File name: | $RBRR86U.exe.zip |
Full analysis: | https://app.any.run/tasks/fdc3da0a-b1a9-4478-aede-9107866d0f63 |
Verdict: | Malicious activity |
Analysis date: | May 24, 2019, 18:56:58 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | 395E89A948660B763D4B8DD733B98EE3 |
SHA1: | 2F15809BF966615064A1CEE0D3F214C88BFEE148 |
SHA256: | 0FF15B863B58C8D7C946E0ED403E01EB967FE457EE602A08FA9CEAF55DBBF39F |
SSDEEP: | 3072:YibEhJ6de903XTzmcIrZTRAYEEO1Ce9Wj85xpiIOBWuUNR9MtaXqjW/ldlp:jbECkif0hGJy6opUVMcqolh |
.zip | | | ZIP compressed archive (100) |
---|
ZipFileName: | $RBRR86U.exe |
---|---|
ZipUncompressedSize: | 302608 |
ZipCompressedSize: | 135128 |
ZipCRC: | 0x6306c57a |
ZipModifyDate: | 2019:05:03 19:03:14 |
ZipCompression: | Deflated |
ZipBitFlag: | 0x0009 |
ZipRequiredVersion: | 20 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2828 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\$RBRR86U.exe.zip" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 | ||||
3144 | "C:\Users\admin\AppData\Local\Temp\Rar$EXb2828.24156\$RBRR86U.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXb2828.24156\$RBRR86U.exe | WinRAR.exe | |
User: admin Company: Broadview Networks, Inc. Integrity Level: MEDIUM Description: OfficeSuite HD Meeting Exit code: 0 Version: 4,1,15397,1225 | ||||
2756 | "C:\Users\admin\AppData\Roaming\BVNMeetings\LDownload\Installer.exe" C:\Users\admin\AppData\Roaming\BVNMeetings\LDownload\Installer.exe --cid=dGlkPWpjeHltczNyUVJPSUc4ckdOS0N1c2c= --conf.no=1112094528 --zc=0 --pwd= --pk= --tk= --browser=firefox --sid= --stype= --token= --uid= --uname= --rtoken= --action=join | C:\Users\admin\AppData\Roaming\BVNMeetings\LDownload\Installer.exe | $RBRR86U.exe | |
User: admin Company: Broadview Networks, Inc. Integrity Level: MEDIUM Description: OfficeSuite HD Meeting Exit code: 0 Version: 4,1,15397,1225 | ||||
2596 | "C:\Users\admin\AppData\Roaming\BVNMeetings\bin\OfficeSuiteHDMeeting.exe" C:\Users\admin\AppData\Roaming\BVNMeetings\bin\OfficeSuiteHDMeeting.exe --url=zoombvn://win.launch?confid=dGlkPWpjeHltczNyUVJPSUc4ckdOS0N1c2c%3d&confno=1112094528&browser=firefox&zc=0&action=join& | C:\Users\admin\AppData\Roaming\BVNMeetings\bin\OfficeSuiteHDMeeting.exe | Installer.exe | |
User: admin Company: Broadview Networks, Inc. Integrity Level: MEDIUM Description: OfficeSuite HD Meeting Exit code: 0 Version: 4,1,15397,1225 | ||||
3304 | C:\Users\admin\AppData\Roaming\BVNMeetings\bin\OfficeSuiteHDMeeting.exe --action=join --runaszvideo=TRUE | C:\Users\admin\AppData\Roaming\BVNMeetings\bin\OfficeSuiteHDMeeting.exe | OfficeSuiteHDMeeting.exe | |
User: admin Company: Broadview Networks, Inc. Integrity Level: MEDIUM Description: OfficeSuite HD Meeting Exit code: 0 Version: 4,1,15397,1225 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3144 | $RBRR86U.exe | C:\Users\admin\AppData\Local\Temp\Cab2E6D.tmp | — | |
MD5:— | SHA256:— | |||
3144 | $RBRR86U.exe | C:\Users\admin\AppData\Local\Temp\Tar2E6E.tmp | — | |
MD5:— | SHA256:— | |||
3144 | $RBRR86U.exe | C:\Users\admin\AppData\Local\Temp\Cab2E8E.tmp | — | |
MD5:— | SHA256:— | |||
3144 | $RBRR86U.exe | C:\Users\admin\AppData\Local\Temp\Tar2E8F.tmp | — | |
MD5:— | SHA256:— | |||
3144 | $RBRR86U.exe | C:\Users\admin\AppData\Local\Temp\Cab2F7B.tmp | — | |
MD5:— | SHA256:— | |||
3144 | $RBRR86U.exe | C:\Users\admin\AppData\Local\Temp\Tar2F8B.tmp | — | |
MD5:— | SHA256:— | |||
3144 | $RBRR86U.exe | C:\Users\admin\AppData\Roaming\BVNMeetings\LDownload\Zoom.msi | — | |
MD5:— | SHA256:— | |||
3144 | $RBRR86U.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 | binary | |
MD5:1E93EDC20EFC087ADD0C0F26ACB20E4B | SHA256:DAAC492FCE0FFE4DF6262726B286B0BB15C0774610E314E07F6B160975C46551 | |||
2828 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXb2828.24156\$RBRR86U.exe | executable | |
MD5:D0E81412B62FF0B055E964CF9AF6ECA6 | SHA256:A95C66A75660AD9D7B4D0FF64A97E87D52278A0F99C4C3E4283156D43C57166B | |||
3144 | $RBRR86U.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 | compressed | |
MD5:7EB117D4F238090940DBE43EFBCDF1F4 | SHA256:A45A77D256628943190F8AA0F4673496D11DBA6BC3569796B6F733465FD005E4 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3144 | $RBRR86U.exe | GET | 200 | 195.138.255.8:80 | http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab | DE | compressed | 56.1 Kb | whitelisted |
3144 | $RBRR86U.exe | GET | 200 | 195.138.255.8:80 | http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/8CF427FD790C3AD166068DE81E57EFBB932272D4.crt | DE | der | 1.06 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3144 | $RBRR86U.exe | 195.138.255.8:80 | www.download.windowsupdate.com | AS33891 Netzbetrieb GmbH | DE | suspicious |
2596 | OfficeSuiteHDMeeting.exe | 34.233.223.210:443 | meeting.broadviewnet.com | Amazon.com, Inc. | US | unknown |
3304 | OfficeSuiteHDMeeting.exe | 34.233.223.210:443 | meeting.broadviewnet.com | Amazon.com, Inc. | US | unknown |
3144 | $RBRR86U.exe | 34.233.223.210:443 | meeting.broadviewnet.com | Amazon.com, Inc. | US | unknown |
Domain | IP | Reputation |
---|---|---|
meeting.broadviewnet.com |
| unknown |
www.download.windowsupdate.com |
| whitelisted |
Process | Message |
---|---|
$RBRR86U.exe | WinMain start, lpCmdLine is: |
$RBRR86U.exe | WinMain start, parameter is: |
$RBRR86U.exe | CZpDownloadMgr::FindParam |
$RBRR86U.exe | CZpDownloadMgr::FindParam |
$RBRR86U.exe | package.name |
$RBRR86U.exe | BinFull.cab |
$RBRR86U.exe | CZpDownloadMgr::FindParam |
$RBRR86U.exe | package.version |
$RBRR86U.exe | latest |
$RBRR86U.exe | CZpDownloadMgr::FindParam |