File name:

LibreHardwareMonitor-net472.zip

Full analysis: https://app.any.run/tasks/47be50ee-278b-4ec4-bd40-81a8bf1df108
Verdict: Malicious activity
Analysis date: July 30, 2024, 14:18:52
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

EEC14A641D5F10F55F06478F5DA22C05

SHA1:

12248C40F613EC3AA91CCE913F699D223EF68C57

SHA256:

EF33F7F3F4FCF00CB9B4DF0066CE6D8C5D13C7AC6D99DEFFCB6098EED9573973

SSDEEP:

98304:YZbqrOS6c+HhfpGnk808vHLKZBq2PTxsHFsSJaOpS6/G+2LGIIYZgaCJNGflB2bE:k2I

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 1568)
      • LibreHardwareMonitor.exe (PID: 1136)
      • csc.exe (PID: 3544)

    • Starts Visual C# compiler

      • LibreHardwareMonitor.exe (PID: 1136)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 2412)

    • Drops a system driver (possible attempt to evade defenses)

      • LibreHardwareMonitor.exe (PID: 1136)

    • Executable content was dropped or overwritten

      • LibreHardwareMonitor.exe (PID: 1136)
      • csc.exe (PID: 3544)

    • Uses .NET C# to load dll

      • LibreHardwareMonitor.exe (PID: 1136)

  • INFO

    • Manual execution by a user

      • wmpnscfg.exe (PID: 2736)
      • WinRAR.exe (PID: 2412)
      • LibreHardwareMonitor.exe (PID: 1136)
      • LibreHardwareMonitor.exe (PID: 3892)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2412)

    • Reads the computer name

      • wmpnscfg.exe (PID: 2736)
      • LibreHardwareMonitor.exe (PID: 1136)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 2412)

    • Checks supported languages

      • wmpnscfg.exe (PID: 2736)
      • LibreHardwareMonitor.exe (PID: 1136)
      • csc.exe (PID: 3544)
      • cvtres.exe (PID: 3504)

    • Reads the machine GUID from the registry

      • LibreHardwareMonitor.exe (PID: 1136)
      • csc.exe (PID: 3544)
      • cvtres.exe (PID: 3504)

    • Create files in a temporary directory

      • LibreHardwareMonitor.exe (PID: 1136)
      • mofcomp.exe (PID: 2548)
      • csc.exe (PID: 3544)
      • cvtres.exe (PID: 3504)

    • Reads Environment values

      • LibreHardwareMonitor.exe (PID: 1136)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0008
ZipCompression: Deflated
ZipModifyDate: 2023:12:31 12:52:58
ZipCRC: 0xadc4f5c0
ZipCompressedSize: 61207
ZipUncompressedSize: 146944
ZipFileName: Aga.Controls.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
54
Monitored processes
8
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe no specs wmpnscfg.exe no specs winrar.exe librehardwaremonitor.exe no specs librehardwaremonitor.exe mofcomp.exe no specs csc.exe cvtres.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1136"C:\Users\admin\Desktop\LibreHardwareMonitor-net472\LibreHardwareMonitor.exe" C:\Users\admin\Desktop\LibreHardwareMonitor-net472\LibreHardwareMonitor.exe
explorer.exe
User:
admin
Company:
LibreHardwareMonitor
Integrity Level:
HIGH
Description:
Libre Hardware Monitor
Version:
0.9.3.0
Modules
Images
c:\users\admin\desktop\librehardwaremonitor-net472\librehardwaremonitor.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1568"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\LibreHardwareMonitor-net472.zipC:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2412"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Desktop\LibreHardwareMonitor-net472.zip" C:\Users\admin\Desktop\LibreHardwareMonitor-net472\C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2548"C:\Windows\system32\WBEM\mofcomp.exe" C:\Windows\system32\WBEM\Framework\root\LibreHardwareMonitor\LibreHardwareMonitor_SN__Version_0.9.3.0.mofC:\Windows\System32\wbem\mofcomp.exe—LibreHardwareMonitor.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
The Managed Object Format (MOF) Compiler
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\wbem\mofcomp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
2736"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3504C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RESEF89.tmp" "c:\Users\admin\AppData\Local\Temp\4rkamdfx\CSC3E3F3DDE948648E4A013964033E64C.TMP"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
14.10.25028.0 built by: VCTOOLSD15RTM
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\cvtres.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\vcruntime140_clr0400.dll
c:\windows\system32\ucrtbase_clr0400.dll
3544"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\4rkamdfx\4rkamdfx.cmdline"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
LibreHardwareMonitor.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
4.8.3761.0 built by: NET48REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\csc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\vcruntime140_clr0400.dll
c:\windows\system32\ucrtbase_clr0400.dll
3892"C:\Users\admin\Desktop\LibreHardwareMonitor-net472\LibreHardwareMonitor.exe" C:\Users\admin\Desktop\LibreHardwareMonitor-net472\LibreHardwareMonitor.exe—explorer.exe
User:
admin
Company:
LibreHardwareMonitor
Integrity Level:
MEDIUM
Description:
Libre Hardware Monitor
Exit code:
3221226540
Version:
0.9.3.0
Modules
Images
c:\users\admin\desktop\librehardwaremonitor-net472\librehardwaremonitor.exe
c:\windows\system32\ntdll.dll
Total events
6 759
Read events
6 725
Write events
34
Delete events
0

Modification events

(PID) Process:(1568) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1568) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1568) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1568) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(1568) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(1568) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(1568) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\LibreHardwareMonitor-net472.zip
(PID) Process:(1568) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1568) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1568) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
19
Suspicious files
4
Text files
9
Unknown types
1

Dropped files

PID
Process
Filename
Type
2412WinRAR.exeC:\Users\admin\Desktop\LibreHardwareMonitor-net472\Microsoft.Win32.TaskScheduler.dllexecutable
MD5:A844AC745A4005FBD3F51D79FF88583C
SHA256:74FE1A6A1E36BE7D893E31BBB4D4BD83BF4B927E715276CD5607982139818EBD
2412WinRAR.exeC:\Users\admin\Desktop\LibreHardwareMonitor-net472\LibreHardwareMonitor.exe.configxml
MD5:21FA0B1D75C0CC7369F1E735FE90C7A9
SHA256:AD8267122C40D37DCD9D99E1412D763187A1825732F378DB8867F3ECF675CF70
2412WinRAR.exeC:\Users\admin\Desktop\LibreHardwareMonitor-net472\LibreHardwareMonitorLib.dllexecutable
MD5:5B4FF376C0A64564DBDC149E686035E0
SHA256:A24C7CBB3D6CA12950E570FBAD82778A87C87311CDE6218914A283A2C0A04E19
2412WinRAR.exeC:\Users\admin\Desktop\LibreHardwareMonitor-net472\OxyPlot.dllexecutable
MD5:E3AE54D182070B2622688F8797407A5D
SHA256:7628A1595D0CAABE0A2A042079EA53E15608AF49096C175A1D5E7F93FC0EA8F8
2412WinRAR.exeC:\Users\admin\Desktop\LibreHardwareMonitor-net472\Aga.Controls.pdbpdb
MD5:66EFF911A602F41206C7E4CF7F7D11AC
SHA256:7C0574A4270AB68B315E92AC7F182237B8DE0A9CEB0189ABBF25A1748E86350D
2412WinRAR.exeC:\Users\admin\Desktop\LibreHardwareMonitor-net472\LibreHardwareMonitorLib.xmlxml
MD5:105CC7617B843C786A9BCD8EF6A76CD5
SHA256:63045964EE6138F26FD8CE7083D9873033D7CB5AA95F14C7CCD6397768402811
2412WinRAR.exeC:\Users\admin\Desktop\LibreHardwareMonitor-net472\Newtonsoft.Json.dllexecutable
MD5:195FFB7167DB3219B217C4FD439EEDD6
SHA256:E1E27AF7B07EEEDF5CE71A9255F0422816A6FC5849A483C6714E1B472044FA9D
2412WinRAR.exeC:\Users\admin\Desktop\LibreHardwareMonitor-net472\LibreHardwareMonitorLib.pdbbinary
MD5:68BE4ED297BE38F65CC150A3C4611C50
SHA256:139824062A36EAE0AA689F01191F093693841B1FB904B8EDA0B80DDC1EB5CDB4
2412WinRAR.exeC:\Users\admin\Desktop\LibreHardwareMonitor-net472\es\Microsoft.Win32.TaskScheduler.resources.dllexecutable
MD5:15DB634B70D6D9D6CD41BAAE3F02EB14
SHA256:E893C6907DA8D68C03B1A10E68B554AD5A8C0533F15912106F32E925F2BEABF0
2412WinRAR.exeC:\Users\admin\Desktop\LibreHardwareMonitor-net472\System.CodeDom.dllexecutable
MD5:59C830AC0D99F8C906292DE85F804B84
SHA256:E8C88B0448083663910587EFEACB6A1977749FE3FFE83B263FC01F7B63D7DFD2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
10
DNS requests
7
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1372
svchost.exe
GET
304
23.50.131.216:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?33775f6043c93e33
unknown
—
—
whitelisted
1060
svchost.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?fbe613066ac7852b
unknown
—
—
whitelisted
1372
svchost.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1372
svchost.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
whitelisted
1372
svchost.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
1060
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
1372
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1372
svchost.exe
23.50.131.216:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
1372
svchost.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
1372
svchost.exe
23.52.120.96:80
www.microsoft.com
AKAMAI-AS
DE
unknown
1060
svchost.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.142
whitelisted
dns.msftncsi.com
  • 131.107.255.255
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
ctldl.windowsupdate.com
  • 23.50.131.216
  • 23.50.131.200
  • 93.184.221.240
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 23.52.120.96
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
LibreHardwareMonitor-net472.zip