File name: | synapse X.rar |
Full analysis: | https://app.any.run/tasks/dcb4e85e-41fb-47de-862b-072e094f4678 |
Verdict: | Malicious activity |
Analysis date: | September 18, 2019, 15:50:39 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-rar |
File info: | RAR archive data, v5 |
MD5: | 6FCA5B4A7BC097ADC31FCCAC30A33B0E |
SHA1: | 8E0069E54BE8C273B971305A2BDE63BE4287DE2C |
SHA256: | 6474CCBE9FB70F4664AB6754EADB2A574012426E66B2FB91666A9BAE61712C71 |
SSDEEP: | 393216:PsC5SDznkacZI/fXB6tNxNbvvR9nj5fo4baukHCBds:PsLznXci0NxB3R9OBiB2 |
.rar | | | RAR compressed archive (v5.0) (61.5) |
---|---|---|
.rar | | | RAR compressed archive (gen) (38.4) |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3852 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\synapse X.rar" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 | ||||
2448 | "C:\Users\admin\Desktop\Synapse X.exe" | C:\Users\admin\Desktop\Synapse X.exe | explorer.exe | |
User: admin Integrity Level: MEDIUM Description: Synapse Bootstrapper Exit code: 0 Version: 1.0.0.0 | ||||
3320 | "C:\Users\admin\Desktop\Synapse X.exe" | C:\Users\admin\Desktop\Synapse X.exe | explorer.exe | |
User: admin Integrity Level: MEDIUM Description: Synapse Bootstrapper Exit code: 0 Version: 1.0.0.0 | ||||
3716 | "bin\C7FB8689DFEAC65B.bin" | C:\Users\admin\Desktop\bin\C7FB8689DFEAC65B.bin | Synapse X.exe | |
User: admin Integrity Level: MEDIUM Description: Synapse UI WPF Version: 1.0.0.0 | ||||
3804 | "bin\C7FB8689DFEAC65B.bin" | C:\Users\admin\Desktop\bin\C7FB8689DFEAC65B.bin | — | Synapse X.exe |
User: admin Integrity Level: MEDIUM Description: Synapse UI WPF Exit code: 4294967295 Version: 1.0.0.0 | ||||
1000 | "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" | C:\Windows\System32\SearchProtocolHost.exe | — | SearchIndexer.exe |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft Windows Search Protocol Host Version: 7.00.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
3852 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3852.37009\bin\4EF437B6217B677D.dll | executable | |
MD5:56E60FDFB8EB50D75AF96C094245106F | SHA256:71DB017C4FA4BD9FEFCA33DBF2AAED01E68792D99731F80EFD0678B78797378D | |||
3852 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3852.37009\bin\theme.json | text | |
MD5:C0C61B71F2D4C3296E1E4C57EF31AC83 | SHA256:951820403E841C0CBE8E00E9C5CCC68DD3EF170438D42A7B3F075D4A2AC73239 | |||
3852 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3852.37009\bin\F089D07A5CDD2A84.bin | executable | |
MD5:232D39E24BF5DA02FCC257A72456DF0F | SHA256:CE91BEE69D4EE6A23A945894D8520EBC5E03B42BE9464A3065853A8090AA8275 | |||
3852 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3852.37009\bin\SynapseInjector.dll | executable | |
MD5:C0A334A3830914BA35F2DAD5B1421F1B | SHA256:6E62638DC9FE57EC3921991EC5012E587D95604215DF1FF836F4A3CBA6170D9F | |||
3852 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3852.37009\bin\vs\basic-languages\dockerfile\dockerfile.js | text | |
MD5:E32DE981BDAF75E6FFB8FE40BC955A68 | SHA256:65B86FC54E9B35D6CB84F01DFB905680DBCAD6605757DE1D6BCA84E3029889AF | |||
3852 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3852.37009\bin\Monaco.html | html | |
MD5:999896134BD43CEFA865F37E514BA62F | SHA256:1ECDD9529EF5487F92736894D94FF680F6C32EE821615D29C0FC814F3A310B4A | |||
3852 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3852.37009\bin\vs\basic-languages\csp\csp.js | text | |
MD5:22ADA25D590811DCFF4E5F5D698E583B | SHA256:4B5A5D7D50986B86B00833447E097C0F01A4388CE1765B48E7E371D06E3A4789 | |||
3852 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3852.37009\bin\vs\basic-languages\bat\bat.js | text | |
MD5:4CB475399C4490EEA41982DCD6D9653E | SHA256:9BCA42394FE8922FEC24B768EEB8CE04692DE6FAD82F9052D5B7E70F5C6B0F40 | |||
3852 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3852.37009\bin\vs\basic-languages\ini\ini.js | text | |
MD5:B9252B74381FE17565D494711F4C9093 | SHA256:1F0FEEAE58C32F6E1F31B78F7E2AAB3C91DA387E464234C0F55EBFF0E77444A2 | |||
3852 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3852.37009\bin\vs\basic-languages\handlebars\handlebars.js | text | |
MD5:3CA7CF83292B56444548F2914C0E1811 | SHA256:31D25588D120E7C79F3332FF3B3C794CEBD0554C7578E3BB37B3CAC366E4F6C2 |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2448 | Synapse X.exe | 104.20.166.135:443 | synapse.to | Cloudflare Inc | US | shared |
2448 | Synapse X.exe | 104.20.165.135:443 | synapse.to | Cloudflare Inc | US | shared |
3320 | Synapse X.exe | 104.20.166.135:443 | synapse.to | Cloudflare Inc | US | shared |
3716 | C7FB8689DFEAC65B.bin | 104.20.166.135:443 | synapse.to | Cloudflare Inc | US | shared |
Domain | IP | Reputation |
---|---|---|
synapse.to |
| whitelisted |
cdn.synapse.to |
| suspicious |
PID | Process | Class | Message |
---|---|---|---|
— | — | Potentially Bad Traffic | ET DNS Query for .to TLD |
— | — | Potentially Bad Traffic | ET DNS Query for .to TLD |