File name: | sample_79.zip |
Full analysis: | https://app.any.run/tasks/bf067706-510c-440d-84d2-111a1af73ae0 |
Verdict: | Malicious activity |
Analysis date: | June 12, 2019, 09:56:20 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | E1CDDDFEE642CCBB4E5056C25B5E873C |
SHA1: | 94246D6989D1C2C269489AACF730C6A68F0C5AD9 |
SHA256: | 537008470A30DD496127B478B07E3FBDEE179825B338395BC792908584F5D39B |
SSDEEP: | 12288:LntECo12yiQBNEQnpY2szmNhS1A81P4+I4YEUBePRfCC15OV69:uF1eQBOQnpbszQcAV+KEOelT15OE |
.zip | | | ZIP compressed archive (100) |
---|
ZipFileName: | sample_79/ |
---|---|
ZipUncompressedSize: | - |
ZipCompressedSize: | - |
ZipCRC: | 0x00000000 |
ZipModifyDate: | 2018:05:01 18:48:23 |
ZipCompression: | None |
ZipBitFlag: | - |
ZipRequiredVersion: | 20 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2824 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\sample_79.zip" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 | ||||
2672 | "C:\Users\admin\Desktop\sample_79\sample_79.exe" | C:\Users\admin\Desktop\sample_79\sample_79.exe | — | explorer.exe |
User: admin Integrity Level: MEDIUM Exit code: 0 Version: 3, 3, 8, 1 | ||||
2504 | "C:\Users\admin\Desktop\sample_79\sample_79.exe" | C:\Users\admin\Desktop\sample_79\sample_79.exe | sample_79.exe | |
User: admin Integrity Level: MEDIUM Exit code: 0 Version: 3, 3, 8, 1 | ||||
252 | C:\Windows\Explorer.EXE | C:\Windows\explorer.exe | ctfmon.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3504 | "C:\Program Files\Internet Explorer\iexplore.exe" | C:\Program Files\Internet Explorer\iexplore.exe | — | sample_79.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) |
(PID) Process: | (2824) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtBMP |
Value: | |||
(PID) Process: | (2824) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtIcon |
Value: | |||
(PID) Process: | (2824) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (252) explorer.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.zip\OpenWithList |
Operation: | write | Name: | a |
Value: WinRAR.exe | |||
(PID) Process: | (2824) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\sample_79.zip | |||
(PID) Process: | (2824) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | name |
Value: 120 | |||
(PID) Process: | (2824) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | size |
Value: 80 | |||
(PID) Process: | (2824) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | type |
Value: 120 | |||
(PID) Process: | (2824) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | mtime |
Value: 100 | |||
(PID) Process: | (252) explorer.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.zip\OpenWithList |
Operation: | write | Name: | MRUList |
Value: a |
PID | Process | Filename | Type | |
---|---|---|---|---|
3504 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\XxX.xXx | text | |
MD5:637F73266374A82478975E58E094B207 | SHA256:3BE6FF0C9411F1F373AC673B39ED11603B7BC27CDE932A5D3B632C24F018DB38 | |||
3504 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\UuU.uUu | text | |
MD5:637F73266374A82478975E58E094B207 | SHA256:3BE6FF0C9411F1F373AC673B39ED11603B7BC27CDE932A5D3B632C24F018DB38 | |||
2504 | sample_79.exe | C:\Users\admin\AppData\Local\Temp\XX--XX--XX.txt | binary | |
MD5:2D0CC6429A6EBD14E473D02B8BB8CFC1 | SHA256:69E7F4C07AC232F0C0DB6D95919E97680430CB2DA1A30D8A6A445E5C049AA5EE | |||
252 | explorer.exe | C:\Users\admin\Desktop\sample_79\sample_79.exe | executable | |
MD5:94C6CAAA60F2CF7EF94738C4D2A42603 | SHA256:12FF08802C6B7656F54FD73E9D6312F818BB4A34D459C3A87BAE53E5B40E2BE6 | |||
2824 | WinRAR.exe | C:\Users\admin\Desktop\sample_79\sample_79 | executable | |
MD5:94C6CAAA60F2CF7EF94738C4D2A42603 | SHA256:12FF08802C6B7656F54FD73E9D6312F818BB4A34D459C3A87BAE53E5B40E2BE6 | |||
3504 | iexplore.exe | C:\Users\admin\AppData\Roaming\logs.dat | text | |
MD5:4362E21AF8686F5EBBA224768D292A5B | SHA256:B1B2CC9A6BF77F9E56955ACBBCE253C70FC25B92D1E150D9928B9183B19B93B3 | |||
2504 | sample_79.exe | C:\dir\install\install\adobepdf.exe | executable | |
MD5:94C6CAAA60F2CF7EF94738C4D2A42603 | SHA256:12FF08802C6B7656F54FD73E9D6312F818BB4A34D459C3A87BAE53E5B40E2BE6 |
Domain | IP | Reputation |
---|---|---|
www.radioflogmix.com |
| unknown |
rpcodec.no-ip.info |
| unknown |
PID | Process | Class | Message |
---|---|---|---|
— | — | Potentially Bad Traffic | ET INFO DYNAMIC_DNS Query to a Suspicious no-ip Domain |