File name: | Ransomware-Builder-v0.2d-master.rar |
Full analysis: | https://app.any.run/tasks/afe83809-f046-40ae-874d-55adee79124e |
Verdict: | Malicious activity |
Analysis date: | January 17, 2020, 21:39:27 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-rar |
File info: | RAR archive data, v5 |
MD5: | 701D229BFB274801626CF65D7829DB93 |
SHA1: | 61647ED6978F88D9BAD3425BF4620CE168AFBB35 |
SHA256: | 354D02C57914426CE5F7C284E52F73A88797297F453DB9E6123004D0BAEC04E0 |
SSDEEP: | 3072:mpgoRBe/dSe8rOoisHu13c/DVrs0JI0KhU+KAT794qNbqnk4q52i2:joiQrfiEuW/DAqk4g2i2 |
.rar | | | RAR compressed archive (v5.0) (61.5) |
---|---|---|
.rar | | | RAR compressed archive (gen) (38.4) |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3332 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Ransomware-Builder-v0.2d-master.rar" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
2096 | "C:\Users\admin\Desktop\Ransomware-Builder-v0.2d-master\RansomBuilder.exe" | C:\Users\admin\Desktop\Ransomware-Builder-v0.2d-master\RansomBuilder.exe | explorer.exe | |
User: admin Company: Microsoft Integrity Level: MEDIUM Description: RansomBuilder Version: 1.0.0.0 | ||||
2452 | "C:\Users\admin\AppData\Local\Temp\RansomBuilder.exe" | C:\Users\admin\AppData\Local\Temp\RansomBuilder.exe | — | RansomBuilder.exe |
User: admin Company: FeelFreeSoft(R) Integrity Level: MEDIUM Description: Ransom Builder v0.2d Exit code: 0 Version: 0.0.2.0 | ||||
3144 | "C:\Users\admin\AppData\Local\Temp\MSBuild.exe" | C:\Users\admin\AppData\Local\Temp\MSBuild.exe | — | RansomBuilder.exe |
User: admin Integrity Level: MEDIUM Description: Bitcoin-Grabber Version: 1.0.0.0 | ||||
2692 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\tynvlf0b.cmdline" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe | RansomBuilder.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Visual C# Command Line Compiler Exit code: 0 Version: 4.7.3062.0 built by: NET472REL1 | ||||
3452 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RESE5D6.tmp" "c:\Users\admin\Desktop\Ransomware-Builder-v0.2d-master\CSC781D78A7F44C42329A7B574AB25F1E63.TMP" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe | — | csc.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft® Resource File To COFF Object Conversion Utility Exit code: 0 Version: 12.00.52519.0 built by: VSWINSERVICING | ||||
2436 | "C:\Users\admin\Desktop\Ransomware-Builder-v0.2d-master\malnig.exe" | C:\Users\admin\Desktop\Ransomware-Builder-v0.2d-master\malnig.exe | explorer.exe | |
User: admin Integrity Level: MEDIUM Description: Exit code: 3762504530 Version: 0.0.0.0 | ||||
3764 | "C:\Users\admin\Desktop\Ransomware-Builder-v0.2d-master\malnig.exe" | C:\Users\admin\Desktop\Ransomware-Builder-v0.2d-master\malnig.exe | explorer.exe | |
User: admin Integrity Level: HIGH Description: Exit code: 3762504530 Version: 0.0.0.0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3332 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3332.19575\Ransomware-Builder-v0.2d-master\crypt.source | — | |
MD5:— | SHA256:— | |||
3332 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3332.19575\Ransomware-Builder-v0.2d-master\Decryptor\Decryptor v0.2d.exe | — | |
MD5:— | SHA256:— | |||
3332 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3332.19575\Ransomware-Builder-v0.2d-master\Icons\Lock.ico | — | |
MD5:— | SHA256:— | |||
3332 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3332.19575\Ransomware-Builder-v0.2d-master\Icons\Radioactive.ico | — | |
MD5:— | SHA256:— | |||
3332 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3332.19575\Ransomware-Builder-v0.2d-master\log.txt | — | |
MD5:— | SHA256:— | |||
3332 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3332.19575\Ransomware-Builder-v0.2d-master\RansomBuilder.exe | — | |
MD5:— | SHA256:— | |||
3332 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3332.19575\Ransomware-Builder-v0.2d-master\RansomBuilder.exe.config | — | |
MD5:— | SHA256:— | |||
3332 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3332.19575\Ransomware-Builder-v0.2d-master\RansomBuilder.pdb | — | |
MD5:— | SHA256:— | |||
3332 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3332.19575\Ransomware-Builder-v0.2d-master\RansomBuilder.vshost.exe | — | |
MD5:— | SHA256:— | |||
3332 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3332.19575\Ransomware-Builder-v0.2d-master\RansomBuilder.vshost.exe.config | — | |
MD5:— | SHA256:— |