File name:

LibreHardwareMonitor-net472.zip

Full analysis: https://app.any.run/tasks/47be50ee-278b-4ec4-bd40-81a8bf1df108
Verdict: Malicious activity
Analysis date: July 30, 2024, 14:18:52
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

EEC14A641D5F10F55F06478F5DA22C05

SHA1:

12248C40F613EC3AA91CCE913F699D223EF68C57

SHA256:

EF33F7F3F4FCF00CB9B4DF0066CE6D8C5D13C7AC6D99DEFFCB6098EED9573973

SSDEEP:

98304:YZbqrOS6c+HhfpGnk808vHLKZBq2PTxsHFsSJaOpS6/G+2LGIIYZgaCJNGflB2bE:k2I

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 1568)
      • LibreHardwareMonitor.exe (PID: 1136)
      • csc.exe (PID: 3544)

    • Starts Visual C# compiler

      • LibreHardwareMonitor.exe (PID: 1136)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 2412)

    • Drops a system driver (possible attempt to evade defenses)

      • LibreHardwareMonitor.exe (PID: 1136)

    • Executable content was dropped or overwritten

      • LibreHardwareMonitor.exe (PID: 1136)
      • csc.exe (PID: 3544)

    • Uses .NET C# to load dll

      • LibreHardwareMonitor.exe (PID: 1136)

  • INFO

    • Checks supported languages

      • wmpnscfg.exe (PID: 2736)
      • LibreHardwareMonitor.exe (PID: 1136)
      • csc.exe (PID: 3544)
      • cvtres.exe (PID: 3504)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2412)

    • Reads the computer name

      • wmpnscfg.exe (PID: 2736)
      • LibreHardwareMonitor.exe (PID: 1136)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 2736)
      • WinRAR.exe (PID: 2412)
      • LibreHardwareMonitor.exe (PID: 3892)
      • LibreHardwareMonitor.exe (PID: 1136)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 2412)

    • Reads the machine GUID from the registry

      • LibreHardwareMonitor.exe (PID: 1136)
      • csc.exe (PID: 3544)
      • cvtres.exe (PID: 3504)

    • Create files in a temporary directory

      • mofcomp.exe (PID: 2548)
      • LibreHardwareMonitor.exe (PID: 1136)
      • csc.exe (PID: 3544)
      • cvtres.exe (PID: 3504)

    • Reads Environment values

      • LibreHardwareMonitor.exe (PID: 1136)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0008
ZipCompression: Deflated
ZipModifyDate: 2023:12:31 12:52:58
ZipCRC: 0xadc4f5c0
ZipCompressedSize: 61207
ZipUncompressedSize: 146944
ZipFileName: Aga.Controls.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
54
Monitored processes
8
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe no specs wmpnscfg.exe no specs winrar.exe librehardwaremonitor.exe no specs librehardwaremonitor.exe mofcomp.exe no specs csc.exe cvtres.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1136"C:\Users\admin\Desktop\LibreHardwareMonitor-net472\LibreHardwareMonitor.exe" C:\Users\admin\Desktop\LibreHardwareMonitor-net472\LibreHardwareMonitor.exe
explorer.exe
User:
admin
Company:
LibreHardwareMonitor
Integrity Level:
HIGH
Description:
Libre Hardware Monitor
Version:
0.9.3.0
Modules
Images
c:\users\admin\desktop\librehardwaremonitor-net472\librehardwaremonitor.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1568"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\LibreHardwareMonitor-net472.zipC:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2412"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Desktop\LibreHardwareMonitor-net472.zip" C:\Users\admin\Desktop\LibreHardwareMonitor-net472\C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2548"C:\Windows\system32\WBEM\mofcomp.exe" C:\Windows\system32\WBEM\Framework\root\LibreHardwareMonitor\LibreHardwareMonitor_SN__Version_0.9.3.0.mofC:\Windows\System32\wbem\mofcomp.exe—LibreHardwareMonitor.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
The Managed Object Format (MOF) Compiler
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\wbem\mofcomp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
2736"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3504C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RESEF89.tmp" "c:\Users\admin\AppData\Local\Temp\4rkamdfx\CSC3E3F3DDE948648E4A013964033E64C.TMP"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
14.10.25028.0 built by: VCTOOLSD15RTM
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\cvtres.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\vcruntime140_clr0400.dll
c:\windows\system32\ucrtbase_clr0400.dll
3544"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\4rkamdfx\4rkamdfx.cmdline"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
LibreHardwareMonitor.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
4.8.3761.0 built by: NET48REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\csc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\vcruntime140_clr0400.dll
c:\windows\system32\ucrtbase_clr0400.dll
3892"C:\Users\admin\Desktop\LibreHardwareMonitor-net472\LibreHardwareMonitor.exe" C:\Users\admin\Desktop\LibreHardwareMonitor-net472\LibreHardwareMonitor.exe—explorer.exe
User:
admin
Company:
LibreHardwareMonitor
Integrity Level:
MEDIUM
Description:
Libre Hardware Monitor
Exit code:
3221226540
Version:
0.9.3.0
Modules
Images
c:\users\admin\desktop\librehardwaremonitor-net472\librehardwaremonitor.exe
c:\windows\system32\ntdll.dll
Total events
6 759
Read events
6 725
Write events
34
Delete events
0

Modification events

(PID) Process:(1568) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1568) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1568) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1568) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(1568) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(1568) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(1568) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\LibreHardwareMonitor-net472.zip
(PID) Process:(1568) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1568) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1568) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
19
Suspicious files
4
Text files
9
Unknown types
1

Dropped files

PID
Process
Filename
Type
2412WinRAR.exeC:\Users\admin\Desktop\LibreHardwareMonitor-net472\LibreHardwareMonitorLib.xmlxml
MD5:105CC7617B843C786A9BCD8EF6A76CD5
SHA256:63045964EE6138F26FD8CE7083D9873033D7CB5AA95F14C7CCD6397768402811
2412WinRAR.exeC:\Users\admin\Desktop\LibreHardwareMonitor-net472\Newtonsoft.Json.dllexecutable
MD5:195FFB7167DB3219B217C4FD439EEDD6
SHA256:E1E27AF7B07EEEDF5CE71A9255F0422816A6FC5849A483C6714E1B472044FA9D
2412WinRAR.exeC:\Users\admin\Desktop\LibreHardwareMonitor-net472\OxyPlot.WindowsForms.dllexecutable
MD5:42DB63F47FF2B3EB71CA4E1B24C9C7E4
SHA256:57BB97DD3053D9849490721B2E1F671E28062C5B416D45E8D447F8180DCA19ED
2412WinRAR.exeC:\Users\admin\Desktop\LibreHardwareMonitor-net472\Aga.Controls.dllexecutable
MD5:A492C040DC7F2749DB754274D0B7AA1B
SHA256:C5FDF080CCE883D702EBB6660B9A4FEF6B2D17CE3E4D2C785DD66A969CF67CAC
2412WinRAR.exeC:\Users\admin\Desktop\LibreHardwareMonitor-net472\HidSharp.dllexecutable
MD5:8D3EB299F8447B633334D1C426A2F0F7
SHA256:8C58E5FBA22ACC751032DFE97CE633E4F8A4C96089749BF316D55283B36649C2
2412WinRAR.exeC:\Users\admin\Desktop\LibreHardwareMonitor-net472\LibreHardwareMonitorLib.pdbbinary
MD5:68BE4ED297BE38F65CC150A3C4611C50
SHA256:139824062A36EAE0AA689F01191F093693841B1FB904B8EDA0B80DDC1EB5CDB4
2412WinRAR.exeC:\Users\admin\Desktop\LibreHardwareMonitor-net472\LibreHardwareMonitor.exeexecutable
MD5:40D8A89DE4E6B12F4F5D146EDDBF14B6
SHA256:2811FA3CF6DA248AFD46032D8407F5466C011F6B814BA3D24A178A161E4259D3
2412WinRAR.exeC:\Users\admin\Desktop\LibreHardwareMonitor-net472\LibreHardwareMonitorLib.dllexecutable
MD5:5B4FF376C0A64564DBDC149E686035E0
SHA256:A24C7CBB3D6CA12950E570FBAD82778A87C87311CDE6218914A283A2C0A04E19
2412WinRAR.exeC:\Users\admin\Desktop\LibreHardwareMonitor-net472\LibreHardwareMonitor.exe.configxml
MD5:21FA0B1D75C0CC7369F1E735FE90C7A9
SHA256:AD8267122C40D37DCD9D99E1412D763187A1825732F378DB8867F3ECF675CF70
2412WinRAR.exeC:\Users\admin\Desktop\LibreHardwareMonitor-net472\Aga.Controls.pdbpdb
MD5:66EFF911A602F41206C7E4CF7F7D11AC
SHA256:7C0574A4270AB68B315E92AC7F182237B8DE0A9CEB0189ABBF25A1748E86350D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
10
DNS requests
7
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1372
svchost.exe
GET
304
23.50.131.216:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?33775f6043c93e33
unknown
—
—
whitelisted
1060
svchost.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?fbe613066ac7852b
unknown
—
—
whitelisted
1372
svchost.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1372
svchost.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
whitelisted
1372
svchost.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
1060
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
1372
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1372
svchost.exe
23.50.131.216:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
1372
svchost.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
1372
svchost.exe
23.52.120.96:80
www.microsoft.com
AKAMAI-AS
DE
unknown
1060
svchost.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.142
whitelisted
dns.msftncsi.com
  • 131.107.255.255
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
ctldl.windowsupdate.com
  • 23.50.131.216
  • 23.50.131.200
  • 93.184.221.240
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 23.52.120.96
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
LibreHardwareMonitor-net472.zip