File name: | kkkkkkkkkkkkk.zip |
Full analysis: | https://app.any.run/tasks/df80bce5-253a-4127-805e-44b6930419ac |
Verdict: | Malicious activity |
Analysis date: | May 21, 2022, 04:52:25 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | 54ECCFEC337C3A34CCB747753381C49A |
SHA1: | 9AA29E1A165EF331E65652F34BA007514E627110 |
SHA256: | 13286BB8E7617B9BAFF9C754660A9F8CD32878473ECED61AE06709D0AEF42536 |
SSDEEP: | 24576:jmeJdF28MRd6ZiyNlP1QI9CXSlxtKN5HXj32uOHtE+1AEdr:jmAU8MRyN71QCCCgNlj32uCtEgxr |
.zip | | | ZIP compressed archive (100) |
---|
ZipFileName: | kkkkkkkkkkkkk/ |
---|---|
ZipUncompressedSize: | - |
ZipCompressedSize: | - |
ZipCRC: | 0x00000000 |
ZipModifyDate: | 2022:05:21 01:49:22 |
ZipCompression: | None |
ZipBitFlag: | - |
ZipRequiredVersion: | 788 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2860 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\kkkkkkkkkkkkk.zip" | C:\Program Files\WinRAR\WinRAR.exe | Explorer.EXE | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
1416 | "C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\kkkkkkkkkkkkk\linkparausar.txt | C:\Windows\system32\NOTEPAD.EXE | — | Explorer.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Notepad Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
3564 | "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" | C:\Windows\system32\SearchProtocolHost.exe | — | SearchIndexer.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft Windows Search Protocol Host Exit code: 0 Version: 7.00.7601.24542 (win7sp1_ldr_escrow.191209-2211) Modules
| |||||||||||||||
1728 | "C:\Users\admin\Desktop\kkkkkkkkkkkkk\VitorBotdeViews.exe" | C:\Users\admin\Desktop\kkkkkkkkkkkkk\VitorBotdeViews.exe | Explorer.EXE | ||||||||||||
User: admin Integrity Level: MEDIUM Description: 301ViewPumper Version: 1.0.0.0 Modules
| |||||||||||||||
5316 | "C:\Program Files\Internet Explorer\iexplore.exe" http://www.youtube.com/watch?v=945ej1xtr1i | C:\Program Files\Internet Explorer\iexplore.exe | VitorBotdeViews.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 1 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
7340 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:5316 CREDAT:267521 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
|
(PID) Process: | (2860) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtBMP |
Value: | |||
(PID) Process: | (2860) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtIcon |
Value: | |||
(PID) Process: | (2860) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (2860) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip | |||
(PID) Process: | (2860) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\Win7-KB3191566-x86.zip | |||
(PID) Process: | (2860) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\kkkkkkkkkkkkk.zip | |||
(PID) Process: | (2860) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | name |
Value: 120 | |||
(PID) Process: | (2860) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | size |
Value: 80 | |||
(PID) Process: | (2860) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | type |
Value: 120 | |||
(PID) Process: | (2860) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | mtime |
Value: 100 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2860 | WinRAR.exe | C:\Users\admin\Desktop\kkkkkkkkkkkkk\set.txt | text | |
MD5:856867AB5C120F4028385016AD39FDBA | SHA256:3C6E8AE1C06D47B503C6CE053F5EE018F263134418082144503AF273C873BACF | |||
2860 | WinRAR.exe | C:\Users\admin\Desktop\kkkkkkkkkkkkk\VitorBotdeViews.exe | executable | |
MD5:A5BC6BE46D2EE64B0E952111535C45DE | SHA256:D6F410C66D87ED1554E83EBE67DB75577576F997ECAB5F85013C14E23842E219 | |||
2860 | WinRAR.exe | C:\Users\admin\Desktop\kkkkkkkkkkkkk\ObjectListView.dll | executable | |
MD5:DC57D276366B6A25108A6C814AC66FEA | SHA256:17225EAD30813CBDD6F4ACEB3EBF534DD7A1DF25F41AC60E2017C2B29D6BA7DE | |||
1728 | VitorBotdeViews.exe | C:\Users\admin\AppData\Roaming\301Pumper\links.fdt | pi2 | |
MD5:DA327091D5CAD382501AD6CA498BA5E0 | SHA256:CD04D33F32D660DBE90C26A385D63193644C7D172458679B685BBE44DDCA0FDC | |||
1728 | VitorBotdeViews.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\reclama_imagine[1].jpg | image | |
MD5:AD4F194E627646B425A9457CF96FB8D6 | SHA256:4B43DACA99D7F13ED385B2474DDD8E57ECDA6CB39E14FD462C34576DD6DA1EE8 | |||
7340 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_7172467AE25B54F1B9D87A9343356E9B | der | |
MD5:F7A987233EC6C363F5225C5654BAD626 | SHA256:5DF2AF937E6007C6BFCEF4AC91AD9F85AF357C8EE0BDEBE97DABD121BEC16E42 | |||
7340 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\DE99CCYY.txt | text | |
MD5:9CDA03AF3F02E2494E3B5A55CE80F71F | SHA256:C28DD994AA6DAA6886E48DAAF1FDD0DD2068D45F31780BC298883B78BDF77D4F | |||
1728 | VitorBotdeViews.exe | C:\Users\admin\AppData\Roaming\301Pumper\links_b.fdt | pi2 | |
MD5:DA327091D5CAD382501AD6CA498BA5E0 | SHA256:CD04D33F32D660DBE90C26A385D63193644C7D172458679B685BBE44DDCA0FDC | |||
2860 | WinRAR.exe | C:\Users\admin\Desktop\kkkkkkkkkkkkk\proxy.txt | text | |
MD5:D09C4BCE9975F3A95B4D4622DA96C9FC | SHA256:975D59237E08C1279A23EB74CA592329E257D4B1C308F7C65CF973291187E432 | |||
7340 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA | der | |
MD5:5A11C6099B9E5808DFB08C5C9570C92F | SHA256:91291A5EDC4E10A225D3C23265D236ECC74473D9893BE5BD07E202D95B3FB172 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
1728 | VitorBotdeViews.exe | GET | 200 | 158.69.225.63:80 | http://blastersuite.com/301views/check_reg.php?email=&code= | CA | text | 18 b | whitelisted |
7340 | iexplore.exe | GET | 200 | 142.250.185.227:80 | http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCdUrA%2FwvrytArhIvu6cF3d | US | der | 472 b | whitelisted |
7340 | iexplore.exe | GET | 200 | 142.250.185.227:80 | http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDExSUZ712qmxLhqE9UUaDV | US | der | 472 b | whitelisted |
5316 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | US | der | 471 b | whitelisted |
7340 | iexplore.exe | GET | 200 | 142.250.185.227:80 | http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D | US | der | 724 b | whitelisted |
7340 | iexplore.exe | GET | 200 | 142.250.185.227:80 | http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEG3aTvFLTYzNCmxS2fUJutw%3D | US | der | 471 b | whitelisted |
5316 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D | US | der | 1.47 Kb | whitelisted |
1728 | VitorBotdeViews.exe | GET | 200 | 158.69.225.63:80 | http://blastersuite.com/301views/reclama_imagine.jpg | CA | image | 9.59 Kb | whitelisted |
7340 | iexplore.exe | GET | 200 | 142.250.185.227:80 | http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D | US | der | 1.41 Kb | whitelisted |
1728 | VitorBotdeViews.exe | GET | 200 | 158.69.225.63:80 | http://blastersuite.com/301views/reclama_dreapta.html | CA | html | 187 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
1728 | VitorBotdeViews.exe | 142.250.185.206:443 | www.youtube.com | Google Inc. | US | whitelisted |
— | — | 142.250.186.46:443 | www.youtube.com | Google Inc. | US | whitelisted |
— | — | 209.85.200.113:443 | s.youtube.com | Google Inc. | US | unknown |
1728 | VitorBotdeViews.exe | 142.250.186.46:443 | www.youtube.com | Google Inc. | US | whitelisted |
1728 | VitorBotdeViews.exe | 158.69.225.63:80 | blastersuite.com | OVH SAS | CA | suspicious |
1728 | VitorBotdeViews.exe | 209.85.200.113:443 | s.youtube.com | Google Inc. | US | unknown |
7340 | iexplore.exe | 142.250.185.206:443 | www.youtube.com | Google Inc. | US | whitelisted |
7340 | iexplore.exe | 178.79.242.128:80 | ctldl.windowsupdate.com | Limelight Networks, Inc. | DE | malicious |
5316 | iexplore.exe | 142.250.185.206:443 | www.youtube.com | Google Inc. | US | whitelisted |
7340 | iexplore.exe | 142.250.185.74:443 | fonts.googleapis.com | Google Inc. | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
blastersuite.com |
| whitelisted |
www.youtube.com |
| whitelisted |
m.youtube.com |
| whitelisted |
s.youtube.com |
| whitelisted |
ctldl.windowsupdate.com |
| whitelisted |
ocsp.pki.goog |
| whitelisted |
fonts.googleapis.com |
| whitelisted |
fonts.gstatic.com |
| whitelisted |
api.bing.com |
| whitelisted |
www.bing.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
1728 | VitorBotdeViews.exe | Potentially Bad Traffic | ET INFO Terse Request for .txt - Likely Hostile |