File name: | setup.exe.7z |
Full analysis: | https://app.any.run/tasks/db069a00-b9ea-4c51-9fe1-da4479aaf452 |
Verdict: | Malicious activity |
Analysis date: | August 12, 2022, 14:01:46 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-7z-compressed |
File info: | 7-zip archive data, version 0.4 |
MD5: | EFE59ABA376549A39223B2E6F48EAF92 |
SHA1: | 61009ACCF810A6AC50EB98F271D90539CAEC4D5E |
SHA256: | 629A2C38D6FD0C5598FEE94BA3BE36DB2A1F5C6A519D9FC3392B66F08E171025 |
SSDEEP: | 384:lk+spo2rEtpNnBUsbl7eJDfw3Kv0VS4aUttk/ijCSAIZfc1L9V6k+B5UjPG:vtpNn2sb8dw3MqS4zxjnZfc3loUa |
.7z | | | 7-Zip compressed archive (v0.4) (57.1) |
---|---|---|
.7z | | | 7-Zip compressed archive (gen) (42.8) |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3596 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\setup.exe.7z" | C:\Program Files\WinRAR\WinRAR.exe | Explorer.EXE | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.91.0 | ||||
2260 | "C:\Users\admin\AppData\Local\Temp\Rar$EXb3596.9512\setup.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXb3596.9512\setup.exe | WinRAR.exe | |
User: admin Integrity Level: MEDIUM Description: EasyScreen Exit code: 0 Version: 1.0.0.0 | ||||
3804 | "C:\Windows\SYSTEM32\WISPTIS.EXE" /ManualLaunch; | C:\Windows\SYSTEM32\WISPTIS.EXE | — | setup.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Pen and Touch Input Component Exit code: 3221226540 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3380 | "C:\Windows\SYSTEM32\WISPTIS.EXE" /ManualLaunch; | C:\Windows\SYSTEM32\WISPTIS.EXE | setup.exe | |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft Pen and Touch Input Component Exit code: 24 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3768 | "C:\Users\admin\AppData\Local\MyEss\MyEss.exe" | C:\Users\admin\AppData\Local\MyEss\MyEss.exe | setup.exe | |
User: admin Integrity Level: MEDIUM Description: MyEss Version: 1.0.0.0 | ||||
688 | "C:\Users\admin\AppData\Local\EasyScreen\EasyScreen.exe" | C:\Users\admin\AppData\Local\EasyScreen\EasyScreen.exe | — | setup.exe |
User: admin Company: Zoodotnet Limited Integrity Level: MEDIUM Description: EasyScreen Exit code: 3221225547 Version: 1.0.0.0 | ||||
2556 | "C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch&plcid=0x409&o1=.NETFramework,Version=v4.6.1&processName=EasyScreen.exe&platform=0000&osver=5&isServer=0&shimver=4.0.30319.34209 | C:\Program Files\Internet Explorer\iexplore.exe | EasyScreen.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) | ||||
2240 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2556 CREDAT:267521 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) |
PID | Process | Filename | Type | |
---|---|---|---|---|
2260 | setup.exe | C:\Users\admin\AppData\Local\EasyScreen\EasyScreen.exe.config | xml | |
MD5:A84BA6BB321EED16C8B348D0F477B182 | SHA256:9E25BCC9EEFBBE88CA72F263733847E0C439ECFF41CAF3887AEFA837095CD699 | |||
2260 | setup.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\30D802E0E248FEE17AAF4A62594CC75A | binary | |
MD5:715AD524B6219B8DE8BF6021F4CC49BB | SHA256:59A3AC679EEE5BF2FA046F99BA2E335043AF1CDA36403CECB855ECADCEB5A949 | |||
2260 | setup.exe | C:\Users\admin\AppData\Local\EasyScreen\languages\be.json | binary | |
MD5:94AC4650E68026F94A415A68658FC577 | SHA256:7AC3D36EA799378E80916018718DD1D61863A054904E1B8B93D6ADB4F2689D2E | |||
2260 | setup.exe | C:\Users\admin\AppData\Local\EasyScreen\es.ico | image | |
MD5:B5C5E6C778FD714E4D18B270A1E69632 | SHA256:59E27E8D8F98A04CBC4F33934642067929451C928D305556BD1E650D5A943748 | |||
2260 | setup.exe | C:\Users\admin\AppData\Local\EasyScreen\EasyScreen.exe | executable | |
MD5:5E804B9F1914DF6C9F5A13972025836D | SHA256:44047C8584BD2CFAC26707AEC7C3EE42566B8199FBD2346B997D1B4FCB8B2B86 | |||
3596 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXb3596.9512\setup.exe | executable | |
MD5:AFBDCD376D0C053907D2F8078827580B | SHA256:11B2AF06AB77EC37274C00B16C9FE9601C6D3D2078ABF222A2046148E0FAEB96 | |||
2260 | setup.exe | C:\Users\admin\AppData\Local\EasyScreen\keymaps\ml.json | text | |
MD5:F8D6EAD512C8AB4E066D6FE1B61AD16C | SHA256:12333880709B5656FB7D96E8375CDFA34B9492B2A14B7DA8263ED55646951ACD | |||
2260 | setup.exe | C:\Users\admin\AppData\Local\EasyScreen\languages\en.json | binary | |
MD5:6E6BE4A16B578CF98EC1657507487487 | SHA256:C05E9725E09C65E65319ECAD2614726BC98552F582086D8B120B57E7397CC360 | |||
2260 | setup.exe | C:\Users\admin\AppData\Local\Temp\PFJNAGX79B.dll | executable | |
MD5:1FFA91F1258A00636300A89D21516F5E | SHA256:4F88242618CCE5C1341E1075038E9BFFE926876990938E663E0BF95736200F3E | |||
2260 | setup.exe | C:\Users\admin\AppData\Local\EasyScreen\languages\da.json | binary | |
MD5:CC87C9D43AD3E9618FAEE7AC99049204 | SHA256:F06B872C726F9A1B00C8408388D2503A239239C5BE2FE26E23816AC7604F5D40 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2556 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | US | der | 471 b | whitelisted |
2240 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D | US | der | 1.47 Kb | whitelisted |
2240 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEALnkXH7gCHpP%2BLZg4NMUMA%3D | US | der | 471 b | whitelisted |
2260 | setup.exe | GET | 200 | 91.199.212.52:80 | http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt | GB | der | 1.52 Kb | whitelisted |
2240 | iexplore.exe | GET | 200 | 8.253.204.121:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?2614554b007721c9 | US | compressed | 4.70 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2260 | setup.exe | 91.199.212.52:80 | crt.sectigo.com | Comodo CA Ltd | GB | suspicious |
2240 | iexplore.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
2240 | iexplore.exe | 96.16.143.41:443 | go.microsoft.com | Akamai International B.V. | US | whitelisted |
2260 | setup.exe | 188.166.70.149:443 | easyscreen.me | Digital Ocean, Inc. | NL | unknown |
3768 | MyEss.exe | 188.166.70.149:443 | easyscreen.me | Digital Ocean, Inc. | NL | unknown |
2240 | iexplore.exe | 8.253.204.121:80 | ctldl.windowsupdate.com | Global Crossing | US | malicious |
2556 | iexplore.exe | 20.25.53.147:443 | query.prod.cms.msn.com | — | US | unknown |
2556 | iexplore.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
2240 | iexplore.exe | 13.107.219.44:443 | dotnet.microsoft.com | Microsoft Corporation | US | suspicious |
2556 | iexplore.exe | 131.253.33.203:443 | www.msn.com | Microsoft Corporation | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
easyscreen.me |
| unknown |
crt.sectigo.com |
| whitelisted |
go.microsoft.com |
| whitelisted |
ctldl.windowsupdate.com |
| whitelisted |
api.bing.com |
| whitelisted |
www.bing.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
dotnet.microsoft.com |
| whitelisted |
dns.msftncsi.com |
| shared |
r20swj13mr.microsoft.com |
| whitelisted |