File name: | synapse X.rar |
Full analysis: | https://app.any.run/tasks/8443e1a1-2b74-49d8-8c6a-6a0d824243f4 |
Verdict: | Malicious activity |
Analysis date: | September 18, 2019, 15:48:10 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-rar |
File info: | RAR archive data, v5 |
MD5: | 6FCA5B4A7BC097ADC31FCCAC30A33B0E |
SHA1: | 8E0069E54BE8C273B971305A2BDE63BE4287DE2C |
SHA256: | 6474CCBE9FB70F4664AB6754EADB2A574012426E66B2FB91666A9BAE61712C71 |
SSDEEP: | 393216:PsC5SDznkacZI/fXB6tNxNbvvR9nj5fo4baukHCBds:PsLznXci0NxB3R9OBiB2 |
.rar | | | RAR compressed archive (v5.0) (61.5) |
---|---|---|
.rar | | | RAR compressed archive (gen) (38.4) |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3440 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\synapse X.rar" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 | ||||
2228 | "C:\Users\admin\Desktop\Synapse X.exe" | C:\Users\admin\Desktop\Synapse X.exe | explorer.exe | |
User: admin Integrity Level: MEDIUM Description: Synapse Bootstrapper Version: 1.0.0.0 | ||||
3184 | "C:\Users\admin\Desktop\Synapse X.exe" | C:\Users\admin\Desktop\Synapse X.exe | explorer.exe | |
User: admin Integrity Level: MEDIUM Description: Synapse Bootstrapper Exit code: 0 Version: 1.0.0.0 | ||||
3372 | "bin\C7FB8689DFEAC65B.bin" | C:\Users\admin\Desktop\bin\C7FB8689DFEAC65B.bin | Synapse X.exe | |
User: admin Integrity Level: MEDIUM Description: Synapse UI WPF Version: 1.0.0.0 | ||||
1676 | "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" | C:\Windows\System32\SearchProtocolHost.exe | — | SearchIndexer.exe |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft Windows Search Protocol Host Version: 7.00.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
3440 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3440.23686\bin\theme.json | text | |
MD5:C0C61B71F2D4C3296E1E4C57EF31AC83 | SHA256:951820403E841C0CBE8E00E9C5CCC68DD3EF170438D42A7B3F075D4A2AC73239 | |||
3440 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3440.23686\bin\F089D07A5CDD2A84.bin | executable | |
MD5:232D39E24BF5DA02FCC257A72456DF0F | SHA256:CE91BEE69D4EE6A23A945894D8520EBC5E03B42BE9464A3065853A8090AA8275 | |||
3440 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3440.23686\bin\4EF437B6217B677D.dll | executable | |
MD5:56E60FDFB8EB50D75AF96C094245106F | SHA256:71DB017C4FA4BD9FEFCA33DBF2AAED01E68792D99731F80EFD0678B78797378D | |||
3440 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3440.23686\bin\SynapseInjector.dll | executable | |
MD5:C0A334A3830914BA35F2DAD5B1421F1B | SHA256:6E62638DC9FE57EC3921991EC5012E587D95604215DF1FF836F4A3CBA6170D9F | |||
3440 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3440.23686\bin\Monaco.html | html | |
MD5:999896134BD43CEFA865F37E514BA62F | SHA256:1ECDD9529EF5487F92736894D94FF680F6C32EE821615D29C0FC814F3A310B4A | |||
3440 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3440.23686\bin\vs\basic-languages\css\css.js | text | |
MD5:49AD30F1151CFD7A74677FDC6DD13DA9 | SHA256:BD331FD3BD2C37B0C3150035325F163AC9266BF6D942310764815E676D856D91 | |||
3440 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3440.23686\bin\vs\basic-languages\ini\ini.js | text | |
MD5:B9252B74381FE17565D494711F4C9093 | SHA256:1F0FEEAE58C32F6E1F31B78F7E2AAB3C91DA387E464234C0F55EBFF0E77444A2 | |||
3440 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3440.23686\bin\vs\basic-languages\cpp\cpp.js | text | |
MD5:0A16509E6CD0155FB622E785CFE976C7 | SHA256:A7C2BEA7CA3D9E203A3A286735945FE010C8F4F8D46620386EE8BEFC6A78B32B | |||
3440 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3440.23686\bin\vs\basic-languages\csharp\csharp.js | text | |
MD5:F8F841D13C9220E15DCD6BC386B37BA2 | SHA256:6B3BE9A86EE8E3202F51745D94D24CC1EEFBCF7D9E6D94FBAF70146B084E835F | |||
3440 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3440.23686\bin\vs\basic-languages\fsharp\fsharp.js | text | |
MD5:DE122B3BC44A8714F386DC80282DCB12 | SHA256:1390079BABC117D3F376735780D98F409F317EB4628D17106642C6933EA1DA7F |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3184 | Synapse X.exe | 104.20.165.135:443 | synapse.to | Cloudflare Inc | US | shared |
2228 | Synapse X.exe | 104.20.166.135:443 | synapse.to | Cloudflare Inc | US | shared |
3372 | C7FB8689DFEAC65B.bin | 104.20.165.135:443 | synapse.to | Cloudflare Inc | US | shared |
3184 | Synapse X.exe | 104.20.166.135:443 | synapse.to | Cloudflare Inc | US | shared |
2228 | Synapse X.exe | 104.20.165.135:443 | synapse.to | Cloudflare Inc | US | shared |
Domain | IP | Reputation |
---|---|---|
synapse.to |
| whitelisted |
cdn.synapse.to |
| suspicious |
PID | Process | Class | Message |
---|---|---|---|
— | — | Potentially Bad Traffic | ET DNS Query for .to TLD |
— | — | Potentially Bad Traffic | ET DNS Query for .to TLD |