| File name: | MDE_File_Sample_06e66a54c6f7b8f984b8f6f063b28ee999303b52.zip |
| Full analysis: | https://app.any.run/tasks/a2d1836a-5e47-4bd2-9840-f59c31287548 |
| Verdict: | Malicious activity |
| Analysis date: | November 10, 2021, 17:07:19 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v2.0 to extract |
| MD5: | CFBC4FB4AB9C308521BFAE2D50288E01 |
| SHA1: | BE9B55EF27903EEB1272D6DFA0CE0DD218654250 |
| SHA256: | 2AFCC306D09E14E7D75B991096F65C76D654856D1D55535733E5B56B5C845B20 |
| SSDEEP: | 24576:zpQUS8bhSy85YUK1v3j856ZDHnA+f8O5hv61NCVuHuUiBUgBv++eeBg/:Kx8bwtYUK1sgNR2NzHzgFR1Bk |
MALICIOUS
Application was dropped or rewritten from another process
- 360huabao.exe (PID: 2800)
- 360huabao.exe (PID: 2780)
- 360huabao.exe (PID: 3600)
SUSPICIOUS
Reads the computer name
- WinRAR.exe (PID: 3412)
Checks supported languages
- WinRAR.exe (PID: 3412)
- 360huabao.exe (PID: 2800)
- 360huabao.exe (PID: 2780)
- 360huabao.exe (PID: 3600)
Executable content was dropped or overwritten
- WinRAR.exe (PID: 3412)
Drops a file with a compile date too recent
- WinRAR.exe (PID: 3412)
Drops a file that was compiled in debug mode
- WinRAR.exe (PID: 3412)
INFO
Manual execution by user
- 360huabao.exe (PID: 2780)
- 360huabao.exe (PID: 3600)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .zip | | | ZIP compressed archive (100) |
|---|
EXIF
ZIP
| ZipRequiredVersion: | 20 |
|---|---|
| ZipBitFlag: | 0x0001 |
| ZipCompression: | Deflated |
| ZipModifyDate: | 2021:11:10 16:54:15 |
| ZipCRC: | 0x4a1f8fb3 |
| ZipCompressedSize: | 1157695 |
| ZipUncompressedSize: | 2503648 |
| ZipFileName: | 360huabao.exe |
Total processes
37
Monitored processes
4
Malicious processes
2
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2780 | "C:\Users\admin\Desktop\360huabao.exe" | C:\Users\admin\Desktop\360huabao.exe | — | Explorer.EXE | |||||||||||
User: admin Integrity Level: MEDIUM Description: 360?? Exit code: 0 Version: 1.10.12.0 Modules
| |||||||||||||||
| 2800 | "C:\Users\admin\AppData\Local\Temp\Rar$EXb3412.20272\360huabao.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXb3412.20272\360huabao.exe | — | WinRAR.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: 360?? Exit code: 0 Version: 1.10.12.0 Modules
| |||||||||||||||
| 3412 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\MDE_File_Sample_06e66a54c6f7b8f984b8f6f063b28ee999303b52.zip" | C:\Program Files\WinRAR\WinRAR.exe | Explorer.EXE | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
| 3600 | "C:\Users\admin\Desktop\360huabao.exe" | C:\Users\admin\Desktop\360huabao.exe | — | Explorer.EXE | |||||||||||
User: admin Integrity Level: MEDIUM Description: 360?? Exit code: 0 Version: 1.10.12.0 Modules
| |||||||||||||||
Total events
1 451
Read events
1 431
Write events
20
Delete events
0
Modification events
| (PID) Process: | (3412) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (3412) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (3412) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (3412) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip | |||
| (PID) Process: | (3412) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\MDE_File_Sample_06e66a54c6f7b8f984b8f6f063b28ee999303b52.zip | |||
| (PID) Process: | (3412) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (3412) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (3412) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (3412) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (3412) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface |
| Operation: | write | Name: | ShowPassword |
Value: 1 | |||
Executable files
2
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3412 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb3412.22012\360huabao.exe | executable | |
MD5:— | SHA256:— | |||
| 3412 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXb3412.20272\360huabao.exe | executable | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report