File name: | 3D Live Pool.exe.zip |
Full analysis: | https://app.any.run/tasks/90f61c07-97d8-4e7a-9d31-5d21fc81f17e |
Verdict: | Malicious activity |
Analysis date: | May 20, 2019, 20:17:14 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | 9A55E8B79EF89FFB5F7D796B81277B93 |
SHA1: | D4CC3772DCB14915C4249524EFC07A4D46077E05 |
SHA256: | 56419806804E331DC9A81D760C8C4CD1FA7254CA8DAA6BA77CF3DA82D5176103 |
SSDEEP: | 49152:BgTA548UC0I//TLJpeaUQYKLvTAFUNqKPWrcnEHYIan4gIuAJif0wbmGHy5P:BYA54URTLJIw7vmq4YEH7Y4/u3fdbm99 |
.zip | | | ZIP compressed archive (100) |
---|
ZipFileName: | 0468B1F79F3B2A62D10247F4A70FCC5969D2E3EE8DA3ED50701B8B2B47547FD5 |
---|---|
ZipUncompressedSize: | 2779046 |
ZipCompressedSize: | 2686530 |
ZipCRC: | 0x70927cbf |
ZipModifyDate: | 2019:05:20 20:09:20 |
ZipCompression: | Deflated |
ZipBitFlag: | 0x0009 |
ZipRequiredVersion: | 20 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3196 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\3D Live Pool.exe.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
3572 | "C:\Users\admin\Desktop\0468B1F79F3B2A62D10247F4A70FCC5969D2E3EE8DA3ED50701B8B2B47547FD5.exe" | C:\Users\admin\Desktop\0468B1F79F3B2A62D10247F4A70FCC5969D2E3EE8DA3ED50701B8B2B47547FD5.exe | — | explorer.exe |
User: admin Integrity Level: MEDIUM | ||||
4084 | "C:\Users\admin\Desktop\0468B1F79F3B2A62D10247F4A70FCC5969D2E3EE8DA3ED50701B8B2B47547FD5.exe" | C:\Users\admin\Desktop\0468B1F79F3B2A62D10247F4A70FCC5969D2E3EE8DA3ED50701B8B2B47547FD5.exe | — | explorer.exe |
User: admin Integrity Level: MEDIUM |
(PID) Process: | (3196) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtBMP |
Value: | |||
(PID) Process: | (3196) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtIcon |
Value: | |||
(PID) Process: | (3196) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (3196) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\3D Live Pool.exe.zip | |||
(PID) Process: | (3196) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | name |
Value: 120 | |||
(PID) Process: | (3196) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | size |
Value: 80 | |||
(PID) Process: | (3196) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | type |
Value: 120 | |||
(PID) Process: | (3196) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | mtime |
Value: 100 | |||
(PID) Process: | (3196) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface |
Operation: | write | Name: | ShowPassword |
Value: 0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3196 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb3196.47095\0468B1F79F3B2A62D10247F4A70FCC5969D2E3EE8DA3ED50701B8B2B47547FD5 | — | |
MD5:— | SHA256:— | |||
3572 | 0468B1F79F3B2A62D10247F4A70FCC5969D2E3EE8DA3ED50701B8B2B47547FD5.exe | C:\Users\admin\AppData\Roaming\Thinstall\3D Live Pool\Registry.rw.lck.USER-PC.ffffffffdf8 | — | |
MD5:— | SHA256:— | |||
3572 | 0468B1F79F3B2A62D10247F4A70FCC5969D2E3EE8DA3ED50701B8B2B47547FD5.exe | C:\Users\admin\AppData\Roaming\Thinstall\3D Live Pool\Registry.rw.tvr.tmp-df8df8 | — | |
MD5:— | SHA256:— | |||
3572 | 0468B1F79F3B2A62D10247F4A70FCC5969D2E3EE8DA3ED50701B8B2B47547FD5.exe | C:\Users\admin\Desktop\%x | — | |
MD5:— | SHA256:— | |||
3572 | 0468B1F79F3B2A62D10247F4A70FCC5969D2E3EE8DA3ED50701B8B2B47547FD5.exe | C:\Users\admin\AppData\Roaming\Thinstall\3D Live Pool\Registry.rw.tvr | binary | |
MD5:E7F78EA001BE0718E425057678E27DB1 | SHA256:91E7EE233BA428CAD43674F848B99BC9AF0F1971F51F20514509FC537A84C845 | |||
3572 | 0468B1F79F3B2A62D10247F4A70FCC5969D2E3EE8DA3ED50701B8B2B47547FD5.exe | C:\Users\admin\AppData\Roaming\Thinstall\3D Live Pool\Registry.tvr.backup | binary | |
MD5:21AAF3AA4F82B19FBF176B0D8D1CE59B | SHA256:C47A8C1694924599BFA188A83D43F316B21FD756F2F553DAAABDD167084F009D | |||
3572 | 0468B1F79F3B2A62D10247F4A70FCC5969D2E3EE8DA3ED50701B8B2B47547FD5.exe | C:\Users\admin\AppData\Roaming\Thinstall\3D Live Pool\Registry.rw.lck | binary | |
MD5:91CEA192F65D9ECE27A20A7E06475304 | SHA256:A024913F8A254D6D6265013976B914476C33A4D099D3073BB358EF6EB63016F4 |