File name:

hidusbf.zip

Full analysis: https://app.any.run/tasks/11945749-315a-4a29-98fe-3e49adece406
Verdict: Malicious activity
Analysis date: December 03, 2024, 20:20:46
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
arch-doc
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=store
MD5:

91F9D7834431CCDB8640E6514413BB2E

SHA1:

99E180FABED3F805D4A09E3121DBB53D56883051

SHA256:

EA74EAE4F4F074DEF0328ADE4F2414C3090F34E35226D1FDEC07DCE90F2DA7E3

SSDEEP:

24576:kuG6O+oo1+oorQ2Yh/QwTj7xKceaaj/HWS4OXQ4euMSZMBi0BHu/jy:kD6O+oo1+oorQ2Yh/QwTj7xKceaaj/H6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 6376)

    • Executing a file with an untrusted certificate

      • Setup.exe (PID: 3420)
      • Setup.exe (PID: 4136)

  • SUSPICIOUS

    • Drops a system driver (possible attempt to evade defenses)

      • WinRAR.exe (PID: 6376)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6376)

    • Manual execution by a user

      • Setup.exe (PID: 4136)
      • Taskmgr.exe (PID: 2512)
      • Taskmgr.exe (PID: 5040)
      • Setup.exe (PID: 3420)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2008:04:15 15:30:18
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: DRIVER/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
135
Monitored processes
6
Malicious processes
1
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe rundll32.exe no specs setup.exe no specs setup.exe taskmgr.exe no specs taskmgr.exe

Process information

PID
CMD
Path
Indicators
Parent process
2512"C:\WINDOWS\system32\taskmgr.exe" /4C:\Windows\System32\Taskmgr.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Manager
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\combase.dll
3420"C:\Users\admin\Downloads\DRIVER\Setup.exe" C:\Users\admin\Downloads\DRIVER\Setup.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\downloads\driver\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
4136"C:\Users\admin\Downloads\DRIVER\Setup.exe" C:\Users\admin\Downloads\DRIVER\Setup.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\downloads\driver\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
4724C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
5040"C:\WINDOWS\system32\taskmgr.exe" /4C:\Windows\System32\Taskmgr.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Manager
Exit code:
3221226540
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
6376"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\hidusbf.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
Total events
4 059
Read events
4 033
Write events
12
Delete events
14

Modification events

(PID) Process:(6376) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6376) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6376) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6376) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\hidusbf.zip
(PID) Process:(6376) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6376) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6376) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6376) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6376) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:15
Value:
(PID) Process:(6376) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:14
Value:
Executable files
23
Suspicious files
4
Text files
8
Unknown types
0

Dropped files

PID
Process
Filename
Type
6376WinRAR.exeC:\Users\admin\Downloads\DRIVER\AMD64\hidusbf.sysexecutable
MD5:C0C8BDFA88BFAF4552B1C50BEDB2E20D
SHA256:EC97D9C203B6FC47605027DE2E65891C63C8088230F5F8B59E705F40E0BD860A
6376WinRAR.exeC:\Users\admin\Downloads\DRIVER\AMD64\1khz\hidusbf.sysexecutable
MD5:C0C8BDFA88BFAF4552B1C50BEDB2E20D
SHA256:EC97D9C203B6FC47605027DE2E65891C63C8088230F5F8B59E705F40E0BD860A
6376WinRAR.exeC:\Users\admin\Downloads\DRIVER\98ME\hidusbf.sysexecutable
MD5:DAC9A10C24B1770031C1F29934853422
SHA256:B14D9D4946A70259038E9B284FD9E9423E95D2CC048D46665E090B4BFB5C73F5
6376WinRAR.exeC:\Users\admin\Downloads\DRIVER\AMD64\nopatch\hidusbf.sysexecutable
MD5:846D9A8DE2927AB31C1A9DE2892EA8B9
SHA256:6A85DF7738F2A04BA9576A7690D1AD67D385D0F6957ADF16027B804F485EEF04
6376WinRAR.exeC:\Users\admin\Downloads\DRIVER\Setup.exeexecutable
MD5:D2C32637681EBC9F9DD1835100CE8CA5
SHA256:5F339D5C59BB983296D76A1B05AAC746CA2E5EE8C0D2F6AB8DB9A19ED98121C6
6376WinRAR.exeC:\Users\admin\Downloads\DRIVER\HIDUSBFU.INFbinary
MD5:F7E4E141E16CE4AF4879EBB7644F7992
SHA256:1A259212D637A4D72A023C3CBB78577E8336BDEA4711C23F57A78E7230C0B1BF
6376WinRAR.exeC:\Users\admin\Downloads\DRIVER\2kHz-4kHz.cmdtext
MD5:CFA099C407DCC29C80DF3CC485EB428A
SHA256:766954A41C08E210FD5B7A31968CC3F6CD3D86227D0C35A1F1CC2FECF89B233A
6376WinRAR.exeC:\Users\admin\Downloads\DRIVER\1kHz.cmdtext
MD5:0E5DFCAAF161C50462DF12B8372E87CB
SHA256:4153A509905F2AE92EEE1578E7E2D0EC8FC734C24A6B6F7ED07F6DFE142724C3
6376WinRAR.exeC:\Users\admin\Downloads\DRIVER\nopatch.cmdtext
MD5:805AC1CD9F18923F83DA46466EAFE0D9
SHA256:C270E8D582B4DE1327D1FDDFCE08932673286F23727B257365C76CED1A6F8A78
6376WinRAR.exeC:\Users\admin\Downloads\DRIVER\NTX86\hidusbf.sysexecutable
MD5:40047C4BBD53B7383134E92175F24296
SHA256:E753BF75D6D8AF04E409D6797DDDDDD287A952070A3779C6D6354623E71A2EEC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
33
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6592
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
1876
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
1876
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4536
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5064
SearchApp.exe
92.123.104.31:443
www.bing.com
Akamai International B.V.
DE
whitelisted
1076
svchost.exe
69.192.162.125:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted
1176
svchost.exe
20.190.159.0:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 23.35.229.160
  • 88.221.169.152
whitelisted
google.com
  • 216.58.206.46
whitelisted
www.bing.com
  • 92.123.104.31
  • 92.123.104.52
  • 92.123.104.43
  • 92.123.104.30
  • 92.123.104.33
  • 92.123.104.32
  • 92.123.104.26
  • 92.123.104.46
  • 92.123.104.38
whitelisted
go.microsoft.com
  • 69.192.162.125
whitelisted
login.live.com
  • 20.190.159.0
  • 20.190.159.71
  • 40.126.31.73
  • 20.190.159.23
  • 20.190.159.64
  • 20.190.159.2
  • 20.190.159.4
  • 20.190.159.73
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
arc.msn.com
  • 20.199.58.43
whitelisted
fd.api.iris.microsoft.com
  • 20.105.99.58
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
hidusbf.zip