⠀

Huge database of samples and IOCs
Custom VM setup
Unlimited submissions
Interactive approach

Sign up, it’s free General Behavior MalConf Static information Video Screenshots Network File name:
virus.zip Full analysis: https://app.any.run/tasks/59d0bfb5-2b39-46c4-8a80-a2b3dbb77b55 Verdict: Malicious activity Analysis date: June 17, 2025 at 17:41:45 OS: Windows 10 Professional (build: 19044, 64 bit) Tags:
lua arch-scr Indicators:
MIME: application/zip File info: Zip archive data, at least v1.0 to extract, compression method=store MD5:
1CC3DE5D0CF0AF0EC8EC159AD0FEDD2D SHA1:
79E41BF5BCED415804D5FFA853DBC8D232537B59 SHA256:
8E39B32C4FD875B9401ED04927F58861D83EF16F15068C7007693AAC0FD9BCEC SSDEEP:
98304:l8a1JsAVEYp4syoqVh/bKuG/+BGgPo8cVaQfR1vEQUChxwZt6yqJ3BsXrz:7g ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

MALICIOUS
No malicious indicators.
SUSPICIOUS
    Reads security settings of Internet Explorer
        WinRAR.exe (PID: 4676)
    Start notepad (likely ransomware note)
        WinRAR.exe (PID: 4676)
    There is functionality for taking screenshot (YARA)
        vlc.exe (PID: 2368)
INFO
    Reads Microsoft Office registry keys
        WinRAR.exe (PID: 4676)
        firefox.exe (PID: 1028)
    Checks supported languages
        vlc.exe (PID: 2368)
    Reads the computer name
        vlc.exe (PID: 2368)
    The process uses Lua
        vlc.exe (PID: 2368)
    Manual execution by a user
        firefox.exe (PID: 5184)
    Reads security settings of Internet Explorer
        notepad.exe (PID: 6304)
        notepad.exe (PID: 640)
        notepad.exe (PID: 7284)
        notepad.exe (PID: 7796)
    Application launched itself
        firefox.exe (PID: 5184)
        firefox.exe (PID: 1028)
    Checks proxy server information
        slui.exe (PID: 6892)
    Reads the software policy settings
        slui.exe (PID: 6892)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report No Malware configuration. TRiD .zip | ZIP compressed archive (100) EXIF ZIP ZipRequiredVersion: 10 ZipBitFlag: 0x0800 ZipCompression: None ZipModifyDate: 2025:06:16 15:51:36 ZipCRC: 0x083f5b02 ZipCompressedSize: 1007750 ZipUncompressedSize: 1007750 ZipFileName: TXT......................𖣠......................TXT screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot All screenshots are available in the full report All screenshots are available in the full report Total processes 175 Monitored processes 38 Malicious processes 1 Suspicious processes 0 Behavior graph Click at the process to see the details start winrar.exe no specs vlc.exe notepad.exe no specs notepad.exe no specs slui.exe firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs notepad.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs notepad.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs svchost.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs notepad.exe no specs notepad.exe no specs Process information PID

CMD

Path

Indicators

Parent process 640 "C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\Temp\Rar$DIa4676.15539\TXTNNN~1.TXT C:\Windows\System32\notepad.exe — WinRAR.exe User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Notepad Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules Images c:\windows\system32\notepad.exe c:\windows\system32\ntdll.dll c:\windows\system32\kernel32.dll c:\windows\system32\kernelbase.dll c:\windows\system32\gdi32.dll c:\windows\system32\win32u.dll c:\windows\system32\gdi32full.dll c:\windows\system32\msvcp_win.dll c:\windows\system32\ucrtbase.dll c:\windows\system32\user32.dll 1028 "C:\Program Files\Mozilla Firefox\firefox.exe" C:\Program Files\Mozilla Firefox\firefox.exe

firefox.exe

User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Version: 136.0 Modules Images c:\program files\mozilla firefox\firefox.exe c:\windows\system32\ntdll.dll c:\windows\system32\kernel32.dll c:\windows\system32\kernelbase.dll c:\windows\system32\ucrtbase.dll c:\program files\mozilla firefox\mozglue.dll c:\windows\system32\bcrypt.dll c:\windows\system32\crypt32.dll c:\windows\system32\msvcp140.dll c:\windows\system32\vcruntime140.dll 1488 "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5292 -prefsLen 39068 -prefMapHandle 5328 -prefMapSize 272997 -jsInitHandle 5332 -jsInitLen 247456 -parentBuildID 20250227124745 -ipcHandle 5340 -initialChannelId {7515c78d-002d-4381-8298-bde61a1a66de} -parentPid 1028 -crashReporter "\.\pipe\gecko-crash-server-pipe.1028" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab C:\Program Files\Mozilla Firefox\firefox.exe — firefox.exe User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 136.0 Modules Images c:\program files\mozilla firefox\firefox.exe c:\windows\system32\ntdll.dll c:\windows\system32\kernel32.dll c:\windows\system32\kernelbase.dll c:\windows\system32\ucrtbase.dll c:\program files\mozilla firefox\mozglue.dll c:\windows\system32\bcrypt.dll c:\windows\system32\crypt32.dll c:\windows\system32\msvcp140.dll c:\windows\system32\vcruntime140.dll 1564 "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250227124745 -prefsHandle 1976 -prefsLen 36520 -prefMapHandle 1980 -prefMapSize 272997 -ipcHandle 2040 -initialChannelId {e1e19580-ccab-48ca-8f63-fa696b0a6e34} -parentPid 1028 -crashReporter "\.\pipe\gecko-crash-server-pipe.1028" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu C:\Program Files\Mozilla Firefox\firefox.exe — firefox.exe User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Version: 136.0 Modules Images c:\program files\mozilla firefox\firefox.exe c:\windows\system32\ntdll.dll c:\windows\system32\kernel32.dll c:\windows\system32\kernelbase.dll c:\windows\system32\ucrtbase.dll c:\program files\mozilla firefox\mozglue.dll c:\windows\system32\msvcp140.dll c:\windows\system32\vcruntime140.dll c:\windows\system32\vcruntime140_1.dll c:\windows\system32\bcrypt.dll 2200 C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache C:\Windows\System32\svchost.exe

services.exe

User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules Images c:\windows\system32\svchost.exe c:\windows\system32\ntdll.dll c:\windows\system32\kernel32.dll c:\windows\system32\kernelbase.dll c:\windows\system32\sechost.dll c:\windows\system32\rpcrt4.dll c:\windows\system32\bcrypt.dll c:\windows\system32\ucrtbase.dll c:\windows\system32\combase.dll c:\windows\system32\kernel.appcore.dll 2272 "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4320 -prefsLen 39438 -prefMapHandle 6784 -prefMapSize 272997 -jsInitHandle 6828 -jsInitLen 247456 -parentBuildID 20250227124745 -ipcHandle 6412 -initialChannelId {a4b32cc0-b04c-4a95-85f3-d72ab9841cd8} -parentPid 1028 -crashReporter "\.\pipe\gecko-crash-server-pipe.1028" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 23 tab C:\Program Files\Mozilla Firefox\firefox.exe — firefox.exe User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Version: 136.0 Modules Images c:\program files\mozilla firefox\firefox.exe c:\windows\system32\ntdll.dll c:\windows\system32\kernel32.dll c:\windows\system32\kernelbase.dll c:\windows\system32\ucrtbase.dll c:\program files\mozilla firefox\mozglue.dll c:\windows\system32\bcrypt.dll c:\windows\system32\crypt32.dll c:\windows\system32\msvcp140.dll c:\windows\system32\vcruntime140.dll 2368 "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\admin\AppData\Local\Temp\Rar$DIa4676.13133\MEE78~1.MP3" C:\Program Files\VideoLAN\VLC\vlc.exe