File name: | setup_hwid-changer-v1.2-[pc]l_5565265683983.zip |
Full analysis: | https://app.any.run/tasks/c46a94eb-dfea-4927-9a12-4298a83e2f33 |
Verdict: | Malicious activity |
Analysis date: | July 12, 2020, 21:02:58 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | 32249D44B284950C76AE9FF174DB9217 |
SHA1: | 4F0758D80668F317D7893FC2D42EA3A9DB69D483 |
SHA256: | 395C2EEB6EAD252E84122CAE73266EFEFFD085ABFEAAFEF958E4C8BC4D0C4C5D |
SSDEEP: | 196608:rvSPoX84G8SKWBbvEzfNTEunMHimYyqJl1fFEt8NRvj4rntIK4SUPPXyTKvo:rvSPCcXnTKNnJe2HfFEt83j4rntMXxvo |
.zip | | | ZIP compressed archive (100) |
---|
ZipFileName: | setup_hwid-changer-v1.2-[pc]l_5565265683983.exe |
---|---|
ZipUncompressedSize: | 10016856 |
ZipCompressedSize: | 9801680 |
ZipCRC: | 0x1bb4a7bf |
ZipModifyDate: | 2020:07:13 00:01:23 |
ZipCompression: | Deflated |
ZipBitFlag: | 0x0002 |
ZipRequiredVersion: | 20 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2352 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\setup_hwid-changer-v1.2-[pc]l_5565265683983.zip" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 | ||||
2980 | "C:\Users\admin\Desktop\setup_hwid-changer-v1.2-[pc]l_5565265683983.exe" | C:\Users\admin\Desktop\setup_hwid-changer-v1.2-[pc]l_5565265683983.exe | — | explorer.exe |
User: admin Company: Auslogics Integrity Level: MEDIUM Description: Auslogics Registry Cleaner Installation File Exit code: 3221226540 Version: 8.x | ||||
1832 | "C:\Users\admin\Desktop\setup_hwid-changer-v1.2-[pc]l_5565265683983.exe" | C:\Users\admin\Desktop\setup_hwid-changer-v1.2-[pc]l_5565265683983.exe | explorer.exe | |
User: admin Company: Auslogics Integrity Level: HIGH Description: Auslogics Registry Cleaner Installation File Exit code: 3735929054 Version: 8.x | ||||
1772 | "C:\Users\admin\Desktop\procexp.exe" | C:\Users\admin\Desktop\procexp.exe | explorer.exe | |
User: admin Company: Sysinternals - www.sysinternals.com Integrity Level: MEDIUM Description: Sysinternals Process Explorer Exit code: 0 Version: 16.32 | ||||
3948 | "C:\Users\admin\Desktop\setup_hwid-changer-v1.2-[pc]l_5565265683983.exe" | C:\Users\admin\Desktop\setup_hwid-changer-v1.2-[pc]l_5565265683983.exe | — | explorer.exe |
User: admin Company: Auslogics Integrity Level: MEDIUM Description: Auslogics Registry Cleaner Installation File Exit code: 3221226540 Version: 8.x | ||||
412 | "C:\Users\admin\Desktop\setup_hwid-changer-v1.2-[pc]l_5565265683983.exe" | C:\Users\admin\Desktop\setup_hwid-changer-v1.2-[pc]l_5565265683983.exe | explorer.exe | |
User: admin Company: Auslogics Integrity Level: HIGH Description: Auslogics Registry Cleaner Installation File Exit code: 3735929054 Version: 8.x | ||||
4008 | "C:\Users\admin\Desktop\setup_hwid-changer-v1.2-[pc]l_5565265683983.exe" | C:\Users\admin\Desktop\setup_hwid-changer-v1.2-[pc]l_5565265683983.exe | explorer.exe | |
User: admin Company: Auslogics Integrity Level: HIGH Description: Auslogics Registry Cleaner Installation File Exit code: 3735929054 Version: 8.x |
PID | Process | Filename | Type | |
---|---|---|---|---|
2352 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2352.13801\setup_hwid-changer-v1.2-[pc]l_5565265683983.exe | — | |
MD5:— | SHA256:— | |||
1772 | procexp.exe | C:\Users\admin\AppData\Local\Temp\PROCEXP152.SYS | — | |
MD5:— | SHA256:— | |||
1772 | procexp.exe | C:\Users\admin\AppData\Local\Temp\CabF86E.tmp | — | |
MD5:— | SHA256:— | |||
1772 | procexp.exe | C:\Users\admin\AppData\Local\Temp\TarF86F.tmp | — | |
MD5:— | SHA256:— | |||
1772 | procexp.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\696F3DE637E6DE85B458996D49D759AD | der | |
MD5:FD2E66B83402FC809B69A4095950C0B2 | SHA256:BBD46B23D9F86AEE159DA852D6389983F06DA22BE04F0ACFA81CDC821FE18D51 | |||
1772 | procexp.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F90F18257CBB4D84216AC1E1F3BB2C76 | der | |
MD5:A09F5282121F46A6A307CC1AD1729304 | SHA256:CDAC0B085932DDB58B48CD9C97A258A489DC796B18C8FD13C533952806A2786B | |||
1772 | procexp.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F90F18257CBB4D84216AC1E1F3BB2C76 | binary | |
MD5:90CCA0DCFA86967FCFCDFC4ACE3DC023 | SHA256:994BCD27EC8EAD9ACA4DA1B05B8A84AA059F7E1CB876657CD2D8B71886565479 | |||
1772 | procexp.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\696F3DE637E6DE85B458996D49D759AD | binary | |
MD5:8B8ED342E0B89800FEA37E043B3FFFF9 | SHA256:41BA03E7D29F5557BE1493A241FF7334389D07B6C89FB42180F14A04DCACF0E1 | |||
1772 | procexp.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B8CC409ACDBF2A2FE04C56F2875B1FD6 | binary | |
MD5:6D39FCD28CD1C553AADCFF9BCE0211AE | SHA256:5D448B8B112C39F3B9107982545BDE3818F4C295BE4AC1D677A16125B4160375 | |||
2352 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2352.13632\procexp.exe | executable | |
MD5:907D7E58EDEA108B21F69780C75F32A9 | SHA256:C567D353E35A8D90D2A214E78313BF8C9A18E95A942715A3FD1AC944BFF1296F |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
1772 | procexp.exe | GET | 200 | 2.21.242.227:80 | http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl | NL | der | 781 b | whitelisted |
1772 | procexp.exe | GET | 200 | 2.21.242.227:80 | http://crl.microsoft.com/pki/crl/products/WinPCA.crl | NL | der | 530 b | whitelisted |
1772 | procexp.exe | GET | 200 | 2.21.242.227:80 | http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl | NL | der | 550 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
1772 | procexp.exe | 2.21.242.227:80 | crl.microsoft.com | Akamai International B.V. | NL | whitelisted |
Domain | IP | Reputation |
---|---|---|
crl.microsoft.com |
| whitelisted |