| File name: | Stf64.rar |
| Full analysis: | https://app.any.run/tasks/5ca0439e-06ca-4ddd-9fa0-33cc07140f84 |
| Verdict: | Malicious activity |
| Threats: | Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security. |
| Analysis date: | February 22, 2020, 02:53:35 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-rar |
| File info: | RAR archive data, v4, os: Win32 |
| MD5: | 187649348720074F3250F9421147F221 |
| SHA1: | 4D9328593A30896E32EAD8E08FE5BBBC0242193C |
| SHA256: | 2A0CD6ACF88E0AB539CFB7324CEF294612ACBDFAA6738825648F6C4EDAC5A00D |
| SSDEEP: | 196608:3s7ATYajR0zGu43cmDlfA+epN/7nNf4qc733ucGc/qCL5e3b9JjwgQhCV+:cVajwHBslfzgN2qi33zip3Dwz1 |
| .rar | | | RAR compressed archive (v-4.x) (58.3) |
|---|---|---|
| .rar | | | RAR compressed archive (gen) (41.6) |
| CompressedSize: | 12014266 |
|---|---|
| UncompressedSize: | 12709888 |
| OperatingSystem: | Win32 |
| ModifyDate: | 2018:06:13 21:35:01 |
| PackingMethod: | Normal |
| ArchivedFileName: | Setup.exe |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1920 | "C:\Users\admin\Desktop\Patch.exe" | C:\Users\admin\Desktop\Patch.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 3221226540 Modules
| |||||||||||||||
| 2512 | "C:\Windows\system32\reg.exe" export HKLM\Software\Stardock C:\Users\admin\AppData\Local\Temp\registry_export.txt /y | C:\Windows\system32\reg.exe | — | irsetup.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Registry Console Tool Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2660 | "C:\Users\admin\Desktop\Setup.exe" | C:\Users\admin\Desktop\Setup.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: Setup Application Exit code: 3221226540 Version: 9.5.1.0 Modules
| |||||||||||||||
| 3460 | "C:\Users\admin\Desktop\Patch.exe" | C:\Users\admin\Desktop\Patch.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 3744 | "C:\Users\admin\Desktop\Setup.exe" | C:\Users\admin\Desktop\Setup.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: HIGH Description: Setup Application Exit code: 0 Version: 9.5.1.0 Modules
| |||||||||||||||
| 3824 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Stf64.rar" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 Modules
| |||||||||||||||
| 3848 | "C:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\GetMachineSID.exe" C:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\GetMachineSID.tmp | C:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\GetMachineSID.exe | — | irsetup.exe | |||||||||||
User: admin Company: Stardock Software, Inc Integrity Level: HIGH Description: Installer Helper Exit code: 0 Version: 1.0.0.1 Modules
| |||||||||||||||
| 4068 | "C:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1954746 "__IRAFN:C:\Users\admin\Desktop\Setup.exe" "__IRCT:3" "__IRTSS:12702823" "__IRSID:S-1-5-21-1302019708-1500728564-335382590-1000" | C:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Setup.exe | ||||||||||||
User: admin Company: Indigo Rose Corporation Integrity Level: HIGH Description: Setup Application Exit code: 0 Version: 9.5.1.0 Modules
| |||||||||||||||
| (PID) Process: | (3824) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (3824) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (3824) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (3824) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\Stf64.rar | |||
| (PID) Process: | (3824) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (3824) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (3824) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (3824) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (3460) Patch.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\FirstFolder |
| Operation: | write | Name: | 0 |
Value: 43003A005C00550073006500720073005C00610064006D0069006E005C004400650073006B0074006F0070005C00500061007400630068002E00650078006500000043003A005C00550073006500720073005C00610064006D0069006E005C004400650073006B0074006F0070000000 | |||
| (PID) Process: | (3460) Patch.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\FirstFolder |
| Operation: | write | Name: | MRUListEx |
Value: 00000000FFFFFFFF | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3824 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3824.6104\Setup.exe | — | |
MD5:— | SHA256:— | |||
| 4068 | irsetup.exe | C:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.dat | — | |
MD5:— | SHA256:— | |||
| 3824 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3824.6465\Patch.exe | executable | |
MD5:A83C862CE356CE27AA1BCAD439DE71AC | SHA256:5405E5C8A154F6219C933DBA05EF3CA2D1162E666CD36B183BA8580F209C898E | |||
| 4068 | irsetup.exe | C:\Users\admin\AppData\Local\Temp\Stardock Fences 3 Setup Log.txt | text | |
MD5:— | SHA256:— | |||
| 4068 | irsetup.exe | C:\Users\admin\AppData\Local\Temp\Cab7AB2.tmp | — | |
MD5:— | SHA256:— | |||
| 4068 | irsetup.exe | C:\Users\admin\AppData\Local\Temp\Tar7AB3.tmp | — | |
MD5:— | SHA256:— | |||
| 4068 | irsetup.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\groupy-2[1].htm | html | |
MD5:— | SHA256:— | |||
| 4068 | irsetup.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\YXECZZ1Z.txt | — | |
MD5:— | SHA256:— | |||
| 4068 | irsetup.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\FA50A800.txt | — | |
MD5:— | SHA256:— | |||
| 4068 | irsetup.exe | C:\Users\admin\AppData\Local\Temp\sdWebResults.xml | text | |
MD5:— | SHA256:— | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
4068 | irsetup.exe | GET | 200 | 205.234.175.175:80 | http://stardock.cachefly.net/installer_crosssell_images/groupy_v2.jpg | US | image | 66.2 Kb | whitelisted |
4068 | irsetup.exe | GET | 200 | 205.234.175.175:80 | http://stardock.cachefly.net/installer_crosssell_images/bg_v1.png | US | image | 973 b | whitelisted |
4068 | irsetup.exe | GET | 200 | 172.217.23.99:80 | http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D | US | der | 468 b | whitelisted |
4068 | irsetup.exe | GET | 200 | 172.217.23.99:80 | http://ocsp.pki.goog/gts1o1/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQCgdZM8AVzzKAgAAAAALnDU | US | der | 472 b | whitelisted |
4068 | irsetup.exe | POST | 200 | 66.79.209.82:80 | http://install.api.stardock.net/installer/Initialize/?format=xml | US | text | 735 b | whitelisted |
4068 | irsetup.exe | GET | 200 | 66.79.209.93:80 | http://installers.stardock.com/crosssell/groupy-2/ | US | html | 888 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4068 | irsetup.exe | 66.79.209.82:80 | install.api.stardock.net | Telnet Worldwide, Inc. | US | malicious |
4068 | irsetup.exe | 205.234.175.175:80 | stardock.cachefly.net | CacheNetworks, Inc. | US | suspicious |
4068 | irsetup.exe | 66.79.209.93:80 | installers.stardock.com | Telnet Worldwide, Inc. | US | unknown |
4068 | irsetup.exe | 216.58.207.46:443 | www.google-analytics.com | Google Inc. | US | whitelisted |
4068 | irsetup.exe | 172.217.23.99:80 | ocsp.pki.goog | Google Inc. | US | whitelisted |
Domain | IP | Reputation |
|---|---|---|
install.api.stardock.net |
| whitelisted |
installers.stardock.com |
| unknown |
stardock.cachefly.net |
| whitelisted |
www.google-analytics.com |
| whitelisted |
ocsp.pki.goog |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
4068 | irsetup.exe | Misc activity | ADWARE [PTsecurity] Setup Factory Installer Checkin |