File name: | Документы 19.12.gz |
Full analysis: | https://app.any.run/tasks/7ce40f69-dace-495a-9b8c-f5f5fb51fbcd |
Verdict: | Malicious activity |
Analysis date: | December 19, 2018, 07:05:14 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/gzip |
File info: | gzip compressed data, was "\304\356\352\363\354\345\355\362\373 19.12.exe", last modified: Tue Dec 18 15:11:42 2018, max speed, from FAT filesystem (MS-DOS, OS/2, NT) |
MD5: | D2457751EBF2867EA8B11AEAC7C405DE |
SHA1: | 8FC6AB625235E38D5C492509F09163A5ED3CC17F |
SHA256: | 245625FBB4DB247B7F6BD84E7EAF48A82B2499A7C237145130B38C68773E966B |
SSDEEP: | 3072:VpeswgRo9FURkzAxDatMRUM2/JyTxKYvrRBGz6WTxXAHbIqDj8cpAXn4:VcswgW3URVDatMiZyTxKYvrRgJgtzYn4 |
.z/gz/gzip | | | GZipped data (100) |
---|
Compression: | Deflated |
---|---|
Flags: | FileName |
ModifyDate: | 2018:12:18 16:11:42+01:00 |
ExtraFlags: | Fastest Algorithm |
OperatingSystem: | FAT filesystem (MS-DOS, OS/2, NT/Win32) |
ArchivedFileName: | ????????? 19.12.exe |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2928 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Документы 19.12.gz" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 | ||||
3176 | "C:\Users\admin\Desktop\Äîêóìåíòû 19.12.exe" | C:\Users\admin\Desktop\Äîêóìåíòû 19.12.exe | — | explorer.exe |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
2332 | "C:\Users\admin\Desktop\Äîêóìåíòû 19.12.exe" | C:\Users\admin\Desktop\Äîêóìåíòû 19.12.exe | Äîêóìåíòû 19.12.exe | |
User: admin Integrity Level: MEDIUM |
(PID) Process: | (2928) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtBMP |
Value: | |||
(PID) Process: | (2928) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtIcon |
Value: | |||
(PID) Process: | (2928) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (2928) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\Документы 19.12.gz | |||
(PID) Process: | (2928) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | name |
Value: 120 | |||
(PID) Process: | (2928) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | size |
Value: 80 | |||
(PID) Process: | (2928) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | type |
Value: 120 | |||
(PID) Process: | (2928) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | mtime |
Value: 100 | |||
(PID) Process: | (2928) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin |
Operation: | write | Name: | Placement |
Value: 2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000 | |||
(PID) Process: | (2928) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\General |
Operation: | write | Name: | LastFolder |
Value: C:\Users\admin\AppData\Local\Temp |
PID | Process | Filename | Type | |
---|---|---|---|---|
2332 | Äîêóìåíòû 19.12.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MozillaUpdate.lnk | lnk | |
MD5:8E1594AC3A5EE1713DC08F464462ED74 | SHA256:A500720A151F021B268159C9C567357ECBD9A5FE96C7DF93DE39318B24C5CC3B | |||
2928 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2928.14309\Äîêóìåíòû 19.12.exe | executable | |
MD5:FAF833A1456E1BB85117D95C23892368 | SHA256:8AFF8A3E4A13967FEACFD482B5D876C9203465DF552A7114A2CDA842210F403D | |||
2332 | Äîêóìåíòû 19.12.exe | C:\Users\admin\AppData\Roaming\Mozilla\xaudiodg.exe | executable | |
MD5:FAF833A1456E1BB85117D95C23892368 | SHA256:8AFF8A3E4A13967FEACFD482B5D876C9203465DF552A7114A2CDA842210F403D |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
— | — | 213.252.244.200:5656 | — | Informacines sistemos ir technologijos, UAB | LT | suspicious |