analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

hwi_772.zip

Full analysis: https://app.any.run/tasks/0e0a2d33-6ebe-4f2d-aeb7-476a3917981e
Verdict: Malicious activity
Analysis date: March 08, 2024, 11:42:19
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

DA51113A7BE83E97B601D359D74F7B79

SHA1:

35BDCFEFBB3FBFBCCA362228C65CB258C32845A6

SHA256:

5DB2364E372FA2B9A1D81A66A9FB4B4298F74915EDA7EEA7F9BB0F6F8E1DE6CD

SSDEEP:

98304:l/ktAAvgIKJKRZMPeYc4ASeg0y+tbDNDXV5yA3Zq3JcXcwiv8OGj5pI980zWJ4q4:iXPOmOJ/Hjq9tf3Ka/aQGXpi4/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3972)
      • HWiNFO32.exe (PID: 116)
      • cpuz_x32.exe (PID: 1020)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • HWiNFO32.exe (PID: 116)
      • cpuz_x32.exe (PID: 1020)

    • Drops a system driver (possible attempt to evade defenses)

      • HWiNFO32.exe (PID: 116)
      • cpuz_x32.exe (PID: 1020)

    • Checks Windows Trust Settings

      • HWiNFO32.exe (PID: 116)
      • cpuz_x32.exe (PID: 1020)

    • Reads settings of System Certificates

      • HWiNFO32.exe (PID: 116)
      • cpuz_x32.exe (PID: 1020)

    • Reads the BIOS version

      • HWiNFO32.exe (PID: 116)

    • Reads security settings of Internet Explorer

      • HWiNFO32.exe (PID: 116)
      • cpuz_x32.exe (PID: 1020)

    • Reads the Internet Settings

      • HWiNFO32.exe (PID: 116)
      • cpuz_x32.exe (PID: 1020)

    • Adds/modifies Windows certificates

      • cpuz_x32.exe (PID: 1020)

  • INFO

    • Checks supported languages

      • HWiNFO32.exe (PID: 116)
      • cpuz_x32.exe (PID: 1020)
      • wmpnscfg.exe (PID: 392)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3972)
      • WinRAR.exe (PID: 3984)

    • Manual execution by a user

      • HWiNFO32.exe (PID: 116)
      • WinRAR.exe (PID: 3984)
      • cpuz_x32.exe (PID: 1020)
      • cpuz_x32.exe (PID: 1484)
      • wmpnscfg.exe (PID: 392)

    • Reads the computer name

      • HWiNFO32.exe (PID: 116)
      • cpuz_x32.exe (PID: 1020)
      • wmpnscfg.exe (PID: 392)

    • Create files in a temporary directory

      • HWiNFO32.exe (PID: 116)

    • Reads the machine GUID from the registry

      • HWiNFO32.exe (PID: 116)
      • cpuz_x32.exe (PID: 1020)

    • Reads CPU info

      • HWiNFO32.exe (PID: 116)

    • Reads the software policy settings

      • HWiNFO32.exe (PID: 116)
      • cpuz_x32.exe (PID: 1020)

    • Checks proxy server information

      • HWiNFO32.exe (PID: 116)
      • cpuz_x32.exe (PID: 1020)

    • Creates files or folders in the user directory

      • HWiNFO32.exe (PID: 116)
      • cpuz_x32.exe (PID: 1020)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3984)

    • Reads Environment values

      • cpuz_x32.exe (PID: 1020)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: HWiNFO32.exe
ZipUncompressedSize: 3101664
ZipCompressedSize: 3039788
ZipCRC: 0x54d74552
ZipModifyDate: 2024:02:05 09:30:34
ZipCompression: Deflated
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
57
Monitored processes
6
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe hwinfo32.exe winrar.exe cpuz_x32.exe no specs cpuz_x32.exe wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3972"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\hwi_772.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
116"C:\Users\admin\Desktop\HWiNFO32.exe" C:\Users\admin\Desktop\HWiNFO32.exe
explorer.exe
User:
admin
Company:
REALiX s.r.o.
Integrity Level:
HIGH
Description:
HWiNFO32
Version:
7.72-5355
Modules
Images
c:\users\admin\desktop\hwinfo32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
3984"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Desktop\cpu-z_2.09-en.zip" C:\Users\admin\Desktop\cpu-z_2.09-en\C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1484"C:\Users\admin\Desktop\cpu-z_2.09-en\cpuz_x32.exe" C:\Users\admin\Desktop\cpu-z_2.09-en\cpuz_x32.exe—explorer.exe
User:
admin
Company:
CPUID
Integrity Level:
MEDIUM
Description:
CPU-Z Application
Exit code:
3221226540
Version:
2, 0, 9, 0
Modules
Images
c:\users\admin\desktop\cpu-z_2.09-en\cpuz_x32.exe
c:\windows\system32\ntdll.dll
1020"C:\Users\admin\Desktop\cpu-z_2.09-en\cpuz_x32.exe" C:\Users\admin\Desktop\cpu-z_2.09-en\cpuz_x32.exe
explorer.exe
User:
admin
Company:
CPUID
Integrity Level:
HIGH
Description:
CPU-Z Application
Version:
2, 0, 9, 0
Modules
Images
c:\users\admin\desktop\cpu-z_2.09-en\cpuz_x32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
392"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
14 031
Read events
13 870
Write events
137
Delete events
24

Modification events

(PID) Process:(3972) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3972) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3972) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3972) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3972) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3972) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(3972) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\hwi_772.zip
(PID) Process:(3972) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3972) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3972) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
5
Suspicious files
6
Text files
6
Unknown types
3

Dropped files

PID
Process
Filename
Type
3972WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3972.14593\HWiNFO32.exeexecutable
MD5:A216E798230D9C7B8AB3C965BEB44EDD
SHA256:140C4203A7F2E9A379B5293EFBE38E74A779044B226B3E3E90DA28D74C9F672E
116HWiNFO32.exeC:\Users\admin\Desktop\HWiNFO32.INItext
MD5:31EA0D720B02F5BE9A0A8C843FA525B6
SHA256:2B52116A161DB87EAD7FBA5329E113610A39EC5183D713A9D9A7222FE657C949
116HWiNFO32.exeC:\Windows\INF\setupapi.app.logini
MD5:EDF6BF91746D13B4581CD37298FB7B1B
SHA256:F0207BD080649D51A402A11EE06D14DC4A7C40FF243FFA38AD76877914CA6CD1
116HWiNFO32.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:352649F70048A56EB54D4F4C082B7B38
SHA256:862FE2EE2984C826D4EBCA4BAF6B57EF1CB637F05E2962FECF0C447A93B2A66F
116HWiNFO32.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464binary
MD5:8ED7F7B800FA590C2BB5EE56B235A947
SHA256:4C799E75999C5E27E292D08C074AA748F4D48DCD155B033B05D1ED76D3BF8DB5
3984WinRAR.exeC:\Users\admin\Desktop\cpu-z_2.09-en\cpuz_readme.txttext
MD5:4822336A7C15F6548D9ADF08F87EABD7
SHA256:333939BD029A3325E4377FC6F33C57BD43647356B84D479732A493F5C1EAA8BF
3984WinRAR.exeC:\Users\admin\Desktop\cpu-z_2.09-en\cpuz_x32.exeexecutable
MD5:F3BF8D3AB2F151D28E3A63AC9E6E4DEE
SHA256:AF0918DB9AA303C6522FBF8423EB006E229E6BE516AA03875964702711922BBE
116HWiNFO32.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:D8C5D912E303DBABD4CA465DCFBE6A73
SHA256:22ACA1668B4FECF851A70991EC7EE5E8F46872AFB1E28A8FDB40AA809150B279
116HWiNFO32.exeC:\Users\admin\AppData\Local\Temp\HWiNFO32_191.SYSexecutable
MD5:6B8909A66EDD2AB656D15B625BA6F6DE
SHA256:FC98ADFA2B94D5ABCF11655807E7FDCA1028C7142C97B7C3B5435E0421FEBFAE
1020cpuz_x32.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\cpuid[1].vertext
MD5:DC2707C8036C831472755CF619C453A7
SHA256:BE2EA0898C5840311CF665059A7DCC16A42838D60ED81AF01A8E9BA47BD923C1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
11
DNS requests
7
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
116
HWiNFO32.exe
GET
304
23.53.42.59:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?53c50ebd11a047c3
unknown
—
—
unknown
116
HWiNFO32.exe
GET
200
142.250.185.195:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
binary
1.41 Kb
unknown
1020
cpuz_x32.exe
GET
200
2.19.217.103:80
http://x1.c.lencr.org/
unknown
binary
717 b
unknown
1080
svchost.exe
GET
200
23.53.41.243:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?89bca2e7018c82c0
unknown
compressed
67.5 Kb
unknown
1020
cpuz_x32.exe
GET
200
195.138.255.18:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgQy%2BbCaB9oPhwT%2BuDTXjawRlg%3D%3D
unknown
binary
503 b
unknown
116
HWiNFO32.exe
GET
200
142.250.185.195:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFCjJ1PwkYAi7fE%3D
unknown
binary
724 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
unknown
116
HWiNFO32.exe
172.67.205.235:443
www.hwinfo.com
CLOUDFLARENET
US
unknown
116
HWiNFO32.exe
23.53.42.59:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
116
HWiNFO32.exe
142.250.185.195:80
ocsp.pki.goog
GOOGLE
US
whitelisted
1080
svchost.exe
23.53.41.243:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
1020
cpuz_x32.exe
195.154.81.43:443
download.cpuid.com
Online S.a.s.
FR
unknown
1020
cpuz_x32.exe
2.19.217.103:80
x1.c.lencr.org
Akamai International B.V.
NL
unknown
1020
cpuz_x32.exe
195.138.255.18:80
r3.o.lencr.org
AS33891 Netzbetrieb GmbH
DE
unknown

DNS requests

Domain
IP
Reputation
www.hwinfo.com
  • 172.67.205.235
  • 104.21.22.164
whitelisted
ctldl.windowsupdate.com
  • 23.53.42.59
  • 23.53.41.249
  • 23.53.42.64
  • 23.53.42.66
  • 23.53.42.65
  • 23.53.41.250
  • 23.53.41.251
  • 23.53.41.248
  • 23.53.42.67
  • 23.53.41.243
  • 23.53.42.25
  • 23.53.41.242
  • 23.53.42.16
  • 23.53.42.58
whitelisted
ocsp.pki.goog
  • 142.250.185.195
whitelisted
download.cpuid.com
  • 195.154.81.43
whitelisted
x1.c.lencr.org
  • 2.19.217.103
whitelisted
r3.o.lencr.org
  • 195.138.255.18
shared

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
hwi_772.zip