File name: | finger_unlock_1.2.0.zip |
Full analysis: | https://app.any.run/tasks/27228284-8dfb-43f4-9742-0ac9abb6c6c7 |
Verdict: | Malicious activity |
Analysis date: | October 20, 2020, 08:51:19 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | 660BBE3ADE9959B0C5BC342D3008BC50 |
SHA1: | 5BC29EE616CD43564C2ED229E0B9B124F989A689 |
SHA256: | 072F554BCE6E6E3C7DBEA7B43FE6712A3C83F5A059B10ECD01AFD0E4A3292500 |
SSDEEP: | 196608:k97ISbz00q8CEPqjzMLPkssog8XHqFnhrPNwMOqK1rzzTkOeY5WrlDqUkUwJ:k9U8z0j8CWlLPksnHqFnhrPNfRor/VDT |
.zip | | | ZIP compressed archive (100) |
---|
ZipFileName: | finger_unlock_1.2.0.exe |
---|---|
ZipUncompressedSize: | 9999654 |
ZipCompressedSize: | 9975781 |
ZipCRC: | 0x12816736 |
ZipModifyDate: | 2019:09:04 01:29:24 |
ZipCompression: | Deflated |
ZipBitFlag: | - |
ZipRequiredVersion: | 20 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3244 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\finger_unlock_1.2.0.zip" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 | ||||
1500 | "C:\Users\admin\Desktop\finger_unlock_1.2.0\finger_unlock_1.2.0.exe" | C:\Users\admin\Desktop\finger_unlock_1.2.0\finger_unlock_1.2.0.exe | explorer.exe | |
User: admin Company: Andrei Rusu Integrity Level: MEDIUM Description: Fingerprint Unlock Module Setup Exit code: 0 Version: | ||||
3276 | "C:\Users\admin\AppData\Local\Temp\is-2AVUV.tmp\finger_unlock_1.2.0.tmp" /SL5="$3012C,9746687,58368,C:\Users\admin\Desktop\finger_unlock_1.2.0\finger_unlock_1.2.0.exe" | C:\Users\admin\AppData\Local\Temp\is-2AVUV.tmp\finger_unlock_1.2.0.tmp | — | finger_unlock_1.2.0.exe |
User: admin Integrity Level: MEDIUM Description: Setup/Uninstall Exit code: 0 Version: 51.52.0.0 | ||||
2352 | "C:\Users\admin\Desktop\finger_unlock_1.2.0\finger_unlock_1.2.0.exe" /SPAWNWND=$30128 /NOTIFYWND=$3012C | C:\Users\admin\Desktop\finger_unlock_1.2.0\finger_unlock_1.2.0.exe | finger_unlock_1.2.0.tmp | |
User: admin Company: Andrei Rusu Integrity Level: HIGH Description: Fingerprint Unlock Module Setup Exit code: 0 Version: | ||||
2148 | "C:\Users\admin\AppData\Local\Temp\is-R2LTC.tmp\finger_unlock_1.2.0.tmp" /SL5="$301CC,9746687,58368,C:\Users\admin\Desktop\finger_unlock_1.2.0\finger_unlock_1.2.0.exe" /SPAWNWND=$30128 /NOTIFYWND=$3012C | C:\Users\admin\AppData\Local\Temp\is-R2LTC.tmp\finger_unlock_1.2.0.tmp | finger_unlock_1.2.0.exe | |
User: admin Integrity Level: HIGH Description: Setup/Uninstall Exit code: 0 Version: 51.52.0.0 | ||||
3152 | "C:\Windows\system32\wusa.exe" C:\Users\admin\AppData\Local\Temp\is-8LE8P.tmp\Windows6.1-KB2999226-x86.msu | C:\Windows\system32\wusa.exe | — | finger_unlock_1.2.0.tmp |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Update Standalone Installer Exit code: 2359302 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2928 | "C:\Windows\system32\cscript.exe" //nologo "C:\Windows\system32\Fingerprint Credentials\firewallexceptions.vbs" /GroupName:"Fingerprint Unlock Module" /RuleName:"Logon UI" /ExePath:"C:\Windows\system32\LogonUI.exe" /Command:"install" | C:\Windows\system32\cscript.exe | — | finger_unlock_1.2.0.tmp |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft ® Console Based Script Host Exit code: 0 Version: 5.8.7600.16385 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2148 | finger_unlock_1.2.0.tmp | C:\Windows\system32\is-SQJND.tmp | — | |
MD5:— | SHA256:— | |||
2148 | finger_unlock_1.2.0.tmp | C:\Users\admin\AppData\Local\Temp\is-8LE8P.tmp\is-ODKMM.tmp | — | |
MD5:— | SHA256:— | |||
3152 | wusa.exe | C:\6592c7768a180106aea579ab5e18\$dpx$.tmp\d44da8475ae67b419c83f2456d3eefdf.tmp | — | |
MD5:— | SHA256:— | |||
3152 | wusa.exe | C:\6592c7768a180106aea579ab5e18\$dpx$.tmp\6b39cd27594edd47a0c1b946a1d6c293.tmp | — | |
MD5:— | SHA256:— | |||
3152 | wusa.exe | C:\6592c7768a180106aea579ab5e18\$dpx$.tmp\7babaeb4b335f74ca6b20a7799a272e4.tmp | — | |
MD5:— | SHA256:— | |||
3152 | wusa.exe | C:\6592c7768a180106aea579ab5e18\$dpx$.tmp\51bf2e5c53dd7742a8750353e39a16b4.tmp | — | |
MD5:— | SHA256:— | |||
3152 | wusa.exe | C:\Windows\Logs\DPX\setuperr.log | — | |
MD5:— | SHA256:— | |||
2148 | finger_unlock_1.2.0.tmp | C:\Windows\system32\is-K8U2C.tmp | — | |
MD5:— | SHA256:— | |||
2148 | finger_unlock_1.2.0.tmp | C:\Windows\system32\is-0LB93.tmp | — | |
MD5:— | SHA256:— | |||
2148 | finger_unlock_1.2.0.tmp | C:\Windows\system32\is-IRD7S.tmp | — | |
MD5:— | SHA256:— |