Huge database of samples and IOCs
Custom VM setup
Unlimited submissions
Interactive approach
Sign up, itโs free
General
Behavior
MalConf
Static information
Video
Screenshots
Network
File name:
virus.zip
Full analysis: https://app.any.run/tasks/59d0bfb5-2b39-46c4-8a80-a2b3dbb77b55
Verdict: Malicious activity
Analysis date: June 17, 2025 at 17:41:45
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
lua
arch-scr
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract, compression method=store
MD5:
1CC3DE5D0CF0AF0EC8EC159AD0FEDD2D
SHA1:
79E41BF5BCED415804D5FFA853DBC8D232537B59
SHA256:
8E39B32C4FD875B9401ED04927F58861D83EF16F15068C7007693AAC0FD9BCEC
SSDEEP:
98304:l8a1JsAVEYp4syoqVh/bKuG/+BGgPo8cVaQfR1vEQUChxwZt6yqJ3BsXrz:7g
ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
MALICIOUS
No malicious indicators.
SUSPICIOUS
Reads security settings of Internet Explorer
WinRAR.exe (PID: 4676)
Start notepad (likely ransomware note)
WinRAR.exe (PID: 4676)
There is functionality for taking screenshot (YARA)
vlc.exe (PID: 2368)
INFO
Reads Microsoft Office registry keys
WinRAR.exe (PID: 4676)
firefox.exe (PID: 1028)
Checks supported languages
vlc.exe (PID: 2368)
Reads the computer name
vlc.exe (PID: 2368)
The process uses Lua
vlc.exe (PID: 2368)
Manual execution by a user
firefox.exe (PID: 5184)
Reads security settings of Internet Explorer
notepad.exe (PID: 6304)
notepad.exe (PID: 640)
notepad.exe (PID: 7284)
notepad.exe (PID: 7796)
Application launched itself
firefox.exe (PID: 5184)
firefox.exe (PID: 1028)
Checks proxy server information
slui.exe (PID: 6892)
Reads the software policy settings
slui.exe (PID: 6892)
Find more information about signature artifacts and mapping to MITRE ATT&CKโข MATRIX at the full report
No Malware configuration.
TRiD
.zip | ZIP compressed archive (100)
EXIF
ZIP
ZipRequiredVersion: 10
ZipBitFlag: 0x0800
ZipCompression: None
ZipModifyDate: 2025:06:16 15:51:36
ZipCRC: 0x083f5b02
ZipCompressedSize: 1007750
ZipUncompressedSize: 1007750
ZipFileName: TXT......................๐ฃ ......................TXT
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
175
Monitored processes
38
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
start winrar.exe no specs vlc.exe notepad.exe no specs notepad.exe no specs slui.exe firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs notepad.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs notepad.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs svchost.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs notepad.exe no specs
notepad.exe no specs
Process information
PID
CMD
Path
Indicators
Parent process
640 "C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\Temp\Rar$DIa4676.15539\TXTNNN~1.TXT C:\Windows\System32\notepad.exe โ WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
1028 "C:\Program Files\Mozilla Firefox\firefox.exe" C:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
136.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
1488 "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5292 -prefsLen 39068 -prefMapHandle 5328 -prefMapSize 272997 -jsInitHandle 5332 -jsInitLen 247456 -parentBuildID 20250227124745 -ipcHandle 5340 -initialChannelId {7515c78d-002d-4381-8298-bde61a1a66de} -parentPid 1028 -crashReporter "\.\pipe\gecko-crash-server-pipe.1028" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab C:\Program Files\Mozilla Firefox\firefox.exe โ firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
136.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
1564 "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250227124745 -prefsHandle 1976 -prefsLen 36520 -prefMapHandle 1980 -prefMapSize 272997 -ipcHandle 2040 -initialChannelId {e1e19580-ccab-48ca-8f63-fa696b0a6e34} -parentPid 1028 -crashReporter "\.\pipe\gecko-crash-server-pipe.1028" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu C:\Program Files\Mozilla Firefox\firefox.exe โ firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
136.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\vcruntime140_1.dll
c:\windows\system32\bcrypt.dll
2200 C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache C:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2272 "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4320 -prefsLen 39438 -prefMapHandle 6784 -prefMapSize 272997 -jsInitHandle 6828 -jsInitLen 247456 -parentBuildID 20250227124745 -ipcHandle 6412 -initialChannelId {a4b32cc0-b04c-4a95-85f3-d72ab9841cd8} -parentPid 1028 -crashReporter "\.\pipe\gecko-crash-server-pipe.1028" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 23 tab C:\Program Files\Mozilla Firefox\firefox.exe โ firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
136.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
2368 "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\admin\AppData\Local\Temp\Rar$DIa4676.13133\MEE78~1.MP3" C:\Program Files\VideoLAN\VLC\vlc.exe