File name:

Xworm-V5.6.zip

Full analysis: https://app.any.run/tasks/c952f285-4be9-42bc-b582-ed1ebcecc7da
Verdict: Malicious activity
Analysis date: February 12, 2025, 18:59:08
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
arch-doc
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

C22E03F94DEC14D4BD32CD2E799C105F

SHA1:

4F9EF5352D31411CFA1FA965E6489473C449F1BF

SHA256:

E4208DE47BD3293D69FED65C47DE8020F4931E3AB08E2C3DEE0E9B1EA15DC94B

SSDEEP:

196608:4pn1IRGK5phNZPv7QdVv5waCTycZfDNZRJn3vcOXaJ6URCeNEbv+3Ss:4Nq0KLhNZPDsv5waCDBXROpHRCPCis

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 5000)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 5000)

    • Starts CMD.EXE for commands execution

      • WinRAR.exe (PID: 5000)

    • Executing commands from a ".bat" file

      • WinRAR.exe (PID: 5000)

    • The process creates files with name similar to system file names

      • WinRAR.exe (PID: 5000)

  • INFO

    • Manual execution by a user

      • notepad.exe (PID: 4052)
      • cmd.exe (PID: 5572)
      • OpenWith.exe (PID: 5004)
      • OpenWith.exe (PID: 4188)
      • rundll32.exe (PID: 3508)
      • OpenWith.exe (PID: 396)
      • rundll32.exe (PID: 3144)
      • OpenWith.exe (PID: 5444)
      • OpenWith.exe (PID: 4548)
      • OpenWith.exe (PID: 1740)

    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 4052)

    • Reads Microsoft Office registry keys

      • OpenWith.exe (PID: 5004)
      • OpenWith.exe (PID: 4188)
      • OpenWith.exe (PID: 5444)
      • OpenWith.exe (PID: 1740)
      • OpenWith.exe (PID: 396)
      • OpenWith.exe (PID: 4548)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 5000)

    • Reads the computer name

      • MpCmdRun.exe (PID: 444)

    • Create files in a temporary directory

      • MpCmdRun.exe (PID: 444)

    • Checks supported languages

      • MpCmdRun.exe (PID: 444)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2023:06:14 03:48:58
ZipCRC: 0x19d2e838
ZipCompressedSize: 946609
ZipUncompressedSize: 946319
ZipFileName: Xworm-V5.6/Background.png
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
129
Monitored processes
15
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe cmd.exe no specs conhost.exe no specs notepad.exe no specs openwith.exe no specs openwith.exe no specs rundll32.exe no specs rundll32.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs cmd.exe no specs conhost.exe no specs mpcmdrun.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
396"C:\WINDOWS\System32\OpenWith.exe" C:\Users\admin\Desktop\XWorm.Fun.resourcesC:\Windows\System32\OpenWith.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Exit code:
2147943623
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
444"C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\admin\AppData\Local\Temp\Rar$VR5000.9882"C:\Program Files\Windows Defender\MpCmdRun.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Malware Protection Command Line Utility
Exit code:
2
Version:
4.18.1909.6 (WinBuild.160101.0800)
Modules
Images
c:\program files\windows defender\mpcmdrun.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
1740"C:\WINDOWS\System32\OpenWith.exe" C:\Users\admin\Desktop\XWorm.TBotNotify.resourcesC:\Windows\System32\OpenWith.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Exit code:
2147943623
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
3144"C:\WINDOWS\System32\rundll32.exe" "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\admin\Desktop\icon (5).icoC:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
3508"C:\WINDOWS\System32\rundll32.exe" "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\admin\Desktop\icon (16).icoC:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
3700C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\Rar$VR5000.9882\Rar$Scan26239.bat" "C:\Windows\System32\cmd.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
4052"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\ErrorLogs.txtC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
4188"C:\WINDOWS\System32\OpenWith.exe" C:\Users\admin\Desktop\U40957361f7481084776e6aedU9f0U1C:\Windows\System32\OpenWith.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Exit code:
2147943623
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4548"C:\WINDOWS\System32\OpenWith.exe" "C:\Users\admin\Desktop\XWorm V5.6.exe.config"C:\Windows\System32\OpenWith.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Exit code:
2147943623
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4840\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
5 850
Read events
5 837
Write events
13
Delete events
0

Modification events

(PID) Process:(5000) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(5000) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(5000) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(5000) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Xworm-V5.6.zip
(PID) Process:(5000) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(5000) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(5000) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(5000) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(5000) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList
Operation:writeName:ArcSort
Value:
32
(PID) Process:(5000) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList
Operation:writeName:ArcSort
Value:
0
Executable files
48
Suspicious files
52
Text files
22
Unknown types
0

Dropped files

PID
Process
Filename
Type
5000WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR5000.9882\Xworm-V5.6.zip\Xworm-V5.6\Fixer.battext
MD5:2DABC46CE85AAFF29F22CD74EC074F86
SHA256:A11703FD47D16020FA099A95BB4E46247D32CF8821DC1826E77A971CDD3C4C55
5000WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR5000.9882\Xworm-V5.6.zip\Xworm-V5.6\GMap.NET.WindowsForms.dllexecutable
MD5:32A8742009FFDFD68B46FE8FD4794386
SHA256:741E1A8F05863856A25D101BD35BF97CBA0B637F0C04ECB432C1D85A78EF1365
5000WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR5000.9882\Xworm-V5.6.zip\Xworm-V5.6\Icons\icon (11).icoimage
MD5:1C2CEA154DEEDC5A39DAEC2F1DADF991
SHA256:3B64B79E4092251EBF090164CD2C4815390F34849BBD76FB51085B6A13301B6D
5000WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR5000.9882\Xworm-V5.6.zip\Xworm-V5.6\Background.pngimage
MD5:C93EE3ABEFF4AC24936471F80B36EC7A
SHA256:2F691CAFF7E1980CFB069D2608B6470B3A06CDB90467CE47820E8602115A0C5B
5000WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR5000.9882\Xworm-V5.6.zip\Xworm-V5.6\FastColoredTextBox.dllexecutable
MD5:B746707265772B362C0BA18D8D630061
SHA256:3701B19CCDAC79B880B197756A972027E2AC609EBED36753BD989367EA4EF519
5000WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR5000.9882\Xworm-V5.6.zip\Xworm-V5.6\Guna.UI2.dllexecutable
MD5:BCC0FE2B28EDD2DA651388F84599059B
SHA256:C6264665A882E73EB2262A74FEA2C29B1921A9AF33180126325FB67A851310EF
5000WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR5000.9882\Xworm-V5.6.zip\Xworm-V5.6\GeoIP.datbinary
MD5:8EF41798DF108CE9BD41382C9721B1C9
SHA256:BC07FF22D4EE0B6FAFCC12482ECF2981C172A672194C647CEDF9B4D215AD9740
5000WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR5000.9882\Xworm-V5.6.zip\Xworm-V5.6\Icons\icon (1).icoimage
MD5:4F409511E9F93F175CD18187379E94CB
SHA256:115F0DB669B624D0A7782A7CFAF6E7C17282D88DE3A287855DBD6FE0F8551A8F
5000WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR5000.9882\Xworm-V5.6.zip\Xworm-V5.6\GMap.NET.Core.dllexecutable
MD5:819352EA9E832D24FC4CEBB2757A462B
SHA256:58C755FCFC65CDDEA561023D736E8991F0AD69DA5E1378DEA59E98C5DB901B86
5000WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR5000.9882\Xworm-V5.6.zip\Xworm-V5.6\Icons\icon (10).icoimage
MD5:AD1740CB3317527AA1ACAE6E7440311E
SHA256:7A97547954AAAD629B0563CC78BCA75E3339E8408B70DA2ED67FA73B4935D878
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
19
DNS requests
6
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
2.17.198.186:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
BE
binary
1.01 Kb
whitelisted
4308
svchost.exe
GET
200
2.17.198.186:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
BE
binary
1.01 Kb
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.219.240.231:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
US
binary
973 b
whitelisted
4308
svchost.exe
GET
200
23.219.240.231:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
US
binary
973 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4308
svchost.exe
2.17.198.186:80
crl.microsoft.com
Akamai International B.V.
BE
whitelisted
4712
MoUsoCoreWorker.exe
2.17.198.186:80
crl.microsoft.com
Akamai International B.V.
BE
whitelisted
4308
svchost.exe
23.219.240.231:80
www.microsoft.com
AKAMAI-AS
US
whitelisted
4712
MoUsoCoreWorker.exe
23.219.240.231:80
www.microsoft.com
AKAMAI-AS
US
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4712
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.124.78.146
whitelisted
google.com
  • 142.250.185.110
whitelisted
crl.microsoft.com
  • 2.17.198.186
  • 2.17.198.153
whitelisted
www.microsoft.com
  • 23.219.240.231
whitelisted
self.events.data.microsoft.com
  • 104.208.16.90
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Xworm-V5.6.zip