File name: | AINTB2768_2022-08-12_17_59_10.zip |
Full analysis: | https://app.any.run/tasks/1c4739dc-3cd6-4473-a543-bd229092c6d3 |
Verdict: | Malicious activity |
Analysis date: | August 12, 2022, 14:59:45 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v4.5 to extract |
MD5: | D825582B6CE6A64489D1921554E9F70F |
SHA1: | F86E45D52A769C49F8E772130BD098D9556D736A |
SHA256: | 61B6A2A5D7D9C7B9D797C10433633E9A45E1F9DC726C7E33B5616C24FDCBBF3B |
SSDEEP: | 24576:S+4wz7ghW03QaTkmwNcM9hte9nsLPWuXobHuk:lcwaTIaQ7epkWuYZ |
.zip | | | ZIP compressed archive (100) |
---|
ZipFileName: | Device/HarddiskVolume9/2022 Y DEVAMI/LIO D/SINAN/900EEF2080/APP/DelayToRun/DelayRun.Exe |
---|---|
ZipUncompressedSize: | 809923 |
ZipCompressedSize: | 790131 |
ZipCRC: | 0x2f9da9fe |
ZipModifyDate: | 1980:00:00 00:00:00 |
ZipCompression: | Deflated |
ZipBitFlag: | 0x0801 |
ZipRequiredVersion: | 20 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
1420 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\AINTB2768_2022-08-12_17_59_10.zip" | C:\Program Files\WinRAR\WinRAR.exe | Explorer.EXE | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 | ||||
188 | "C:\Users\admin\AppData\Local\Temp\Rar$EXb1420.9026\Device\HarddiskVolume9\2022 Y DEVAMI\LIO D\SINAN\900EEF2080\APP\DelayToRun\DelayRun.Exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXb1420.9026\Device\HarddiskVolume9\2022 Y DEVAMI\LIO D\SINAN\900EEF2080\APP\DelayToRun\DelayRun.Exe | — | WinRAR.exe |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
2848 | "C:\Users\admin\Desktop\DelayRun.Exe" | C:\Users\admin\Desktop\DelayRun.Exe | — | Explorer.EXE |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
1064 | "C:\Users\admin\Desktop\DelayRun.Exe" | C:\Users\admin\Desktop\DelayRun.Exe | — | Explorer.EXE |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
3000 | "C:\Users\admin\Desktop\DelayRun.Exe" | C:\Users\admin\Desktop\DelayRun.Exe | — | Explorer.EXE |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
3524 | "C:\Users\admin\Desktop\DelayRun.Exe" | C:\Users\admin\Desktop\DelayRun.Exe | — | Explorer.EXE |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
3564 | "C:\Users\admin\Desktop\DelayRun.Exe" | C:\Users\admin\Desktop\DelayRun.Exe | — | Explorer.EXE |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
1736 | "C:\Users\admin\Desktop\DelayRun.Exe" | C:\Users\admin\Desktop\DelayRun.Exe | — | Explorer.EXE |
User: admin Integrity Level: MEDIUM Exit code: 0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
1420 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXb1420.9026\manifest.json | ini | |
MD5:474B5F90F83BA27833FC875FF8C1E418 | SHA256:1CA61A5104D02A368627AA7BD7DBD6158CE440C272BB727000016876BB82C8F1 | |||
1420 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXb1420.9026\Device\HarddiskVolume9\2022 Y DEVAMI\LIO D\SINAN\900EEF2080\APP\DelayToRun\DelayRun.Exe | executable | |
MD5:6D5A82047433689FB4B12078C61B9F02 | SHA256:33C88578E4FB71BC79180F30F4A8059C70687B19EB1AFE0EDB60708A44F62381 | |||
1420 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb1420.10995\Device\HarddiskVolume9\2022 Y DEVAMI\LIO D\SINAN\900EEF2080\APP\DelayToRun\DelayRun.Exe | executable | |
MD5:6D5A82047433689FB4B12078C61B9F02 | SHA256:33C88578E4FB71BC79180F30F4A8059C70687B19EB1AFE0EDB60708A44F62381 |