File name: | loas-crystal-h-208912983.zip |
Full analysis: | https://app.any.run/tasks/a46dfb25-08b5-401e-b51a-5e010f2485c7 |
Verdict: | Malicious activity |
Analysis date: | November 30, 2020, 06:08:52 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | 400DAAEB60473307ACA47D65A7515D91 |
SHA1: | B566AE9062D659C1A29A656D04C857F0E04123EB |
SHA256: | 57B0E949DA44E7A74753E66A1A65A51C9FA061BE919C4CDFA9499A8A8EEA4A3B |
SSDEEP: | 393216:ZSREC0bltFJP7pLNmkNu+5ujrg1pWRaUWEJYrSJq6ict:Yv0xtFxzu+5K29UtOqq6X |
.zip | | | ZIP compressed archive (100) |
---|
ZipFileName: | CaretVisible.exe |
---|---|
ZipUncompressedSize: | 3000008 |
ZipCompressedSize: | 2916667 |
ZipCRC: | 0x09f882c6 |
ZipModifyDate: | 2020:10:21 21:24:14 |
ZipCompression: | Deflated |
ZipBitFlag: | - |
ZipRequiredVersion: | 20 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3032 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\loas-crystal-h-208912983.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
3668 | "C:\Users\admin\Desktop\CaretVisible.exe" | C:\Users\admin\Desktop\CaretVisible.exe | explorer.exe | |
User: admin Company: VSO-Software SARL Integrity Level: MEDIUM Description: VSO Inspector Setup Version: | ||||
1980 | "C:\Users\admin\AppData\Local\Temp\is-BMMQC.tmp\CaretVisible.tmp" /SL5="$3017C,2571070,140800,C:\Users\admin\Desktop\CaretVisible.exe" | C:\Users\admin\AppData\Local\Temp\is-BMMQC.tmp\CaretVisible.tmp | — | CaretVisible.exe |
User: admin Integrity Level: MEDIUM Description: Setup/Uninstall Version: 51.1052.0.0 | ||||
3672 | "C:\Users\admin\Desktop\CaretVisible.exe" /SPAWNWND=$20172 /NOTIFYWND=$3017C | C:\Users\admin\Desktop\CaretVisible.exe | CaretVisible.tmp | |
User: admin Company: VSO-Software SARL Integrity Level: HIGH Description: VSO Inspector Setup Version: | ||||
3232 | "C:\Users\admin\AppData\Local\Temp\is-EN3J5.tmp\CaretVisible.tmp" /SL5="$30170,2571070,140800,C:\Users\admin\Desktop\CaretVisible.exe" /SPAWNWND=$20172 /NOTIFYWND=$3017C | C:\Users\admin\AppData\Local\Temp\is-EN3J5.tmp\CaretVisible.tmp | CaretVisible.exe | |
User: admin Integrity Level: HIGH Description: Setup/Uninstall Version: 51.1052.0.0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3032 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3032.41171\CaretVisible.exe | — | |
MD5:— | SHA256:— | |||
3032 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3032.41171\loas-crystal-h-208912983.exe | — | |
MD5:— | SHA256:— | |||
3232 | CaretVisible.tmp | C:\Users\admin\AppData\Local\Temp\is-FN7RD.tmp\_isetup\_shfoldr.dll | executable | |
MD5:92DC6EF532FBB4A5C3201469A5B5EB63 | SHA256:9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87 | |||
3672 | CaretVisible.exe | C:\Users\admin\AppData\Local\Temp\is-EN3J5.tmp\CaretVisible.tmp | executable | |
MD5:8FD32D871DFD28C4519CD9C96A120026 | SHA256:0C340A0C550CDE8D73F7B109416FAF9A1243C5BEBCC5477123CB97028BA01088 | |||
3668 | CaretVisible.exe | C:\Users\admin\AppData\Local\Temp\is-BMMQC.tmp\CaretVisible.tmp | executable | |
MD5:8FD32D871DFD28C4519CD9C96A120026 | SHA256:0C340A0C550CDE8D73F7B109416FAF9A1243C5BEBCC5477123CB97028BA01088 |