File name: | test.rar |
Full analysis: | https://app.any.run/tasks/9a443122-2af2-4485-8038-92c14b88ebc4 |
Verdict: | Malicious activity |
Analysis date: | January 10, 2025, 19:26:38 |
OS: | Windows 10 Professional (build: 19045, 64 bit) |
Tags: | |
Indicators: | |
MIME: | application/x-rar |
File info: | RAR archive data, v5 |
MD5: | B92B894CE4368F90FBB8ECAB45BB2F49 |
SHA1: | 2B9CBDA7F00F3BFB415F61494D0830D1B72ACE54 |
SHA256: | 4E2AF3A5C2640CBFC8C98B04FBFB08E4F35C357AD1667BB59CFB77FBAD4D93D2 |
SSDEEP: | 196608:RjRMQI3+FORKJwzuG/Cyjfy45/AqqQL99:RjyQgCORtH6yW/qqi99 |
.rar | | | RAR compressed archive (v5.0) (61.5) |
---|---|---|
.rar | | | RAR compressed archive (gen) (38.4) |
FileVersion: | RAR v5 |
---|
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
6328 | "C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\test.rar | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 1 Version: 5.91.0 Modules
| |||||||||||||||
6828 | "C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Desktop\test.rar" C:\Users\admin\Desktop\ | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
4444 | C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding | C:\Windows\System32\rundll32.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
3188 | "C:\Users\admin\Desktop\test\x.exe" | C:\Users\admin\Desktop\test\x.exe | — | explorer.exe | |||||||||||
User: admin Company: diakov.net Integrity Level: MEDIUM Description: FontExpert 2020 17.0 Release 1 Exit code: 3221226540 Version: 2020.17.0.1 Modules
| |||||||||||||||
4740 | "C:\Users\admin\Desktop\test\x.exe" | C:\Users\admin\Desktop\test\x.exe | explorer.exe | ||||||||||||
User: admin Company: diakov.net Integrity Level: HIGH Description: FontExpert 2020 17.0 Release 1 Exit code: 0 Version: 2020.17.0.1 Modules
| |||||||||||||||
2672 | C:\Users\admin\AppData\Local\Temp\temp\packeg.exe -gm2 -y -pdiakov1 | C:\Users\admin\AppData\Local\Temp\temp\packeg.exe | x.exe | ||||||||||||
User: admin Company: Igor Pavlov Integrity Level: HIGH Description: 7z SFX Exit code: 0 Version: 19.00 Modules
| |||||||||||||||
6552 | C:\Users\admin\AppData\Local\Temp\temp\install.exe /S | C:\Users\admin\AppData\Local\Temp\temp\install.exe | x.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
6244 | C:\Users\admin\AppData\Local\Temp\hi\install.exe | C:\Users\admin\AppData\Local\Temp\hi\install.exe | install.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
3092 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://diakov.net/ | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | x.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft Edge Exit code: 1 Version: 122.0.2365.59 Modules
| |||||||||||||||
6684 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.59 --initial-client-data=0x310,0x314,0x318,0x308,0x320,0x7ff820fa5fd8,0x7ff820fa5fe4,0x7ff820fa5ff0 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft Edge Exit code: 0 Version: 122.0.2365.59 Modules
|
(PID) Process: | (4488) explorer.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000702CA |
Operation: | write | Name: | VirtualDesktop |
Value: 1000000030304456A48A294F7A40804AB924005FF030B61F | |||
(PID) Process: | (4488) explorer.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000702CA |
Operation: | delete key | Name: | (default) |
Value: | |||
(PID) Process: | (6328) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | name |
Value: 120 | |||
(PID) Process: | (6328) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | size |
Value: 80 | |||
(PID) Process: | (6328) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | type |
Value: 120 | |||
(PID) Process: | (6328) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | mtime |
Value: 100 | |||
(PID) Process: | (6328) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\General\Toolbar\Layout |
Operation: | write | Name: | Band76_0 |
Value: 4C000000730100000402000000000000F0F0F00000000000000000000000000000000000000000005003050000000000000000003B000000B402000000000000000000000000000001000000 | |||
(PID) Process: | (6328) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\General\Toolbar\Layout |
Operation: | write | Name: | Band76_1 |
Value: 4C000000730100000500000000000000F0F0F0000000000000000000000000000000000000000000580305000000000000000000180000002A00000000000000000000000000000002000000 | |||
(PID) Process: | (6328) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\General\Toolbar\Layout |
Operation: | write | Name: | Band76_2 |
Value: 4C000000730100000400000000000000F0F0F00000000000000000000000000000000000000000005A0305000000000000000000180000006400000000000000000000000000000003000000 | |||
(PID) Process: | (4488) explorer.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rar\OpenWithProgids |
Operation: | write | Name: | WinRAR |
Value: |
PID | Process | Filename | Type | |
---|---|---|---|---|
4488 | explorer.exe | C:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\$RSJOTDS.rar | — | |
MD5:— | SHA256:— | |||
4740 | x.exe | C:\Users\admin\AppData\Local\Temp\nsbFFE1.tmp\Aero.dll | executable | |
MD5:243BF44688B131C3171F2827A93E39DC | SHA256:04A577DF50431EB0FF6FB103566402BF66C50415BCC1F8A86B9C235053131455 | |||
4488 | explorer.exe | C:\Users\admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat | binary | |
MD5:E49C56350AEDF784BFE00E444B879672 | SHA256:A8BD235303668981563DFB5AAE338CB802817C4060E2C199B7C84901D57B7E1E | |||
4740 | x.exe | C:\Users\admin\Desktop\FontExpert\App\FontExpert\FontExpertAdminPS.dll | executable | |
MD5:5793EF283A67A919EB5E290796558787 | SHA256:C3A595104C6527C38CC2DA0827CDC6C366F61CBC44D10EEF1E8CC3FC9A159BBD | |||
4740 | x.exe | C:\Users\admin\AppData\Local\Temp\nsbFFE1.tmp\nsis-r.bmp | image | |
MD5:E0F6D1919734B498325CE459C8F6994D | SHA256:3C6E4748F25607AF12306691D3ED7CC241A50EE575F5B98E9352C3EBF7F0D8BE | |||
4740 | x.exe | C:\Users\admin\AppData\Local\Temp\nsbFFE1.tmp\modern-header.bmp | image | |
MD5:33DE9450BB7F062AEF70A6C16E50F277 | SHA256:BABB250788BC1A2AC09A71CBBADAC5AEE4A43E157D152F97F6E1DA98B38FA276 | |||
4740 | x.exe | C:\Users\admin\AppData\Local\Temp\nsbFFE1.tmp\orange-r.bmp | image | |
MD5:ABBE5E29999E90A0AF8D6CE254BC80D8 | SHA256:B64ED6879818F46B21BF79830AF94217EA77EF50ADE837EC0BAC06429D237336 | |||
4740 | x.exe | C:\Users\admin\Desktop\FontExpert\App\FontExpert\FontExpert.chm | binary | |
MD5:A58D9DEA0341C48343F3B06151A6C191 | SHA256:2D10AAC66EE5E48C2357D9FC19F83E1E94BE46E4E920D88F43FD4340E225F430 | |||
4740 | x.exe | C:\Users\admin\Desktop\FontExpert\App\FontExpert\FontExpertAdmin.dll | executable | |
MD5:89128B8EC72DE33A0C0B4144D7E4ADD3 | SHA256:44593A93E31684784385AF759166C299EB0FA508EF45C60A4C5693FAB837E30A | |||
6828 | WinRAR.exe | C:\Users\admin\Desktop\test\x.exe | executable | |
MD5:704D1C1A102E90CFF1DBF6E2A78643E6 | SHA256:611DC519D9B9437AA66E459779D33559B62C4BA7FB2A4CB227EA58272A41F550 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
4488 | explorer.exe | GET | 200 | 172.64.149.23:80 | http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D | unknown | — | — | whitelisted |
1520 | svchost.exe | HEAD | 200 | 199.232.210.172:80 | http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0c269ced-c74b-4e70-9b58-6e7999b292c0?P1=1736877583&P2=404&P3=2&P4=in9ILH6w4%2fBM4ukWnYC81p65vNTls4rMv4D%2bk2pcBiOrMtiRj1uw0DCa7vmliBwnECrzLZDz3hKG2Z7VQgCqGA%3d%3d | unknown | — | — | whitelisted |
5064 | SearchApp.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
1176 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
4488 | explorer.exe | GET | 200 | 172.64.149.23:80 | http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D | unknown | — | — | whitelisted |
4500 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
— | — | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
4488 | explorer.exe | GET | 404 | 172.64.149.23:80 | http://crl.usertrust.com/AddTrustExternalCARoot.crl | unknown | — | — | whitelisted |
7136 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
4488 | explorer.exe | GET | 200 | 104.18.38.233:80 | http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEC58h8wOk0pS%2FpT9HLfNNK8%3D | unknown | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4712 | MoUsoCoreWorker.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6068 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5064 | SearchApp.exe | 2.23.227.215:443 | www.bing.com | Ooredoo Q.S.C. | QA | whitelisted |
5064 | SearchApp.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
— | — | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 2.16.241.19:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
— | — | 184.30.21.171:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
1176 | svchost.exe | 20.190.160.20:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
Domain | IP | Reputation |
---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
www.bing.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
login.live.com |
| whitelisted |
go.microsoft.com |
| whitelisted |
arc.msn.com |
| whitelisted |
fd.api.iris.microsoft.com |
| whitelisted |