File name:

W32.Nimda.A.zip

Full analysis: https://app.any.run/tasks/37eacba8-348a-43e6-b73f-1a4cf1482d7d
Verdict: Malicious activity
Analysis date: June 19, 2025, 14:24:06
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
arch-scr
arch-html
arch-email
arch-exec
arch-doc
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

B62632C8E6AAFA05A07CAD52B2E25AA5

SHA1:

35C626A3513F8866095F891F69C593DE6D87EBD2

SHA256:

E56E79F9DC8752E11B66C3DEA5282E835EF280A46A2B5D98AF19222D11B72767

SSDEEP:

6144:F5+YTd3QOMgyjGyrQb+MU5opgJcvd7JEZ:F5+YhogyjGK4ZqWgZ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 2784)

    • Runs injected code in another process

      • mepBFC1.tmp.exe (PID: 2816)

    • Application was injected by another process

      • explorer.exe (PID: 1452)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • explorer.exe (PID: 1452)
      • readme.exe (PID: 3464)
      • mepBFC1.tmp.exe (PID: 2816)

    • Detected use of alternative data streams (AltDS)

      • readme.exe (PID: 3464)
      • mepBFC1.tmp.exe (PID: 2816)

    • Starts itself from another location

      • readme.exe (PID: 3464)

  • INFO

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 1452)

    • Reads the Internet Settings

      • explorer.exe (PID: 1452)

    • Manual execution by a user

      • WinRAR.exe (PID: 3184)
      • readme.exe (PID: 3464)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3184)

    • Checks supported languages

      • readme.exe (PID: 3464)
      • mepBFC1.tmp.exe (PID: 2816)

    • Create files in a temporary directory

      • mepBFC1.tmp.exe (PID: 2816)
      • readme.exe (PID: 3464)

    • Reads the computer name

      • mepBFC1.tmp.exe (PID: 2816)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 788
ZipBitFlag: 0x0001
ZipCompression: Deflated
ZipModifyDate: 2019:01:09 16:45:30
ZipCRC: 0xda64013f
ZipCompressedSize: 284
ZipUncompressedSize: 6148
ZipFileName: .DS_Store
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
5
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs winrar.exe readme.exe mepbfc1.tmp.exe explorer.exe

Process information

PID
CMD
Path
Indicators
Parent process
1452C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
255
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2784"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\W32.Nimda.A.zipC:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2816C:\Users\admin\AppData\Local\Temp\mepBFC1.tmp.exe -dontrunoldC:\Users\admin\AppData\Local\Temp\mepBFC1.tmp.exe
readme.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\mepbfc1.tmp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
3184"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\I-Worm.Nimda.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3464"C:\Users\admin\Desktop\readme.exe" C:\Users\admin\Desktop\readme.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\readme.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
Total events
8 819
Read events
8 750
Write events
69
Delete events
0

Modification events

(PID) Process:(2784) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2784) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2784) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1452) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
01000000D08C9DDF0115D1118C7A00C04FC297EB01000000A1A559CD5EBA54449F9B23534AC7F42F00000000020000000000106600000001000020000000588A5629DB60DA02DB7614987AF6435DDFE1957D2742BD90EECEAC977DD2B03F000000000E80000000020000200000009941A314A30B183B1EC0A19BA61A4CAC71F3635D9825732B9844DE4CAB874E3A30000000ABE84BCB32942F90785226CA38B56EAEED99D70C759DB91F3FAFFFD04CCE06736084862E6B8C4D1BE4E0EDF59F25526140000000807FD493B989A57428858FAF1C988FF6F5676514663945DF6A3FF4A82D67419536A79935C4CB57EBC703294EF51E7842DC6CC401C8813018AFE9CA12C26DDD7F
(PID) Process:(2784) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2784) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(2784) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(2784) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\W32.Nimda.A.zip
(PID) Process:(2784) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2784) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
Executable files
10
Suspicious files
5
Text files
1
Unknown types
3

Dropped files

PID
Process
Filename
Type
2784WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2784.37415\I-Worm.Nimda.zipcompressed
MD5:844855B2EC58F20718CFF30D874AB43E
SHA256:70E37EA05B1D89E37E04B1C2CE98731E65B6C37CF718DC72A109D862CA36CC2A
1452explorer.exeC:\Users\admin\Desktop\I-Worm.Nimda.zipcompressed
MD5:844855B2EC58F20718CFF30D874AB43E
SHA256:70E37EA05B1D89E37E04B1C2CE98731E65B6C37CF718DC72A109D862CA36CC2A
1452explorer.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\290532160612e071.automaticDestinations-msautomaticdestinations-ms
MD5:AC72932B9CA09087C1448B04B35287AC
SHA256:7A5B6BFDFE0CF3E5771E6EE853AB6358E8C2766B2484DDDCB0925CE2E1A32AF8
3464readme.exeC:\Users\admin\AppData\Local\Temp\mepBFC1.tmp.exeexecutable
MD5:7A9527AFDDA4179B10E5465E93D0F3AA
SHA256:C4A60096AD81F6E4CE7412F4873465DE408EAB69D7AC35B9AF9B0B1A4CCD3EEA
1452explorer.exeC:\Users\admin\Desktop\readme.exeexecutable
MD5:7A9527AFDDA4179B10E5465E93D0F3AA
SHA256:C4A60096AD81F6E4CE7412F4873465DE408EAB69D7AC35B9AF9B0B1A4CCD3EEA
2816mepBFC1.tmp.exeC:\Users\admin\AppData\Local\Temp\mepC051.tmptext
MD5:46587BC0DBA53442F164F7A1190AE4A3
SHA256:64FDAA7002C8410512BD2A7E4DEF3120FF000A2093B92AD919992B2B8FE0138D
2816mepBFC1.tmp.exeC:\Users\admin\AppData\Local\Temp\mepBFF0.tmp.exeexecutable
MD5:7A9527AFDDA4179B10E5465E93D0F3AA
SHA256:C4A60096AD81F6E4CE7412F4873465DE408EAB69D7AC35B9AF9B0B1A4CCD3EEA
3464readme.exeC:\Users\admin\AppData\Local\Temp\mepBFC1.tmp.exe:OECustomPropertybinary
MD5:8243E382810CB1DF88D17BB47C998B8E
SHA256:7DFD2BAAA67EE5473604683461E100D6EAD5702581728D211516CD95CC17345B
2816mepBFC1.tmp.exeC:\Users\admin\AppData\Local\Temp\mepC030.tmp:OECustomPropertybinary
MD5:8243E382810CB1DF88D17BB47C998B8E
SHA256:7DFD2BAAA67EE5473604683461E100D6EAD5702581728D211516CD95CC17345B
2816mepBFC1.tmp.exeC:\Users\admin\AppData\Local\Temp\mepC030.tmpexecutable
MD5:7A9527AFDDA4179B10E5465E93D0F3AA
SHA256:C4A60096AD81F6E4CE7412F4873465DE408EAB69D7AC35B9AF9B0B1A4CCD3EEA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
5
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.110
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
W32.Nimda.A.zip