File name: | Spyware.zip |
Full analysis: | https://app.any.run/tasks/ade80e18-85da-432b-a362-7bf5d3abc361 |
Verdict: | Malicious activity |
Threats: | Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying. |
Analysis date: | March 10, 2024, 23:53:52 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v4.5 to extract, compression method=deflate |
MD5: | 02017DAB46A248B6C69982C35AFDFA21 |
SHA1: | 2958978BE43FA2B1AB2C7076182282B15D17E2DC |
SHA256: | 4D104F2A3CB1812C62F80E35F7287D91B68C0163377001779B10E88C974F038D |
SSDEEP: | 98304:j8BCqQ11cdi1Kvn5m01NZ8SwGYi1jVnVicrFiYM33dKGmOCROFjYEIR/2gX+rlKe:+iV767g |
.zip | | | ZIP compressed archive (100) |
---|
ZipFileName: | Spyware/ |
---|---|
ZipUncompressedSize: | - |
ZipCompressedSize: | 2 |
ZipCRC: | 0x00000000 |
ZipModifyDate: | 2024:03:03 01:03:36 |
ZipCompression: | Deflated |
ZipBitFlag: | 0x0800 |
ZipRequiredVersion: | 45 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
3700 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Spyware.zip" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.91.0 Modules
| |||||||||||||||
3460 | "C:\Users\admin\AppData\Local\Temp\Spyware\Spyware\butterflyondesktop.exe" | C:\Users\admin\AppData\Local\Temp\Spyware\Spyware\butterflyondesktop.exe | explorer.exe | ||||||||||||
User: admin Company: Drive Software Company Integrity Level: MEDIUM Description: Butterfly on Desktop Setup Exit code: 0 Version: Modules
| |||||||||||||||
2332 | "C:\Users\admin\AppData\Local\Temp\is-CHHLE.tmp\butterflyondesktop.tmp" /SL5="$120160,2719719,54272,C:\Users\admin\AppData\Local\Temp\Spyware\Spyware\butterflyondesktop.exe" | C:\Users\admin\AppData\Local\Temp\is-CHHLE.tmp\butterflyondesktop.tmp | — | butterflyondesktop.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: Setup/Uninstall Exit code: 0 Version: 51.52.0.0 Modules
| |||||||||||||||
3276 | "C:\Users\admin\AppData\Local\Temp\Spyware\Spyware\butterflyondesktop.exe" /SPAWNWND=$5020E /NOTIFYWND=$120160 | C:\Users\admin\AppData\Local\Temp\Spyware\Spyware\butterflyondesktop.exe | butterflyondesktop.tmp | ||||||||||||
User: admin Company: Drive Software Company Integrity Level: HIGH Description: Butterfly on Desktop Setup Exit code: 0 Version: Modules
| |||||||||||||||
3964 | "C:\Users\admin\AppData\Local\Temp\is-4V63K.tmp\butterflyondesktop.tmp" /SL5="$80240,2719719,54272,C:\Users\admin\AppData\Local\Temp\Spyware\Spyware\butterflyondesktop.exe" /SPAWNWND=$5020E /NOTIFYWND=$120160 | C:\Users\admin\AppData\Local\Temp\is-4V63K.tmp\butterflyondesktop.tmp | butterflyondesktop.exe | ||||||||||||
User: admin Integrity Level: HIGH Description: Setup/Uninstall Exit code: 0 Version: 51.52.0.0 Modules
| |||||||||||||||
2792 | "C:\Program Files\Butterfly on Desktop\ButterflyOnDesktop.exe" | C:\Program Files\Butterfly on Desktop\ButterflyOnDesktop.exe | — | butterflyondesktop.tmp | |||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
2064 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --single-argument http://freedesktopsoft.com/butterflyondesktoplike.html | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | butterflyondesktop.tmp | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
2364 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=109.0.5414.149 "--annotation=exe=C:\Program Files\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win32 "--annotation=prod=Microsoft Edge" --annotation=ver=109.0.1518.115 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd8,0x6a42f598,0x6a42f5a8,0x6a42f5b4 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
1768 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1328 --field-trial-handle=1392,i,1948850662048884830,8835101865411008669,131072 /prefetch:2 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
3324 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1580 --field-trial-handle=1392,i,1948850662048884830,8835101865411008669,131072 /prefetch:3 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
|
(PID) Process: | (3700) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtBMP |
Value: | |||
(PID) Process: | (3700) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtIcon |
Value: | |||
(PID) Process: | (3700) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (3700) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 3 |
Value: C:\Users\admin\Desktop\phacker.zip | |||
(PID) Process: | (3700) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\Win7-KB3191566-x86.zip | |||
(PID) Process: | (3700) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip | |||
(PID) Process: | (3700) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\Spyware.zip | |||
(PID) Process: | (3700) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | name |
Value: 120 | |||
(PID) Process: | (3700) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | size |
Value: 80 | |||
(PID) Process: | (3700) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | type |
Value: 120 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3964 | butterflyondesktop.tmp | C:\Users\admin\AppData\Local\Temp\is-3BMB7.tmp\_isetup\_RegDLL.tmp | executable | |
MD5:0EE914C6F0BB93996C75941E1AD629C6 | SHA256:4DC09BAC0613590F1FAC8771D18AF5BE25A1E1CB8FDBF4031AA364F3057E74A2 | |||
3964 | butterflyondesktop.tmp | C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Butterfly on Desktop\Uninstall Butterfly on Desktop.lnk | binary | |
MD5:D001999CFCA4F3EE8604854F5DBB8893 | SHA256:5C8C457EEBA4FFA0ED5B49D7EE129E9B2C993982C771E15FFB8D3852EBE2B3E7 | |||
3276 | butterflyondesktop.exe | C:\Users\admin\AppData\Local\Temp\is-4V63K.tmp\butterflyondesktop.tmp | executable | |
MD5:C765336F0DCF4EFDCC2101EED67CD30C | SHA256:C5177FDC6031728E10141745CD69EDBC91C92D14411A2DEC6E8E8CAA4F74AB28 | |||
3964 | butterflyondesktop.tmp | C:\Users\admin\AppData\Local\Temp\is-3BMB7.tmp\_isetup\_shfoldr.dll | executable | |
MD5:92DC6EF532FBB4A5C3201469A5B5EB63 | SHA256:9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87 | |||
3964 | butterflyondesktop.tmp | C:\Program Files\Butterfly on Desktop\is-AP3PA.tmp | executable | |
MD5:1FEE4DB19D9F5AF7834EC556311E69DD | SHA256:3D550C908D5A8DE143C5CD5F4FE431528CD5FA20B77F4605A9B8CA063E83FC36 | |||
3700 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Spyware\Spyware\AgentTesla.exe | executable | |
MD5:CCE284CAB135D9C0A2A64A7CAEC09107 | SHA256:18AAB0E981EEE9E4EF8E15D4B003B14B3A1B0BFB7233FADE8EE4B6A22A5ABBB9 | |||
3700 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Spyware\Spyware\butterflyondesktop.exe | executable | |
MD5:1535AA21451192109B86BE9BCC7C4345 | SHA256:4641AF6A0071E11E13AD3B1CD950E01300542C2B9EFB6AE92FFECEDDE974A4A6 | |||
3700 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Spyware\Spyware\The Worst Of All!!!!!!\BonziBUDDY!!!!!!.txt | text | |
MD5:804161C9689A11073CB06C6EFB14DF48 | SHA256:75AF24573F8E21F6F34E6AD1B6E25AE91DD6CC2BA97AD10E119354ADCCFF1E59 | |||
3700 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Spyware\Spyware\Kakwa.doc | document | |
MD5:9A039302B3F3109607DFA7C12CFBD886 | SHA256:31CA294DDD253E4258A948CF4D4B7AAAA3E0AA1457556E0E62EE53C22B4EB6F0 | |||
3460 | butterflyondesktop.exe | C:\Users\admin\AppData\Local\Temp\is-CHHLE.tmp\butterflyondesktop.tmp | executable | |
MD5:C765336F0DCF4EFDCC2101EED67CD30C | SHA256:C5177FDC6031728E10141745CD69EDBC91C92D14411A2DEC6E8E8CAA4F74AB28 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3800 | msedge.exe | GET | 200 | 78.46.117.95:80 | http://freedesktopsoft.com/images/superman_likeus.gif | unknown | image | 30.8 Kb | unknown |
1808 | msedge.exe | GET | 301 | 172.67.165.22:80 | http://www.veryicon.com/icon/png/Flag/Flag%204/United%20Kingdom.png | unknown | — | — | unknown |
3800 | msedge.exe | GET | 200 | 78.46.117.95:80 | http://freedesktopsoft.com/button.css | unknown | text | 2.71 Kb | unknown |
3800 | msedge.exe | GET | 200 | 78.46.117.95:80 | http://freedesktopsoft.com/slider/slider.css | unknown | text | 6.40 Kb | unknown |
3800 | msedge.exe | GET | 200 | 78.46.117.95:80 | http://freedesktopsoft.com/images/banner3.jpg | unknown | image | 41.3 Kb | unknown |
3800 | msedge.exe | GET | 200 | 78.46.117.95:80 | http://freedesktopsoft.com/images/bodybackground.png | unknown | image | 11.6 Kb | unknown |
3800 | msedge.exe | GET | 200 | 78.46.117.95:80 | http://freedesktopsoft.com/images/menubackgroundside2.jpg | unknown | image | 1.35 Kb | unknown |
3800 | msedge.exe | GET | 200 | 78.46.117.95:80 | http://freedesktopsoft.com/butterflyondesktoplike.html | unknown | html | 6.04 Kb | unknown |
3800 | msedge.exe | GET | 200 | 78.46.117.95:80 | http://freedesktopsoft.com/main.css | unknown | text | 4.15 Kb | unknown |
3800 | msedge.exe | GET | 200 | 78.46.117.95:80 | http://freedesktopsoft.com/images/menubackground2.jpg | unknown | image | 16.4 Kb | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 224.0.0.252:5355 | — | — | — | unknown |
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
3800 | msedge.exe | 78.46.117.95:80 | freedesktopsoft.com | Hetzner Online GmbH | DE | unknown |
2100 | msedge.exe | 239.255.255.250:1900 | — | — | — | unknown |
3800 | msedge.exe | 13.107.42.16:443 | config.edge.skype.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
3800 | msedge.exe | 204.79.197.239:443 | edge.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | unknown |
3800 | msedge.exe | 142.251.36.34:443 | pagead2.googlesyndication.com | GOOGLE | US | unknown |
3800 | msedge.exe | 142.250.179.174:80 | www.google-analytics.com | GOOGLE | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
freedesktopsoft.com |
| malicious |
edge.microsoft.com |
| whitelisted |
config.edge.skype.com |
| whitelisted |
pagead2.googlesyndication.com |
| whitelisted |
www.google-analytics.com |
| whitelisted |
connect.facebook.net |
| whitelisted |
googleads.g.doubleclick.net |
| whitelisted |
fundingchoicesmessages.google.com |
| whitelisted |
www.bing.com |
| whitelisted |
megabytemantom.com |
| unknown |
PID | Process | Class | Message |
---|---|---|---|
1808 | msedge.exe | Not Suspicious Traffic | INFO [ANY.RUN] Cloudflare Network Error Logging (NEL) |
1808 | msedge.exe | Misc activity | ET INFO File Sharing Related Domain in DNS Lookup (mega .nz) |
1808 | msedge.exe | Misc activity | ET INFO File Sharing Related Domain in DNS Lookup (mega .nz) |
1808 | msedge.exe | Misc activity | ET INFO File Sharing Related Domain in DNS Lookup (mega .nz) |
276 | taskhost.exe | Potential Corporate Privacy Violation | ET POLICY Bitmessage Activity |
1808 | msedge.exe | Misc activity | ET INFO File Sharing Domain Observed in TLS SNI (mega .nz) |
1808 | msedge.exe | Misc activity | ET INFO File Sharing Domain Observed in TLS SNI (mega .nz) |
1808 | msedge.exe | Misc activity | ET INFO Observed DNS Query to Filesharing Service (mega .co .nz) |
1808 | msedge.exe | Misc activity | ET INFO Observed DNS Query to Filesharing Service (mega .co .nz) |
1808 | msedge.exe | Misc activity | ET INFO Observed DNS Query to Filesharing Service (mega .co .nz) |