File name: | IDM.Trial.Reset.v1.0.0.zip |
Full analysis: | https://app.any.run/tasks/af164cd0-810a-4551-8931-e8fb6e26c185 |
Verdict: | Malicious activity |
Analysis date: | December 06, 2019, 19:37:59 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | 016866100C1BEFF73C59F5E02323BE46 |
SHA1: | 60AA90998FDE73E03FFBE42BF899793B32E2EE65 |
SHA256: | 372DC10FBE87C1744D2852877E0D36D37E034B5507F868DE61C8BA6A46D0E012 |
SSDEEP: | 12288:F3EHTdr/G+70+d5oVe+TghBAcRlbqm9Ks3wjNind3y4/VA/Sznml3gUdfFUWgsD5:BN+g6oVe+TgrVWAAjadF/XAVha2D7l |
.zip | | | ZIP compressed archive (100) |
---|
ZipRequiredVersion: | 20 |
---|---|
ZipBitFlag: | - |
ZipCompression: | Deflated |
ZipModifyDate: | 2016:09:06 05:20:13 |
ZipCRC: | 0xd3e76a9d |
ZipCompressedSize: | 881964 |
ZipUncompressedSize: | 895488 |
ZipFileName: | IDM Trial Reset.exe |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
1484 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\IDM.Trial.Reset.v1.0.0.zip" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
2060 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa1484.10474\IDM Trial Reset.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa1484.10474\IDM Trial Reset.exe | WinRAR.exe | |
User: admin Company: J2TeaM Integrity Level: MEDIUM Description: Use IDM forever without cracking Version: 1.0.0.0 | ||||
3088 | C:\Windows\system32\cmd.exe /c reg query hkcr\clsid /s > C:\Users\admin\AppData\Local\Temp\reg_query.tmp | C:\Windows\system32\cmd.exe | — | IDM Trial Reset.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
4004 | reg query hkcr\clsid /s | C:\Windows\system32\reg.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Registry Console Tool Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
1292 | "C:\Windows\system32\cmd.exe" /c findstr /N /I cDTvBFquXk0 C:\Users\admin\AppData\Local\Temp\reg_query.tmp | C:\Windows\system32\cmd.exe | — | IDM Trial Reset.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3044 | findstr /N /I cDTvBFquXk0 C:\Users\admin\AppData\Local\Temp\reg_query.tmp | C:\Windows\system32\findstr.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Find String (QGREP) Utility Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3928 | "C:\Windows\system32\cmd.exe" /c findstr /N . C:\Users\admin\AppData\Local\Temp\reg_query.tmp | findstr /b -1: | C:\Windows\system32\cmd.exe | — | IDM Trial Reset.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 2 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
1096 | findstr /N . C:\Users\admin\AppData\Local\Temp\reg_query.tmp | C:\Windows\system32\findstr.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Find String (QGREP) Utility Exit code: 2 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
856 | findstr /b -1: | C:\Windows\system32\findstr.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Find String (QGREP) Utility Exit code: 2 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
932 | "C:\Users\admin\AppData\Local\Temp\SetACLx32.exe" -on HKCU\Software\Classes\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192} -ot reg -actn setowner -ownr "n:S-1-1-0" -silent | C:\Users\admin\AppData\Local\Temp\SetACLx32.exe | — | IDM Trial Reset.exe |
User: admin Company: Helge Klein Integrity Level: MEDIUM Description: SetACL 3 Exit code: 5 Version: 3.0.6.0 |
(PID) Process: | (1484) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtBMP |
Value: | |||
(PID) Process: | (1484) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtIcon |
Value: | |||
(PID) Process: | (1484) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (1484) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\IDM.Trial.Reset.v1.0.0.zip | |||
(PID) Process: | (1484) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | name |
Value: 120 | |||
(PID) Process: | (1484) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | size |
Value: 80 | |||
(PID) Process: | (1484) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | type |
Value: 120 | |||
(PID) Process: | (1484) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | mtime |
Value: 100 | |||
(PID) Process: | (1484) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
(PID) Process: | (1484) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 1 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2060 | IDM Trial Reset.exe | C:\Users\admin\AppData\Local\Temp\autC7EE.tmp | — | |
MD5:— | SHA256:— | |||
2060 | IDM Trial Reset.exe | C:\Users\admin\AppData\Local\Temp\autC7EF.tmp | — | |
MD5:— | SHA256:— | |||
2060 | IDM Trial Reset.exe | C:\Users\admin\AppData\Local\Temp\autC7F0.tmp | — | |
MD5:— | SHA256:— | |||
2060 | IDM Trial Reset.exe | C:\Users\admin\AppData\Local\Temp\autC7F1.tmp | — | |
MD5:— | SHA256:— | |||
2060 | IDM Trial Reset.exe | C:\Users\admin\AppData\Local\Temp\autC821.tmp | — | |
MD5:— | SHA256:— | |||
3088 | cmd.exe | C:\Users\admin\AppData\Local\Temp\reg_query.tmp | text | |
MD5:0A8E0FE081097E29AE629307416591C4 | SHA256:6102278316B1109EC080821F0496DE8D604898D8086132C99E89303DB5FAE01E | |||
2060 | IDM Trial Reset.exe | C:\Users\admin\AppData\Local\Temp\idm_reg.reg | text | |
MD5:3DEDFE7770A57CA2BCB76D01D1756EE6 | SHA256:832134EB65B2A91BE5B6584B48AB69B4B7CE9B6228EA4738F6D1B7A8A0E1915E | |||
1484 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa1484.10474\IDM Trial Reset.exe | executable | |
MD5:064F82094AE6A6E22C28A6F1EF868A26 | SHA256:A2D2B22CD0D5628976EB5996A8B20F3B5AC468907910DBC3F826F1069D435587 | |||
2060 | IDM Trial Reset.exe | C:\Users\admin\AppData\Local\Temp\idm_trial.reg | text | |
MD5:237962E36948F3D0C9EC42EFA289AC52 | SHA256:40AD93CF424EEE41A0877B11ACB92F7F12D58AB3AA6FA6D64D92CFBBE11695A2 | |||
2060 | IDM Trial Reset.exe | C:\Users\admin\AppData\Local\Temp\SetACLx64.exe | executable | |
MD5:3E350EB5DF15C06DEC400A39DD1C6F29 | SHA256:427FF43693CB3CA2812C4754F607F107A6B2D3F5A8B313ADDEE57D89982DF419 |