File name:

Office_Tool_v10.19.8.0_x86.zip

Full analysis: https://app.any.run/tasks/fd501b9f-1e43-4fd7-b90c-1c757f579320
Verdict: Malicious activity
Analysis date: December 26, 2024, 00:40:41
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=store
MD5:

1A080165968F8C6D5BEA7DBB98D5741E

SHA1:

AB1408A3ED0677435B7F6D6972165C0BE309946B

SHA256:

FFFC8524E1051816442A140EE5E451CAB9B1D5CF548CEE159CE3C8559DD34544

SSDEEP:

98304:nx7aPXkxd8cWQWsaynaRA+DTJ2hVe8rlDur4ypibqlHNOg09S0d1MbEPJoV6aUXD:tS8Z7bFw4qvaeFuy21UNfAO27Cm

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Antivirus name has been found in the command line (generic signature)

      • MpCmdRun.exe (PID: 5920)
      • MpCmdRun.exe (PID: 1596)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 2324)

    • Starts CMD.EXE for commands execution

      • WinRAR.exe (PID: 2324)

    • Executing commands from a ".bat" file

      • WinRAR.exe (PID: 2324)

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 2324)

  • INFO

    • The sample compiled with chinese language support

      • WinRAR.exe (PID: 2324)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 2324)

    • The process uses the downloaded file

      • WinRAR.exe (PID: 2324)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2324)

    • Create files in a temporary directory

      • MpCmdRun.exe (PID: 5920)

    • Checks supported languages

      • MpCmdRun.exe (PID: 5920)
      • MpCmdRun.exe (PID: 1596)

    • Reads the computer name

      • MpCmdRun.exe (PID: 5920)
      • MpCmdRun.exe (PID: 1596)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2024:12:20 21:12:50
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: Office Tool/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
123
Monitored processes
7
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe cmd.exe no specs conhost.exe no specs mpcmdrun.exe no specs cmd.exe no specs conhost.exe no specs mpcmdrun.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
440C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\Rar$VR2324.48381\Rar$Scan20957.bat" "C:\Windows\System32\cmd.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
1596"C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\admin\AppData\Local\Temp\Rar$VR2324.2254"C:\Program Files\Windows Defender\MpCmdRun.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Malware Protection Command Line Utility
Exit code:
2
Version:
4.18.1909.6 (WinBuild.160101.0800)
Modules
Images
c:\program files\windows defender\mpcmdrun.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
2164\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2224C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\Rar$VR2324.2254\Rar$Scan59480.bat" "C:\Windows\System32\cmd.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
2324"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\Office_Tool_v10.19.8.0_x86.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
5464\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5920"C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\admin\AppData\Local\Temp\Rar$VR2324.48381"C:\Program Files\Windows Defender\MpCmdRun.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Malware Protection Command Line Utility
Exit code:
2
Version:
4.18.1909.6 (WinBuild.160101.0800)
Modules
Images
c:\program files\windows defender\mpcmdrun.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
Total events
1 802
Read events
1 791
Write events
11
Delete events
0

Modification events

(PID) Process:(2324) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(2324) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(2324) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(2324) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Office_Tool_v10.19.8.0_x86.zip
(PID) Process:(2324) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2324) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2324) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2324) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2324) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\VirusScan
Operation:writeName:DefScanner
Value:
Windows Defender
(PID) Process:(2324) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList
Operation:writeName:ArcSort
Value:
32
Executable files
22
Suspicious files
240
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
2324WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR2324.48381\Office_Tool_v10.19.8.0_x86.zip\Office Tool\files\preferences\de-de\settings-onent-de.jsonbinary
MD5:95A143A1B983DC509E16D575AC75CD38
SHA256:41E3B906A846FDA1080FF2A945B01D4F02057A60A7C2F7D75EACD8E5DADE854C
2324WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR2324.48381\Office_Tool_v10.19.8.0_x86.zip\Office Tool\files\preferences\de-de\settings-access-de.jsonbinary
MD5:BD53EAFAA9808246211BE7202ED06B5B
SHA256:23D89AE14372685C67AE1D1A3B5A0C4DCF954ABE3A369D3AFFDD44658D9E35B9
2324WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR2324.48381\Office_Tool_v10.19.8.0_x86.zip\Office Tool\files\preferences\en-us\settings-pub-en.jsonbinary
MD5:7490C524CBFDDD853C4F6E063DCEC527
SHA256:0ADF60254BBE9DA7EC1D842A6EA0418B0E76B786C45C0575621C781E4884CCA7
2324WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR2324.48381\Office_Tool_v10.19.8.0_x86.zip\Office Tool\files\preferences\en-us\settings-visio-en.jsonbinary
MD5:0B71E07EC1F18A0862789E1299741604
SHA256:7D039AA358EA1D2996C4249E2B87A344474C16E50D50AE7C2011AA3ECEE77D10
2324WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR2324.48381\Office_Tool_v10.19.8.0_x86.zip\Office Tool\files\preferences\de-de\settings-proj-de.jsonbinary
MD5:CD20C572890F1025F7002F43FB2A63A1
SHA256:651CD0C91B60A72C26E5F6EAC1ACE2A409B1B76454CEAE68C780F8A874437AF2
2324WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR2324.48381\Office_Tool_v10.19.8.0_x86.zip\Office Tool\files\preferences\de-de\settings-excel-de.jsonbinary
MD5:A5A2DDB5D679F8A91C89BAB337E3567F
SHA256:81F5FBD601534D6F9F19840732FCC7E973841F72036760DE5CD73CFD4E3DA9F9
2324WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR2324.48381\Office_Tool_v10.19.8.0_x86.zip\Office Tool\files\preferences\en-us\settings-access-en.jsonbinary
MD5:9B3421B90762AB9CA88FD94B984DF334
SHA256:697AE3F1C93F502D0B054D872837D9A8C6C3622FCA80C6A95ABBC3D27445E367
2324WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR2324.48381\Office_Tool_v10.19.8.0_x86.zip\Office Tool\files\preferences\en-us\settings-word-en.jsonbinary
MD5:71534A3C317FAE3BE8540FF31115F607
SHA256:BAA7EA88B8BF469E453ACD30CE75ECE82844827405D9FF4B9A7E30882D3F7221
2324WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR2324.48381\Office_Tool_v10.19.8.0_x86.zip\Office Tool\files\preferences\de-de\settings-outlk-de.jsonbinary
MD5:4BF4245AD197A930F4B0C03EBE0A3BDD
SHA256:0AFB82ABB950F0A3F9E0EED3BFEC7755751437110A22FF201E44490557A4609D
2324WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR2324.48381\Office_Tool_v10.19.8.0_x86.zip\Office Tool\files\preferences\en-us\settings-ppt-en.jsonbinary
MD5:2F8DCEE7004B033B49BDA4617EC3D72A
SHA256:EDA94B5DF27C87A6561E4011383D63B7372B24F5E9FBF3FF0FE90AABDC128EFC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
22
DNS requests
8
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6068
svchost.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.19.217.218:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6068
svchost.exe
GET
200
2.19.217.218:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4712
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
6068
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.212.110.152:443
www.bing.com
Akamai International B.V.
CZ
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6068
svchost.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
6068
svchost.exe
2.19.217.218:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4712
MoUsoCoreWorker.exe
2.19.217.218:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
whitelisted
www.bing.com
  • 23.212.110.152
  • 23.212.110.170
  • 23.212.110.162
  • 23.212.110.163
  • 23.212.110.176
  • 23.212.110.169
  • 23.212.110.144
whitelisted
google.com
  • 142.250.185.110
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 2.19.217.218
whitelisted
self.events.data.microsoft.com
  • 52.168.117.174
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Office_Tool_v10.19.8.0_x86.zip