File name: | vbehxx.zip |
Full analysis: | https://app.any.run/tasks/1aa893b7-c0ae-4e7f-8b54-e8a780964692 |
Verdict: | Malicious activity |
Analysis date: | June 27, 2022, 05:44:31 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | DFB15C3BDEFF52B5B2D88F8CCA0B76FF |
SHA1: | 02CE8A26A825CBE44A28820415DB10CF5C75CF27 |
SHA256: | 2E80059A92E23F07ECE25CD25F4E855CB01C8623A5CA9D8D63756C2273368563 |
SSDEEP: | 768:YgV76KrqScCf4h4ywSC1/VzXDiAJgwkLF3YwzyrNjP:Yc6Kr27SV1/5z5Hhz |
.zip | | | ZIP compressed archive (100) |
---|
ZipRequiredVersion: | 20 |
---|---|
ZipBitFlag: | - |
ZipCompression: | Deflated |
ZipModifyDate: | 2021:11:01 16:51:27 |
ZipCRC: | 0xe6a17274 |
ZipCompressedSize: | 34474 |
ZipUncompressedSize: | 107168 |
ZipFileName: | fucker script.exe |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2412 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\vbehxx.zip" | C:\Program Files\WinRAR\WinRAR.exe | Explorer.EXE | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 | ||||
3700 | "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,Control_RunDLL C:\Windows\System32\main.cpl ,1 | C:\Windows\system32\rundll32.exe | — | Explorer.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
884 | "C:\Windows\explorer.exe" | C:\Windows\explorer.exe | — | Explorer.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3040 | "C:\Windows\system32\UserAccountControlSettings.exe" | C:\Windows\system32\UserAccountControlSettings.exe | — | Explorer.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: UserAccountControlSettings Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3912 | C:\Windows\system32\DllHost.exe /Processid:{EA2C6B24-C590-457B-BAC8-4A0F9B13B5B8} | C:\Windows\system32\DllHost.exe | — | svchost.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: COM Surrogate Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2060 | C:\Windows\system32\DllHost.exe /Processid:{06C792F8-6212-4F39-BF70-E8C0AC965C23} | C:\Windows\system32\DllHost.exe | — | svchost.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: COM Surrogate Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3412 | "C:\Windows\system32\UserAccountControlSettings.exe" /applySettings | C:\Windows\system32\UserAccountControlSettings.exe | DllHost.exe | |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: UserAccountControlSettings Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
1960 | "C:\Users\admin\AppData\Local\Temp\67c04cb0-a689-4a5b-9288-e0be80394969.exe" | C:\Users\admin\AppData\Local\Temp\67c04cb0-a689-4a5b-9288-e0be80394969.exe | — | Explorer.EXE |
User: admin Integrity Level: MEDIUM | ||||
3496 | "C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE" | C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE | — | Explorer.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Version: 14.0.6025.1000 | ||||
3928 | "C:\Program Files\VideoLAN\VLC\vlc.exe" | C:\Program Files\VideoLAN\VLC\vlc.exe | Explorer.EXE | |
User: admin Company: VideoLAN Integrity Level: MEDIUM Description: VLC media player Version: 3.0.11 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3496 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVR22A8.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2584 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVR26EE.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2868 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVR270D.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3496 | OUTLOOK.EXE | C:\Users\admin\Documents\Outlook Files\Outlook Data File - NoMail.pst | — | |
MD5:— | SHA256:— | |||
1016 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVR46AB.tmp.cvr | — | |
MD5:— | SHA256:— | |||
880 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVR5FB1.tmp.cvr | — | |
MD5:— | SHA256:— | |||
4168 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVR5FFF.tmp.cvr | — | |
MD5:— | SHA256:— | |||
4296 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVR607C.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3496 | OUTLOOK.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Outlook.lnk | lnk | |
MD5:301F671CC17AF078AC9A373BB2430E6D | SHA256:8D2A3C21C2A78050CDF58078ED973025CA0E86B8895D0FCB0889B0D0AD7ACE0C | |||
3496 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.log | text | |
MD5:405814A990CA4F0B2A4172A165D451B2 | SHA256:D6C9F0A80CE5C52476FFE6BC118BCF4EC4F54D1F7CBD7AD3F804E7BAB17215FE |
Process | Message |
---|---|
vlc.exe | main libvlc debug: VLC media player - 3.0.11 Vetinari
|
vlc.exe | main libvlc debug: Copyright © 1996-2020 the VideoLAN team
|
vlc.exe | main libvlc debug: revision 3.0.11-0-gdc0c5ced72
|
vlc.exe | main libvlc debug: configured with ../extras/package/win32/../../../configure '--enable-update-check' '--enable-lua' '--enable-faad' '--enable-flac' '--enable-theora' '--enable-avcodec' '--enable-merge-ffmpeg' '--enable-dca' '--enable-mpc' '--enable-libass' '--enable-schroedinger' '--enable-realrtsp' '--enable-live555' '--enable-dvdread' '--enable-shout' '--enable-goom' '--enable-caca' '--enable-qt' '--enable-skins2' '--enable-sse' '--enable-mmx' '--enable-libcddb' '--enable-zvbi' '--disable-telx' '--enable-nls' '--host=i686-w64-mingw32' '--with-breakpad=https://win.crashes.videolan.org' 'host_alias=i686-w64-mingw32' 'PKG_CONFIG_LIBDIR=/home/jenkins/workspace/vlc-release/windows/vlc-release-win32-x86/contrib/i686-w64-mingw32/lib/pkgconfig'
|
vlc.exe | main libvlc debug: using multimedia timers as clock source
|
vlc.exe | main libvlc debug: min period: 1 ms, max period: 1000000 ms
|
vlc.exe | main libvlc debug: searching plug-in modules
|
vlc.exe | main libvlc debug: loading plugins cache file C:\Program Files\VideoLAN\VLC\plugins\plugins.dat
|
vlc.exe | main libvlc debug: recursively browsing `C:\Program Files\VideoLAN\VLC\plugins'
|
vlc.exe | main libvlc error: stale plugins cache: modified C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_concat_plugin.dll
|