File name: | xray-68-1152.jar |
Full analysis: | https://app.any.run/tasks/6a432c09-77c9-46b5-b449-56a0c8320eeb |
Verdict: | Malicious activity |
Analysis date: | May 30, 2020, 11:54:22 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v1.0 to extract |
MD5: | 3AA399398F1680806ABD824020054467 |
SHA1: | 719D762B3D040117EF58DDFA5EC609F9FCA31332 |
SHA256: | 1A0DF1D65144EC6B2896ECE1320DADFD026D701284B2C9701735BD5713890812 |
SSDEEP: | 6144:eFmxs7LcwAaiAnJZLMcnZ/XyzCZw2XN2tGh4p0Ht:eAYdAVAnJZLFXyzCS2PhVHt |
.jar | | | Java Archive (78.3) |
---|---|---|
.zip | | | ZIP compressed archive (21.6) |
ZipFileName: | META-INF/MANIFEST.MF |
---|---|
ZipUncompressedSize: | 223 |
ZipCompressedSize: | 148 |
ZipCRC: | 0x0803bf86 |
ZipModifyDate: | 2020:01:21 21:42:21 |
ZipCompression: | Deflated |
ZipBitFlag: | - |
ZipRequiredVersion: | 10 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
1764 | "C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -jar "C:\Users\admin\AppData\Local\Temp\xray-68-1152.jar" | C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe | — | explorer.exe |
User: admin Company: Oracle Corporation Integrity Level: MEDIUM Description: Java(TM) Platform SE binary Exit code: 0 Version: 8.0.920.14 | ||||
2408 | C:\Windows\system32\DeviceDisplayObjectProvider.exe -Embedding | C:\Windows\system32\DeviceDisplayObjectProvider.exe | — | svchost.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Device Display Object Function Discovery Provider Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
4036 | C:\Windows\system32\DeviceDisplayObjectProvider.exe -Embedding | C:\Windows\system32\DeviceDisplayObjectProvider.exe | — | svchost.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Device Display Object Function Discovery Provider Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
588 | "C:\Program Files\CCleaner\CCleaner.exe" | C:\Program Files\CCleaner\CCleaner.exe | — | explorer.exe |
User: admin Company: Piriform Ltd Integrity Level: MEDIUM Description: CCleaner Exit code: 0 Version: 5, 35, 0, 6210 | ||||
2368 | "C:\Program Files\CCleaner\CCleaner.exe" /uac | C:\Program Files\CCleaner\CCleaner.exe | taskeng.exe | |
User: admin Company: Piriform Ltd Integrity Level: HIGH Description: CCleaner Exit code: 0 Version: 5, 35, 0, 6210 | ||||
2232 | "C:\Program Files\CCleaner\CCleaner.exe" /monitor | C:\Program Files\CCleaner\CCleaner.exe | CCleaner.exe | |
User: admin Company: Piriform Ltd Integrity Level: HIGH Description: CCleaner Version: 5, 35, 0, 6210 | ||||
2652 | "C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe | — | explorer.exe |
User: admin Company: Adobe Systems Incorporated Integrity Level: MEDIUM Description: Adobe Acrobat Reader DC Exit code: 1 Version: 15.23.20070.215641 | ||||
1096 | "C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" --type=renderer | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe | — | AcroRd32.exe |
User: admin Company: Adobe Systems Incorporated Integrity Level: LOW Description: Adobe Acrobat Reader DC Exit code: 1 Version: 15.23.20070.215641 | ||||
3456 | "C:\Program Files\Google\Chrome\Application\chrome.exe" | C:\Program Files\Google\Chrome\Application\chrome.exe | explorer.exe | |
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Version: 75.0.3770.100 | ||||
1916 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=75.0.3770.100 --initial-client-data=0x7c,0x80,0x84,0x78,0x88,0x6f57a9d0,0x6f57a9e0,0x6f57a9ec | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe |
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Version: 75.0.3770.100 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2408 | DeviceDisplayObjectProvider.exe | C:\Users\admin\AppData\Local\Microsoft\Device Metadata\dmrc.idx.0 | — | |
MD5:— | SHA256:— | |||
2408 | DeviceDisplayObjectProvider.exe | C:\Users\admin\AppData\Local\Microsoft\Device Metadata\OLDCACHE.000 | — | |
MD5:— | SHA256:— | |||
4036 | DeviceDisplayObjectProvider.exe | C:\Users\admin\AppData\Local\Microsoft\Device Metadata\dmrc.idx.0 | — | |
MD5:— | SHA256:— | |||
4036 | DeviceDisplayObjectProvider.exe | C:\Users\admin\AppData\Local\Microsoft\Device Metadata\OLDCACHE.000 | — | |
MD5:— | SHA256:— | |||
2368 | CCleaner.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat | — | |
MD5:— | SHA256:— | |||
2368 | CCleaner.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\WebCache\tmp.edb | — | |
MD5:— | SHA256:— | |||
2368 | CCleaner.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cookies.sqlite-shm | — | |
MD5:— | SHA256:— | |||
2368 | CCleaner.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\webappsstore.sqlite-shm | — | |
MD5:— | SHA256:— | |||
2368 | CCleaner.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\9JS7281SYZ07P98E5LM2.temp | — | |
MD5:— | SHA256:— | |||
2368 | CCleaner.exe | C:\Users\admin\AppData\Local\Temp\Cab5272.tmp | — | |
MD5:— | SHA256:— |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2368 | CCleaner.exe | GET | 301 | 151.101.0.64:80 | http://www.piriform.com/auto?a=0&p=cc&v=5.35.6210&l=1033&lk=&mk=IJR6-W5SV-5KYR-QBZD-6BY4-RN5Z-WAV9-RVK2-VJCA&o=6.1W3&au=1&mx=97B7721C4994E2556FF6A439510F665DB45337A341A47E15F4997584423BF714&gu=00000000-0000-4000-8000-d6f7f2be5127 | US | — | — | whitelisted |
2368 | CCleaner.exe | GET | 200 | 104.18.21.226:80 | http://ocsp.globalsign.com/rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCCwQAAAAAAURO8EJH | US | der | 1.49 Kb | whitelisted |
2368 | CCleaner.exe | GET | 200 | 104.18.21.226:80 | http://ocsp.globalsign.com/rootr1/ME8wTTBLMEkwRzAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCDkbwjNvPLFRm7zMB3V80 | US | der | 1.49 Kb | whitelisted |
2636 | chrome.exe | GET | 302 | 172.217.23.110:80 | http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjY5QUFXTEQwc2RPVXhRY3picjhxblh1dw/7619.603.0.2_pkedcjkdefgpdelpbcmbmeomcjbeemfm.crx | US | html | 523 b | whitelisted |
2636 | chrome.exe | GET | 301 | 172.227.120.75:80 | http://img.utdstc.com/avatar/defaultavatar.png:xs | US | — | — | whitelisted |
2636 | chrome.exe | GET | 301 | 172.227.120.75:80 | http://img.utdstc.com/avatar/avatar-2925134-6df.jpg:xs | US | — | — | whitelisted |
2636 | chrome.exe | GET | 302 | 5.149.248.70:80 | http://eseclist.com/synthesizer/hysterical?impacted=pericarditis/ZG93bmxvYWR8Yng4TXpOM2JUTTFmSHd4TlRnMk1URTBNek13Zkh3eU16STNmSHdvUlU1SFNVNUZLU0JFY25Wd1lXd2dXMFpwYkdVZ1ZYQnNiMkZrWFE.livers=Um9ibG94IEhhY2sgRG93bmxvYWQUm9=oregonians | NL | — | — | malicious |
2636 | chrome.exe | GET | 301 | 172.227.120.75:80 | http://img.utdstc.com/avatar/avatar-3485909-b2c.jpg:xs | US | — | — | whitelisted |
2636 | chrome.exe | GET | 301 | 172.227.120.75:80 | http://img.utdstc.com/avatar/avatar-2985353-d4a.jpg:xs | US | — | — | whitelisted |
2636 | chrome.exe | GET | 304 | 2.21.78.252:80 | http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab | unknown | compressed | 57.0 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
— | — | 151.101.0.64:80 | www.piriform.com | Fastly | US | whitelisted |
2368 | CCleaner.exe | 151.101.2.109:443 | license.piriform.com | Fastly | US | suspicious |
2368 | CCleaner.exe | 151.101.2.109:80 | license.piriform.com | Fastly | US | suspicious |
2368 | CCleaner.exe | 151.101.0.64:443 | www.piriform.com | Fastly | US | whitelisted |
2368 | CCleaner.exe | 104.18.21.226:80 | ocsp.globalsign.com | Cloudflare Inc | US | shared |
2368 | CCleaner.exe | 151.101.2.202:443 | www.ccleaner.com | Fastly | US | suspicious |
2636 | chrome.exe | 172.217.23.99:443 | clientservices.googleapis.com | Google Inc. | US | whitelisted |
— | — | 172.217.22.99:443 | www.google.com.ua | Google Inc. | US | whitelisted |
2636 | chrome.exe | 216.58.210.10:443 | fonts.googleapis.com | Google Inc. | US | whitelisted |
— | — | 172.217.23.142:443 | apis.google.com | Google Inc. | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
www.piriform.com |
| whitelisted |
www.ccleaner.com |
| whitelisted |
ocsp.globalsign.com |
| whitelisted |
license.piriform.com |
| whitelisted |
clientservices.googleapis.com |
| whitelisted |
accounts.google.com |
| shared |
www.google.com.ua |
| whitelisted |
fonts.googleapis.com |
| whitelisted |
www.gstatic.com |
| whitelisted |
fonts.gstatic.com |
| whitelisted |