File name: | paint_test.zip |
Full analysis: | https://app.any.run/tasks/b5bd6c10-b079-4228-9dbf-02ad230b5b6c |
Verdict: | Malicious activity |
Analysis date: | August 13, 2019, 16:02:05 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v4.5 to extract |
MD5: | 99778D144C379C1A2BA21B81E36D87AC |
SHA1: | 2D11C6F3906D11A56AA6D4B31696DAFB18068B53 |
SHA256: | 61D12FBCC210F8A38ADA06C4E71D196EFCEBBA561BD71442B1160BB0A060B3A1 |
SSDEEP: | 6144:TqDGyYq6Cz/9j9lHkJjsiMLfYqQJis5tylB/r1+wGR7v7DRF5NhKMTHmsTu4MiHP:njpCBj9lHk/MLQFJ5tymlh3NhKMSKMY |
.zip | | | ZIP compressed archive (100) |
---|
ZipFileName: | Device/HarddiskVolume3/Windows/CSC/v2.0.6/namespace/dc2/profile/burk/Application Data/Paint.exe |
---|---|
ZipUncompressedSize: | 849920 |
ZipCompressedSize: | 382883 |
ZipCRC: | 0x351e2bc1 |
ZipModifyDate: | 1980:00:00 00:00:00 |
ZipCompression: | Deflated |
ZipBitFlag: | 0x0801 |
ZipRequiredVersion: | 20 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2740 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\paint_test.zip" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
2972 | "C:\Users\admin\AppData\Local\Temp\Rar$EXb2740.16013\Device\HarddiskVolume3\Windows\CSC\v2.0.6\namespace\dc2\profile\burk\Application Data\Paint.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXb2740.16013\Device\HarddiskVolume3\Windows\CSC\v2.0.6\namespace\dc2\profile\burk\Application Data\Paint.exe | WinRAR.exe | |
User: admin Integrity Level: MEDIUM | ||||
1596 | "C:\Windows\system32\wermgr.exe" "-outproc" "128" "3952" | C:\Windows\system32\wermgr.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Problem Reporting Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2884 | "C:\Users\admin\Desktop\Paint.exe" | C:\Users\admin\Desktop\Paint.exe | — | explorer.exe |
User: admin Integrity Level: MEDIUM Exit code: 3221226540 | ||||
2868 | "C:\Users\admin\Desktop\Paint.exe" | C:\Users\admin\Desktop\Paint.exe | explorer.exe | |
User: admin Integrity Level: HIGH Exit code: 0 | ||||
3984 | "C:\Windows\system32\wermgr.exe" "-outproc" "128" "3500" | C:\Windows\system32\wermgr.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Problem Reporting Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
536 | "C:\Users\admin\Desktop\Paint.exe" | C:\Users\admin\Desktop\Paint.exe | — | explorer.exe |
User: admin Integrity Level: MEDIUM Exit code: 3221226540 | ||||
2788 | "C:\Users\admin\Desktop\Paint.exe" | C:\Users\admin\Desktop\Paint.exe | explorer.exe | |
User: admin Integrity Level: HIGH Exit code: 0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2740 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb2740.19647\Device\HarddiskVolume3\Windows\CSC\v2.0.6\namespace\dc2\profile\burk\Application Data\Paint.exe | — | |
MD5:— | SHA256:— | |||
2868 | Paint.exe | C:\Windows\vAlcrmv.ico | — | |
MD5:— | SHA256:— | |||
2868 | Paint.exe | C:\Windows\RCX321B.tmp | — | |
MD5:— | SHA256:— | |||
2868 | Paint.exe | C:\Users\admin\AppData\Local\Temp\WRP322D.tmp | — | |
MD5:— | SHA256:— | |||
2868 | Paint.exe | C:\Users\admin\AppData\Local\Temp\WRP323F.tmp | — | |
MD5:— | SHA256:— | |||
2868 | Paint.exe | C:\Users\admin\AppData\Local\Temp\WRP3250.tmp | — | |
MD5:— | SHA256:— | |||
2868 | Paint.exe | C:\Users\admin\AppData\Local\Temp\WRP3262.tmp | — | |
MD5:— | SHA256:— | |||
2868 | Paint.exe | C:\Users\admin\AppData\Local\Temp\WRP3264.tmp | — | |
MD5:— | SHA256:— | |||
2868 | Paint.exe | C:\Users\admin\AppData\Local\Temp\WRP3275.tmp | — | |
MD5:— | SHA256:— | |||
2868 | Paint.exe | C:\Users\admin\AppData\Local\Temp\WRP3287.tmp | — | |
MD5:— | SHA256:— |
Process | Message |
---|---|
Paint.exe | FTH: (2868): *** Fault tolerant heap shim applied to current process. This is usually due to previous crashes. ***
|
Paint.exe | FTH: (2788): *** Fault tolerant heap shim applied to current process. This is usually due to previous crashes. ***
|