File name:

hidusbf.zip

Full analysis: https://app.any.run/tasks/11945749-315a-4a29-98fe-3e49adece406
Verdict: Malicious activity
Analysis date: December 03, 2024, 20:20:46
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
arch-doc
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=store
MD5:

91F9D7834431CCDB8640E6514413BB2E

SHA1:

99E180FABED3F805D4A09E3121DBB53D56883051

SHA256:

EA74EAE4F4F074DEF0328ADE4F2414C3090F34E35226D1FDEC07DCE90F2DA7E3

SSDEEP:

24576:kuG6O+oo1+oorQ2Yh/QwTj7xKceaaj/HWS4OXQ4euMSZMBi0BHu/jy:kD6O+oo1+oorQ2Yh/QwTj7xKceaaj/H6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 6376)

    • Executing a file with an untrusted certificate

      • Setup.exe (PID: 3420)
      • Setup.exe (PID: 4136)

  • SUSPICIOUS

    • Drops a system driver (possible attempt to evade defenses)

      • WinRAR.exe (PID: 6376)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6376)

    • Manual execution by a user

      • Setup.exe (PID: 3420)
      • Setup.exe (PID: 4136)
      • Taskmgr.exe (PID: 5040)
      • Taskmgr.exe (PID: 2512)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2008:04:15 15:30:18
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: DRIVER/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
135
Monitored processes
6
Malicious processes
1
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe rundll32.exe no specs setup.exe no specs setup.exe taskmgr.exe no specs taskmgr.exe

Process information

PID
CMD
Path
Indicators
Parent process
2512"C:\WINDOWS\system32\taskmgr.exe" /4C:\Windows\System32\Taskmgr.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Manager
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\combase.dll
3420"C:\Users\admin\Downloads\DRIVER\Setup.exe" C:\Users\admin\Downloads\DRIVER\Setup.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\downloads\driver\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
4136"C:\Users\admin\Downloads\DRIVER\Setup.exe" C:\Users\admin\Downloads\DRIVER\Setup.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\downloads\driver\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
4724C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
5040"C:\WINDOWS\system32\taskmgr.exe" /4C:\Windows\System32\Taskmgr.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Manager
Exit code:
3221226540
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
6376"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\hidusbf.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
Total events
4 059
Read events
4 033
Write events
12
Delete events
14

Modification events

(PID) Process:(6376) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6376) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6376) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6376) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\hidusbf.zip
(PID) Process:(6376) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6376) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6376) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6376) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6376) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:15
Value:
(PID) Process:(6376) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:14
Value:
Executable files
23
Suspicious files
4
Text files
8
Unknown types
0

Dropped files

PID
Process
Filename
Type
6376WinRAR.exeC:\Users\admin\Downloads\DRIVER\NTX86\nopatch\hidusbf.sysexecutable
MD5:2122564C266A79E73FA73A44523783DC
SHA256:A3CBA51DC28B10F7BE1A232BE0D6CEC6D734B6753AB7054169A04CE22335F7D8
6376WinRAR.exeC:\Users\admin\Downloads\DRIVER\AMD64\2khz-4khz\hidusbf.sysexecutable
MD5:52A628ECC5B5D74F3F9F03FE6FD49C30
SHA256:841D8EC5B070D068B0BF97C8EA255CD3AE9360FCA4BE2FB61149411419DBE755
6376WinRAR.exeC:\Users\admin\Downloads\DRIVER\AMD64\hidusbf.sysexecutable
MD5:C0C8BDFA88BFAF4552B1C50BEDB2E20D
SHA256:EC97D9C203B6FC47605027DE2E65891C63C8088230F5F8B59E705F40E0BD860A
6376WinRAR.exeC:\Users\admin\Downloads\DRIVER\sx64.exeexecutable
MD5:722C4801D445CB49477A6A60AFF8E6E8
SHA256:B0DF95C336A135B3F0D61DFB4914FAD4C0288EA4527D71F514FE7016ED331053
6376WinRAR.exeC:\Users\admin\Downloads\DRIVER\HIDUSBFU.INFbinary
MD5:F7E4E141E16CE4AF4879EBB7644F7992
SHA256:1A259212D637A4D72A023C3CBB78577E8336BDEA4711C23F57A78E7230C0B1BF
6376WinRAR.exeC:\Users\admin\Downloads\DRIVER\HIDUSBF.INFbinary
MD5:8EAD6929CA01C948532FC16CEF6B8591
SHA256:9F98870BA3CBF2B992C848BC7447685B70C0A06D2DD31975CBD8CE3E8235E5A5
6376WinRAR.exeC:\Users\admin\Downloads\DRIVER\AMD64\4khz-8khz\hidusbf.sysexecutable
MD5:DFE3AEEA9E6C889698FE12F5308C810F
SHA256:889241E792A3E58673EB98D4D1815C8073A6BCFA0ABC6C3AF060C5C6E7B94302
6376WinRAR.exeC:\Users\admin\Downloads\DRIVER\98ME\hidusbf.sysexecutable
MD5:DAC9A10C24B1770031C1F29934853422
SHA256:B14D9D4946A70259038E9B284FD9E9423E95D2CC048D46665E090B4BFB5C73F5
6376WinRAR.exeC:\Users\admin\Downloads\DRIVER\AMD64\1khz\hidusbf.sysexecutable
MD5:C0C8BDFA88BFAF4552B1C50BEDB2E20D
SHA256:EC97D9C203B6FC47605027DE2E65891C63C8088230F5F8B59E705F40E0BD860A
6376WinRAR.exeC:\Users\admin\Downloads\DRIVER\1kHz.cmdtext
MD5:0E5DFCAAF161C50462DF12B8372E87CB
SHA256:4153A509905F2AE92EEE1578E7E2D0EC8FC734C24A6B6F7ED07F6DFE142724C3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
33
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6592
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1876
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
1876
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4536
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5064
SearchApp.exe
92.123.104.31:443
www.bing.com
Akamai International B.V.
DE
whitelisted
1076
svchost.exe
69.192.162.125:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted
1176
svchost.exe
20.190.159.0:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 23.35.229.160
  • 88.221.169.152
whitelisted
google.com
  • 216.58.206.46
whitelisted
www.bing.com
  • 92.123.104.31
  • 92.123.104.52
  • 92.123.104.43
  • 92.123.104.30
  • 92.123.104.33
  • 92.123.104.32
  • 92.123.104.26
  • 92.123.104.46
  • 92.123.104.38
whitelisted
go.microsoft.com
  • 69.192.162.125
whitelisted
login.live.com
  • 20.190.159.0
  • 20.190.159.71
  • 40.126.31.73
  • 20.190.159.23
  • 20.190.159.64
  • 20.190.159.2
  • 20.190.159.4
  • 20.190.159.73
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
arc.msn.com
  • 20.199.58.43
whitelisted
fd.api.iris.microsoft.com
  • 20.105.99.58
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
hidusbf.zip