File name:

wiztree_4_25_portable.zip

Full analysis: https://app.any.run/tasks/c5180ed9-4b74-49f4-b871-15173246da66
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Analysis date: March 24, 2025, 14:32:33
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-doc
adware
stealer
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

9C58467395CAF6B7A02E55A14BFDCC6A

SHA1:

5E0D6EFDF0D04A14EAA987602332B1AF3F55E299

SHA256:

F828A01298A38AB86BF32CC15ED9CBD1661197890FE85FFA1988DEEB1DA7D205

SSDEEP:

98304:KI9M3a8TlPpwwqzv80nVV989oraUXylUlou6Uaxv9GQpaWBXuzBivJ+IMKT1fYFJ:Klkjs22CEWRQJQeYsi

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Actions looks like stealing of personal data

      • WizTree64.exe (PID: 632)
  • SUSPICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 660)
    • Access to an unwanted program domain was detected

      • WizTree64.exe (PID: 632)
  • INFO

    • The sample compiled with english language support

      • WinRAR.exe (PID: 660)
    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 660)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2025:02:28 15:49:00
ZipCRC: 0x3e463557
ZipCompressedSize: 3947728
ZipUncompressedSize: 10839144
ZipFileName: WizTree64.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
133
Monitored processes
2
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe wiztree64.exe

Process information

PID
CMD
Path
Indicators
Parent process
632"C:\Users\admin\AppData\Local\Temp\Rar$EXa660.9929\WizTree64.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa660.9929\WizTree64.exe
WinRAR.exe
User:
admin
Company:
Antibody Software Limited
Integrity Level:
MEDIUM
Description:
WizTree
Version:
4.25.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa660.9929\wiztree64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\winmm.dll
c:\windows\system32\rpcrt4.dll
660"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\wiztree_4_25_portable.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
Total events
2 618
Read events
2 610
Write events
8
Delete events
0

Modification events

(PID) Process:(660) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(660) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(660) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(660) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\wiztree_4_25_portable.zip
(PID) Process:(660) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(660) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(660) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(660) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
2
Suspicious files
28
Text files
30
Unknown types
0

Dropped files

PID
Process
Filename
Type
660WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa660.9929\WizTree64.exeexecutable
MD5:0823B9D1B759CAEC05265F4A664DEB90
SHA256:3D8DA42CA5A32EE05787EF0BFADB39F92B23A0C682A188CF6B4048A601A9A5AA
660WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa660.9929\locale\bg\LC_MESSAGES\default.mobinary
MD5:D4A9C291A05B00560159872AB8266736
SHA256:901AE873AC9D89CF482C72B9DE6FD16C843926F099A25CA81DB4A6B3E2B6A8C5
660WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa660.9929\locale\cs\LC_MESSAGES\default.potext
MD5:33D39CB5A9462C7A027DC3947DFFF97B
SHA256:5F47BBF4A5D15F2DA4A9C25384C0364823CF5B8E07C804739E3C31AAA1FB17F3
660WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa660.9929\locale\cs\LC_MESSAGES\default.mobinary
MD5:F4EE17873EB3D86EF5B4EF9DF129DF12
SHA256:BA2E0CD9571CA509B8BD69B36E4DEF36D7E45FB1C8C8BA9D6863B7B051D83AF9
660WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa660.9929\locale\da\LC_MESSAGES\default.potext
MD5:F1EE8DAB3181886AD9BB0DDB907DF683
SHA256:BBC23F69C01D3802F70DE3A932610B42D687F8F1FC26AC96374B7441B9A4A56F
660WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa660.9929\locale\ar\LC_MESSAGES\default.potext
MD5:57C0AFB2ECBEE84AE0B7CF5E43B19125
SHA256:B6DA5C27A6A8671E9637AAED1D7BC5710249175195220FB9CCE33E06840F8826
660WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa660.9929\locale\da\LC_MESSAGES\default.mobinary
MD5:507963D987DFF38968106ED28F606906
SHA256:CF368D0AB7B7CABE8F6FF09FEB250E6C39A825068E52ED641C67DC3BDDBFE5E8
660WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa660.9929\locale\de\LC_MESSAGES\default.potext
MD5:991D927F2BAC7A148276765E19179C99
SHA256:34DE831D552AE731044D9CB3A7E6DEF7E9ECA42BC25F7FAB9E8E1CBD899A6E27
660WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa660.9929\locale\de\LC_MESSAGES\default.mobinary
MD5:AA191A04251AF94E87DCBE72FE03D6C0
SHA256:FB193A46A8D259443358879BD1601E88C2131C28B28F44E3FD6DFE8F35ECB5CB
660WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa660.9929\locale\ar\LC_MESSAGES\default.mobinary
MD5:6A00285133B281D76BC0D372012316E5
SHA256:580332F2C1D6136B19345F5FA8CA180E0DAA0F9698E1F483B4A6CD4A2E8EFDC5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
18
DNS requests
12
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
5512
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
5512
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
whitelisted
5204
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
whitelisted
632
WizTree64.exe
GET
200
23.111.178.178:80
http://antibody-software.com/files/wiztreeversion.php?ver=4.25&newinstall=1
unknown
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
whitelisted
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
whitelisted
3216
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
20.190.160.64:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
20.190.160.64:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5204
backgroundTaskHost.exe
20.223.35.26:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
login.live.com
  • 20.190.160.64
  • 20.190.160.14
  • 40.126.32.74
  • 20.190.160.20
  • 40.126.32.140
  • 40.126.32.136
  • 20.190.160.131
  • 20.190.160.130
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
www.microsoft.com
  • 23.219.150.101
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted
antibody-software.com
  • 23.111.178.178
unknown

Threats

PID
Process
Class
Message
632
WizTree64.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP Antibody Software Installed (PUA)
632
WizTree64.exe
Potentially Bad Traffic
ET USER_AGENTS Suspicious User-Agent (Embarcadero URI Client/1.0)
No debug info