercfg.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs lodctr.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs wmiapsrv.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
516"powercfg.exe" /duplicatescheme 381b4222-f694-41f0-9685-ff5bb260df2eC:\Windows\System32\powercfg.exe—HYDRA.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Power Settings Command-Line Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\powercfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\powrprof.dll
1056"powercfg.exe" /setacvalueindex be3e1c98-d25e-41e7-8169-c25c68351d83 54533251-82be-4824-96c1-47b60b740d00 bae08b81-2d5e-4688-ad6a-13243356654b 0x00000001C:\Windows\System32\powercfg.exe—HYDRA.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Power Settings Command-Line Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\powercfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
1196\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powercfg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1280\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powercfg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1388\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powercfg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1532"powercfg.exe" /setacvalueindex be3e1c98-d25e-41e7-8169-c25c68351d83 54533251-82be-4824-96c1-47b60b740d00 3b04d4fd-1cc7-4f23-ab1c-d1337819c4bb 0x00000000C:\Windows\System32\powercfg.exe—HYDRA.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Power Settings Command-Line Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\powercfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
2088"powercfg.exe" /restoredefaultschemesC:\Windows\System32\powercfg.exe—HYDRA.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Power Settings Command-Line Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\powercfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\powrprof.dll
2516"powercfg.exe" /lC:\Windows\System32\powercfg.exe—HYDRA.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Power Settings Command-Line Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\powercfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\powrprof.dll
3240\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powercfg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3268\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powercfg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
11 172
Read events
10 804
Write events
199
Delete events
169

Modification events

(PID) Process:(7412) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(7412) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(7412) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(7412) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\HYDRA 1.8A PRO.7z
(PID) Process:(7412) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7412) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(7412) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(7412) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(5508) lodctr.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\.NET CLR Data\Performance
Operation:delete valueName:First Counter
Value:
᪸
(PID) Process:(5508) lodctr.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\.NET CLR Data\Performance
Operation:delete valueName:Last Counter
Value:
᫄
Executable files
45
Suspicious files
4
Text files
8
Unknown types
0

Dropped files

PID
Process
Filename
Type
7412WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7412.24332\HYDRA 1.8A PRO\amdvbflash\Changelog.txttext
MD5:E55A0130C287F8ACAAA432B787A4C8BB
SHA256:1CBE1AD43C3ABB2475FF9B237A3CB67827A268DDD6D37A854AD90BC80095FB0A
7412WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7412.24332\HYDRA 1.8A PRO\ProfilesBackupCPU.initext
MD5:9CDE440C1351CAC670354CD26B506E9E
SHA256:DF4514C632059A703D85673AE23BCED5EECD68714893D3B1CE72428F46C9619A
7412WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7412.24332\HYDRA 1.8A PRO\amdvbflash\arguments.txttext
MD5:696A0182C4867D2F6C6D7FB72674E7A2
SHA256:8B463CABD48AB42E22870D8AE30F6CE88B2D1CFD519A5B53A863D63B42CA8838
7412WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7412.24332\HYDRA 1.8A PRO\Bunifu.UI.WinForms.1.5.3.dllexecutable
MD5:019B3A5DD20F3E55B426E652ED512079
SHA256:EB3B6850904C1FD49C6C2B92A8BD4D24FFBE682753AA90DC7DE9A8B406DEADD2
7412WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7412.24332\HYDRA 1.8A PRO\amdvbflash\amdvbflash.exeexecutable
MD5:313ED2279DF1AF019A0CCD06B4507277
SHA256:CB04893E48312E2AA23436D21DD3CAACF8FEC2339373EEF3F3875B7C359B1A3C
7412WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7412.24332\HYDRA 1.8A PRO\Bunifu.UI.WinForms.BunifuDropdown.dllexecutable
MD5:C715CBDEE4B7E42294BEA2A949626D41
SHA256:41199AFA13D2967121028FBEA947397EB86505DD3C42E4BBFB002FAB04FE46A6
7412WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7412.24332\HYDRA 1.8A PRO\Bunifu.Licensing.dllexecutable
MD5:2B2740E0C34A46DE31CF9DA8A75D77CF
SHA256:A9BE91CAE167702885A5CA74273DB779E3E391E2E604CC03779ED403C53EBE43
7412WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7412.24332\HYDRA 1.8A PRO\amdvbflash\AMDVBFlashDriverInstaller.exeexecutable
MD5:98D09E802EE2130801160A3F395B5774
SHA256:A509DDBFA8E02213A3C81918BAAF020A0E2E56DF9814102C191F7DD6EAA77A78
7412WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7412.24332\HYDRA 1.8A PRO\Bunifu.UI.WinForms.BunifuButton.dllexecutable
MD5:7E751AE1A357A30E3AA5153352EBCAFD
SHA256:ADFE00B9B70403C2C908D55058D63F9E151322E1CBD8BD3B854C25659CFE46CF
7412WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7412.24332\HYDRA 1.8A PRO\Bunifu.UI.WinForms.BunifuCheckBox.dllexecutable
MD5:4274A77B71F547347F241386C6729CD6
SHA256:038BA8832AF2803BA45462D0D8873721D515EFBCA34A325818D05E8561BACEB7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
22
DNS requests
12
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7268
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.166:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7268
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7720
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1852
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.166:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
40.126.31.0:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
7720
backgroundTaskHost.exe
20.31.169.57:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
google.com
  • 216.58.206.46
whitelisted
crl.microsoft.com
  • 23.48.23.166
  • 23.48.23.156
  • 23.48.23.143
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
login.live.com
  • 40.126.31.0
  • 40.126.31.67
  • 20.190.159.64
  • 20.190.159.73
  • 40.126.31.130
  • 40.126.31.129
  • 20.190.159.128
  • 20.190.159.131
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
arc.msn.com
  • 20.31.169.57
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
HYDRA 1.8A PRO.7z