File name:

AUTO_ADMITE_TUTERAD.0034202500159.zip

Full analysis: https://app.any.run/tasks/70c1a14b-3de2-4f46-99fb-53b140deddb4
Verdict: Malicious activity
Analysis date: March 24, 2025, 20:41:50
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto
generic
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

6127CC3F7F10EEBC7C1C7BAA28AB8123

SHA1:

BC00D0437A00E340659FA82BAA75B3D198F85374

SHA256:

E85D6FA126668CE8C6137CDB47699354C6E6B4F1EBE6E9C6C9AFCAFFAE7FB680

SSDEEP:

98304:DN5aaRdpsGMh0giYZCmn2Vt73d2ryMfIPfwhwo1vaYxlQtYcjmdWYEjKzRhYzA3l:s3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • GENERIC has been found (auto)

      • WinRAR.exe (PID: 2152)
      • AUTO_ADMITE_TUTERAD.0034202500159.exe (PID: 2852)

    • Changes the autorun value in the registry

      • AUTO_ADMITE_TUTERAD.0034202500159.exe (PID: 2852)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 2152)

    • Executable content was dropped or overwritten

      • AUTO_ADMITE_TUTERAD.0034202500159.exe (PID: 2852)

    • Connects to unusual port

      • AddInProcess32.exe (PID: 1184)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2152)

    • Checks supported languages

      • AddInProcess32.exe (PID: 1184)

    • Reads the computer name

      • AUTO_ADMITE_TUTERAD.0034202500159.exe (PID: 2852)
      • AddInProcess32.exe (PID: 1184)

    • Reads the machine GUID from the registry

      • AddInProcess32.exe (PID: 1184)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0009
ZipCompression: Deflated
ZipModifyDate: 2025:03:01 05:55:24
ZipCRC: 0x7fc34a1c
ZipCompressedSize: 33333
ZipUncompressedSize: 63504
ZipFileName: AUTO_ADMITE_TUTERAD.0034202500159.exe
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
139
Monitored processes
6
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #GENERIC winrar.exe sppextcomobj.exe no specs slui.exe no specs #GENERIC auto_admite_tuterad.0034202500159.exe conhost.exe no specs addinprocess32.exe

Process information

PID
CMD
Path
Indicators
Parent process
1184"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
AUTO_ADMITE_TUTERAD.0034202500159.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
AddInProcess.exe
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\addinprocess32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
1348C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
1812\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—AUTO_ADMITE_TUTERAD.0034202500159.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2152"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\AUTO_ADMITE_TUTERAD.0034202500159.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
2852"C:\Users\admin\AppData\Local\Temp\Rar$EXb2152.23021\AUTO_ADMITE_TUTERAD.0034202500159.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb2152.23021\AUTO_ADMITE_TUTERAD.0034202500159.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
4294967295
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb2152.23021\auto_admite_tuterad.0034202500159.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\users\admin\appdata\local\temp\rar$exb2152.23021\libcares-2.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
5256"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
2 383
Read events
2 372
Write events
11
Delete events
0

Modification events

(PID) Process:(2152) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(2152) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(2152) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(2152) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\AUTO_ADMITE_TUTERAD.0034202500159.zip
(PID) Process:(2152) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2152) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2152) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2152) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2152) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(2852) AUTO_ADMITE_TUTERAD.0034202500159.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:AUTO_ADMITE_TUTERAD.0034202500159
Value:
cmd.exe /C "start "" /D "C:\Users\admin\SystemRootDoc" "C:\Users\admin\SystemRootDoc\AUTO_ADMITE_TUTERAD.0034202500159.exe""
Executable files
4
Suspicious files
2
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2852AUTO_ADMITE_TUTERAD.0034202500159.exeC:\Users\admin\SystemRootDoc\libcares-2.dllexecutable
MD5:685341E5347952DCC91726EF16D52FE8
SHA256:C66EFD7693F67389D4FE5761657265214F1ECA398FA85742250EE7FA775D28C7
2852AUTO_ADMITE_TUTERAD.0034202500159.exeC:\Users\admin\SystemRootDoc\vcruntime210.dllbinary
MD5:A64A3E2413DF50A77217410F6DAD32F8
SHA256:9D19B043B0A14FFA675ECDC5EF378BA7154F43A41686ACD6C7F9C7FB085EC5AF
2852AUTO_ADMITE_TUTERAD.0034202500159.exeC:\Users\admin\SystemRootDoc\AUTO_ADMITE_TUTERAD.0034202500159.exeexecutable
MD5:FD3C8166E7FBBB64D12C1170B8F4BACF
SHA256:A52E245DD7937094711B10C479274A2CCCEA2DFB89F7D4C9F22879214718F92B
2152WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2152.23021\libcares-2.dllexecutable
MD5:685341E5347952DCC91726EF16D52FE8
SHA256:C66EFD7693F67389D4FE5761657265214F1ECA398FA85742250EE7FA775D28C7
2152WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2152.23021\AUTO_ADMITE_TUTERAD.0034202500159.exeexecutable
MD5:FD3C8166E7FBBB64D12C1170B8F4BACF
SHA256:A52E245DD7937094711B10C479274A2CCCEA2DFB89F7D4C9F22879214718F92B
2152WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2152.23021\vcruntime210.dllbinary
MD5:A64A3E2413DF50A77217410F6DAD32F8
SHA256:9D19B043B0A14FFA675ECDC5EF378BA7154F43A41686ACD6C7F9C7FB085EC5AF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
48
DNS requests
13
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
23.48.23.139:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
3884
backgroundTaskHost.exe
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
5260
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5260
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.48.23.139:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6544
svchost.exe
40.126.32.74:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
23.54.109.203:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3884
backgroundTaskHost.exe
20.223.35.26:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3884
backgroundTaskHost.exe
23.54.109.203:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.48.23.139
  • 23.48.23.157
  • 23.48.23.153
  • 23.48.23.147
  • 23.48.23.155
  • 23.48.23.149
  • 23.48.23.138
  • 23.48.23.144
  • 23.48.23.190
whitelisted
google.com
  • 142.250.186.142
whitelisted
login.live.com
  • 40.126.32.74
  • 20.190.160.64
  • 40.126.32.72
  • 40.126.32.133
  • 20.190.160.2
  • 40.126.32.76
  • 20.190.160.65
  • 20.190.160.130
whitelisted
ocsp.digicert.com
  • 23.54.109.203
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted

Threats

PID
Process
Class
Message
1184
AddInProcess32.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 13
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
AUTO_ADMITE_TUTERAD.0034202500159.zip