File name:

WinRGBDestructive.zip

Full analysis: https://app.any.run/tasks/2b85ed79-d9a4-4cf8-9ab0-b5d19ac9c344
Verdict: Malicious activity
Analysis date: July 22, 2022, 01:53:52
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

2CCF48C0F0E4379E7FE1290008E9E27B

SHA1:

4841AE2EF01EB9CF6046034EE605EB0082EFCD48

SHA256:

F14DC938825E26808CEB544D8DBDEEA14A3E88EE299D9B07F60B851E4F4B188B

SSDEEP:

98304:AUKmwLFDU3FsvhB70f+deONz7niiyvMwsNAyOyOnGw+/asdVLor85nw2pVistzQ0:CxLFDUGhq4799OnG3isTDnwOQo8CV

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • WinRGBDestructive.exe (PID: 2976)
      • WinRGBDestructive.exe (PID: 268)
      • bytebeat1.exe (PID: 1904)
      • Lines.exe (PID: 3632)
      • rgb.exe (PID: 3412)
      • sinewaves.exe (PID: 2468)
      • mbr.exe (PID: 1908)

    • Drops executable file immediately after starts

      • WinRAR.exe (PID: 3296)
      • WinRGBDestructive.exe (PID: 268)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3296)
      • WinRGBDestructive.exe (PID: 268)

    • Checks supported languages

      • WinRAR.exe (PID: 3296)
      • WinRGBDestructive.exe (PID: 268)
      • rgb.exe (PID: 3412)
      • sinewaves.exe (PID: 2468)
      • wscript.exe (PID: 3712)
      • mbr.exe (PID: 1908)
      • bytebeat1.exe (PID: 1904)
      • Lines.exe (PID: 3632)

    • Reads the computer name

      • WinRAR.exe (PID: 3296)
      • bytebeat1.exe (PID: 1904)
      • WinRGBDestructive.exe (PID: 268)
      • wscript.exe (PID: 3712)

    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 3296)
      • WinRGBDestructive.exe (PID: 268)

    • Executes scripts

      • WinRGBDestructive.exe (PID: 268)

  • INFO

    • Manual execution by user

      • WinRGBDestructive.exe (PID: 2976)
      • WinRGBDestructive.exe (PID: 268)

    • Checks Windows Trust Settings

      • wscript.exe (PID: 3712)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: WinRGBDestructive.exe
ZipUncompressedSize: 810496
ZipCompressedSize: 806787
ZipCRC: 0x9511e736
ZipModifyDate: 2022:04:16 10:07:15
ZipCompression: Deflated
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
46
Monitored processes
9
Malicious processes
2
Suspicious processes
3

Behavior graph

Click at the process to see the details
start winrar.exe winrgbdestructive.exe no specs winrgbdestructive.exe wscript.exe no specs mbr.exe no specs bytebeat1.exe no specs rgb.exe no specs sinewaves.exe no specs lines.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
268"C:\Users\admin\Desktop\WinRGBDestructive.exe" C:\Users\admin\Desktop\WinRGBDestructive.exe
Explorer.EXE
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\winrgbdestructive.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
1904"C:\Users\admin\AppData\Local\Temp\2682.tmp\bytebeat1.exe" C:\Users\admin\AppData\Local\Temp\2682.tmp\bytebeat1.exe—wscript.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\2682.tmp\bytebeat1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\winmm.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
1908"C:\Users\admin\AppData\Local\Temp\2682.tmp\mbr.exe" C:\Users\admin\AppData\Local\Temp\2682.tmp\mbr.exe—wscript.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\2682.tmp\mbr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
2468"C:\Users\admin\AppData\Local\Temp\2682.tmp\sinewaves.exe" C:\Users\admin\AppData\Local\Temp\2682.tmp\sinewaves.exe—wscript.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\2682.tmp\sinewaves.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msvcrt.dll
2976"C:\Users\admin\Desktop\WinRGBDestructive.exe" C:\Users\admin\Desktop\WinRGBDestructive.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\winrgbdestructive.exe
c:\windows\system32\ntdll.dll
3296"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\WinRGBDestructive.zip"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3412"C:\Users\admin\AppData\Local\Temp\2682.tmp\rgb.exe" C:\Users\admin\AppData\Local\Temp\2682.tmp\rgb.exe—wscript.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\2682.tmp\rgb.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
3632"C:\Users\admin\AppData\Local\Temp\2682.tmp\Lines.exe" C:\Users\admin\AppData\Local\Temp\2682.tmp\Lines.exe—wscript.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\2682.tmp\lines.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
3712"C:\Windows\system32\wscript.exe" C:\Users\admin\AppData\Local\Temp\2682.tmp\2683.tmp\2684.vbs //Nologo C:\Windows\system32\wscript.exe—WinRGBDestructive.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
2 080
Read events
2 051
Write events
29
Delete events
0

Modification events

(PID) Process:(3296) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3296) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3296) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3296) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3296) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3296) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\WinRGBDestructive.zip
(PID) Process:(3296) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3296) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3296) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3296) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
12
Suspicious files
1
Text files
12
Unknown types
1

Dropped files

PID
Process
Filename
Type
268WinRGBDestructive.exeC:\Users\admin\AppData\Local\Temp\2682.tmp\bytebeat1.cpptext
MD5:68C309CE1FAEFBF83A6F4B9988B84D2F
SHA256:D1FED31D11B387B29AE25E9CBC43AAA633A60BECA039A4AFCFBA4FB11117C11A
268WinRGBDestructive.exeC:\Users\admin\AppData\Local\Temp\2682.tmp\bytebeat1.exeexecutable
MD5:6B673ECE600BCC8A665EBF251D7D926E
SHA256:41AC58D922F32134E75E87898D2C179D478C81EDAAE0D9BC28E7CE7D6F422F8B
3296WinRAR.exeC:\Users\admin\Desktop\WinRGBDestructive.exeexecutable
MD5:E9D46548E6009B9DD5648FCE65B22511
SHA256:E320066F7580BB1D65F073FC673E14B5FE07021474E9254E8A78B3BB4F28E0BE
268WinRGBDestructive.exeC:\Users\admin\AppData\Local\Temp\2682.tmp\bytebeat1.txttext
MD5:848CDE3FC92870D6315795FA5E0CFEFA
SHA256:185E5B831B37F992D07570B7A2EFFDE08734513884867967B67B2086ECE659E6
268WinRGBDestructive.exeC:\Users\admin\AppData\Local\Temp\2682.tmp\bsod.cpptext
MD5:CA73D197DEF1B095BC712CBEC6168FE2
SHA256:72BB7E3AE6DA142F61E824951DC4ADD9B1851C010CCABF6C68671AF0C970ECCB
268WinRGBDestructive.exeC:\Users\admin\AppData\Local\Temp\2682.tmp\bsod.exeexecutable
MD5:2C0970F41F80A89AF6DA46F72076A008
SHA256:B1CB05D160F4469801CB993F76B2BBB7B077611973B4A914F50752B5852770D6
268WinRGBDestructive.exeC:\Users\admin\AppData\Local\Temp\2682.tmp\bytebeat1.wavwav
MD5:09D2094F56D2D38AA64EAC1D90C5A554
SHA256:4599F6F06C7F491A50E3C4012A83CCE9F3EE13AE209189CB8964F0B6BA14614C
268WinRGBDestructive.exeC:\Users\admin\AppData\Local\Temp\2682.tmp\cubes.cpptext
MD5:A7B13FE165BE9EE2D89CF818D25C6B78
SHA256:C385660B680E0EE1C0C3AD0D76246E6088963DBCBD316E1ABCC0661C741E3E5C
268WinRGBDestructive.exeC:\Users\admin\AppData\Local\Temp\2682.tmp\2683.tmp\2684.vbsbinary
MD5:DBE460E73BC825119C6326250AC8F223
SHA256:39EC4EDE07D340F3CE319A28DA8EBF3CDEE86AE95241A53FA99FE729746AAEF0
268WinRGBDestructive.exeC:\Users\admin\AppData\Local\Temp\2682.tmp\mbr.cpptext
MD5:D20EDDECB5625B60D61D80C067537188
SHA256:45EAA30A90C739FD9FB32D59B29D3E7CD8871431670A3E64D6C34FD53A08F979
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
WinRGBDestructive.zip