File name: | DesktopGoose v0.3.rar |
Full analysis: | https://app.any.run/tasks/63b2b46f-cc97-4b26-a9dc-106ea2a28750 |
Verdict: | Malicious activity |
Analysis date: | May 21, 2022, 10:47:12 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-rar |
File info: | RAR archive data, v5 |
MD5: | 51A8E1806D0F0B844A1D2080B7F784C5 |
SHA1: | 89ECD78782BEFF6A9916D7157314D65CE7A301D1 |
SHA256: | 0515FDE2A02C2261B2F02466C3858AD716349266E3F444F827687CE02446919B |
SSDEEP: | 98304:qwuMOticXOaBoVvXxT1vj+P3wM3TVfdb81Xf/ClE:JeOamPxT1vqvbfdb81v/ClE |
.rar | | | RAR compressed archive (v5.0) (61.5) |
---|---|---|
.rar | | | RAR compressed archive (gen) (38.4) |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2976 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\DesktopGoose v0.3.rar" | C:\Program Files\WinRAR\WinRAR.exe | Explorer.EXE | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 | ||||
3548 | "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe4_ Global\UsGthrCtrlFltPipeMssGthrPipe4 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" | C:\Windows\system32\SearchProtocolHost.exe | — | SearchIndexer.exe |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft Windows Search Protocol Host Version: 7.00.7601.24542 (win7sp1_ldr_escrow.191209-2211) | ||||
2768 | "C:\Users\admin\Desktop\DesktopGoose v0.3\GooseDesktop.exe" | C:\Users\admin\Desktop\DesktopGoose v0.3\GooseDesktop.exe | — | Explorer.EXE |
User: admin Integrity Level: MEDIUM Description: GooseDesktop Version: 1.0.0.0 |
(PID) Process: | (2976) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtBMP |
Value: | |||
(PID) Process: | (2976) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtIcon |
Value: | |||
(PID) Process: | (2976) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (2976) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip | |||
(PID) Process: | (2976) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\Win7-KB3191566-x86.zip | |||
(PID) Process: | (2976) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\DesktopGoose v0.3.rar | |||
(PID) Process: | (2976) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | name |
Value: 120 | |||
(PID) Process: | (2976) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | size |
Value: 80 | |||
(PID) Process: | (2976) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | type |
Value: 120 | |||
(PID) Process: | (2976) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | mtime |
Value: 100 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2976 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2976.20465\DesktopGoose v0.3\Assets\Images\Memes\Meme7.png | image | |
MD5:245F29E1E0905C497306C8F06F503244 | SHA256:9E3B5C5158686F49BC91D41D1215E8DF9322A092B7C9015E8F9228CFBE4C61E3 | |||
2976 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2976.20465\DesktopGoose v0.3\Assets\Images\Memes\Meme3.png | image | |
MD5:CEF6B9818BC01655614FB969CFFC155F | SHA256:37BC0E217C6D6BF3EAF31072C02F010E785F4935ABE9849FBEE96D586D0904A7 | |||
2976 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2976.20465\DesktopGoose v0.3\Assets\Images\MemeAttributions.txt | text | |
MD5:FC280867F6CF727FF169B24371019A93 | SHA256:C6134785BB0927CCE100B3B02EC08EDFA0A3E485F16B2481EE28F8CFAD208AB7 | |||
2976 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2976.20465\DesktopGoose v0.3\Assets\Images\Memes\Meme1.png | image | |
MD5:EC6A7941AA0D1C3CD0A7B724324FBB96 | SHA256:FE5EE195C07EBFC789F15CE771CC0F003AE43C0D5115C193D0F876DE00C18DBE | |||
2976 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2976.20465\DesktopGoose v0.3\Assets\Images\Memes\Meme4.png | image | |
MD5:AF4BEF7B9F4F37AC62E782B5B59D02AA | SHA256:9FCC9A9ADCD231656E848B9B42BAB449EA5A083CBF3A7A987C2E52963D9CF6D0 | |||
2976 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2976.20465\DesktopGoose v0.3\Assets\Images\Memes\GooseDance.gif | image | |
MD5:B89E8C268B06E14D2DACABADCC1B7BFC | SHA256:F1D46D538348EC2405F3A68291029B062129D8253DE275E22584E22539989E8A | |||
2976 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2976.20465\DesktopGoose v0.3\Assets\Sound\NotEmbedded\MudSquith.mp3 | mp3 | |
MD5:B2354D238829D09C54E272D8B4F60189 | SHA256:D5281BA99731FE3C443B6B2D18960A49E74B5B407956D3E1A3CDE360F86573BA | |||
2976 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2976.20465\DesktopGoose v0.3\Assets\Images\Memes\Meme6.png | image | |
MD5:E46D6D7154CEBF37D064C537F5D01F36 | SHA256:A078C89DE64C606313E251122A4D6025FF3F76CD941F1FB2195938E6173CF9F1 | |||
2976 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2976.20465\DesktopGoose v0.3\Assets\Mods\RainbowStrobe\RainbowStrobe.dll | executable | |
MD5:69F76F1C3C92F0EA101FEB9EBCB89A9B | SHA256:FF8A4102C95AC41331B62813A1859697790FC008052DA29F28AB695FDDC6702B | |||
2976 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2976.20465\DesktopGoose v0.3\Assets\Text\NotepadMessages\am goose.txt | text | |
MD5:9CE4FBCA1E49909C6B3E2359A5DC07A8 | SHA256:C25DF8E9906DE90C6D65ED25313B38A7BF1BD65C7B619712B78B72E2553A6916 |