| File name: | BATDSK0315_2024-02-05_14_24_14.513.zip |
| Full analysis: | https://app.any.run/tasks/02705b55-d3d2-4dd9-8337-81b84ebef665 |
| Verdict: | Malicious activity |
| Analysis date: | February 05, 2024, 14:24:47 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v4.5 to extract |
| MD5: | C9CD8E9D387792DF06DC70696F1C966B |
| SHA1: | E1137E83415ECDDA2A852CBC6C097609C8428953 |
| SHA256: | 66B7A9D3F367182183F35FA6EF29D9DC046FE3F0066D0710D0A4DC69FC9E01C3 |
| SSDEEP: | 12288:Annqozen0D4DLAUo8oRtZhEx1eAXdmS7rQ6RnK:AnnLhD4D0Uo8OtZhEiAXASo6xK |
MALICIOUS
Drops the executable file immediately after the start
- xf-adsk2015_x64.exe (PID: 3096)
- csc.exe (PID: 3268)
- csc.exe (PID: 2952)
- csc.exe (PID: 2996)
Starts Visual C# compiler
- sdiagnhost.exe (PID: 2500)
SUSPICIOUS
Executable content was dropped or overwritten
- xf-adsk2015_x64.exe (PID: 3096)
- csc.exe (PID: 2952)
- csc.exe (PID: 2996)
- csc.exe (PID: 3268)
Probably uses Microsoft diagnostics tool to execute malicious payload
- pcwrun.exe (PID: 4020)
Process drops legitimate windows executable
- msdt.exe (PID: 4016)
Reads settings of System Certificates
- msdt.exe (PID: 4016)
Reads the Internet Settings
- sdiagnhost.exe (PID: 2500)
- msdt.exe (PID: 4016)
Uses .NET C# to load dll
- sdiagnhost.exe (PID: 2500)
Uses RUNDLL32.EXE to load library
- msdt.exe (PID: 4016)
INFO
Manual execution by a user
- WinRAR.exe (PID: 584)
- pcwrun.exe (PID: 4020)
- xf-adsk2015_x64.exe (PID: 3096)
Checks supported languages
- xf-adsk2015_x64.exe (PID: 3096)
- csc.exe (PID: 3268)
- cvtres.exe (PID: 3368)
- csc.exe (PID: 2952)
- cvtres.exe (PID: 2924)
- cvtres.exe (PID: 3204)
- csc.exe (PID: 2996)
Drops the executable file immediately after the start
- WinRAR.exe (PID: 584)
- msdt.exe (PID: 4016)
Executable content was dropped or overwritten
- WinRAR.exe (PID: 584)
Reads the machine GUID from the registry
- xf-adsk2015_x64.exe (PID: 3096)
- csc.exe (PID: 3268)
- cvtres.exe (PID: 3368)
- csc.exe (PID: 2952)
- cvtres.exe (PID: 3204)
- csc.exe (PID: 2996)
- cvtres.exe (PID: 2924)
Reads the computer name
- xf-adsk2015_x64.exe (PID: 3096)
Create files in a temporary directory
- pcwrun.exe (PID: 4020)
- msdt.exe (PID: 4016)
- sdiagnhost.exe (PID: 2500)
- csc.exe (PID: 3268)
- csc.exe (PID: 2952)
- cvtres.exe (PID: 2924)
- cvtres.exe (PID: 3204)
- csc.exe (PID: 2996)
- cvtres.exe (PID: 3368)
Reads security settings of Internet Explorer
- msdt.exe (PID: 4016)
- sdiagnhost.exe (PID: 2500)
Creates files or folders in the user directory
- msdt.exe (PID: 4016)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .zip | | | ZIP compressed archive (100) |
|---|
EXIF
ZIP
| ZipRequiredVersion: | 20 |
|---|---|
| ZipBitFlag: | 0x0801 |
| ZipCompression: | Deflated |
| ZipModifyDate: | 1980:00:00 00:00:00 |
| ZipCRC: | 0xd383f2e0 |
| ZipCompressedSize: | 326793 |
| ZipUncompressedSize: | 326731 |
| ZipFileName: | Device/HarddiskVolume6/Logiciels/REVIT 2015/rvt 2015/xf-adsk2015_x64_activation autodesk 2015.7z |
Total processes
57
Monitored processes
14
Malicious processes
3
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 584 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\xf-adsk2015_x64_activation autodesk 2015.7z" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
| 1652 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\BATDSK0315_2024-02-05_14_24_14.513.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
| 2472 | "C:\Windows\System32\rundll32.exe" C:\Windows\system32\pcwutl.dll,CreateAndRunTask -path "C:\Users\admin\Desktop\adesk_patcher64.exe" | C:\Windows\System32\rundll32.exe | — | msdt.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2500 | C:\Windows\System32\sdiagnhost.exe -Embedding | C:\Windows\System32\sdiagnhost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Scripted Diagnostics Native Host Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2924 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RESBEDC.tmp" "c:\Users\admin\AppData\Local\Temp\CSCBEDB.tmp" | C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe | — | csc.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft® Resource File To COFF Object Conversion Utility Exit code: 0 Version: 8.00.50727.5003 (Win7SP1GDR.050727-5400) Modules
| |||||||||||||||
| 2952 | "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\gzpp4a0u.cmdline" | C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe | sdiagnhost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Visual C# Command Line Compiler Exit code: 0 Version: 8.0.50727.5483 (Win7SP1GDR.050727-5400) Modules
| |||||||||||||||
| 2996 | "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\1rmntahv.cmdline" | C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe | sdiagnhost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Visual C# Command Line Compiler Exit code: 0 Version: 8.0.50727.5483 (Win7SP1GDR.050727-5400) Modules
| |||||||||||||||
| 3096 | "C:\Users\admin\Desktop\xf-adsk2015_x64.exe" | C:\Users\admin\Desktop\xf-adsk2015_x64.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 3221225547 Modules
| |||||||||||||||
| 3204 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RESBF98.tmp" "c:\Users\admin\AppData\Local\Temp\CSCBF87.tmp" | C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe | — | csc.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft® Resource File To COFF Object Conversion Utility Exit code: 0 Version: 8.00.50727.5003 (Win7SP1GDR.050727-5400) Modules
| |||||||||||||||
| 3268 | "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\7ujjhj_m.cmdline" | C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe | sdiagnhost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Visual C# Command Line Compiler Exit code: 0 Version: 8.0.50727.5483 (Win7SP1GDR.050727-5400) Modules
| |||||||||||||||
Total events
7 534
Read events
7 470
Write events
63
Delete events
1
Modification events
| (PID) Process: | (1652) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (1652) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 3 |
Value: C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip | |||
| (PID) Process: | (1652) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\phacker.zip | |||
| (PID) Process: | (1652) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\Win7-KB3191566-x86.zip | |||
| (PID) Process: | (1652) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip | |||
| (PID) Process: | (1652) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (1652) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (1652) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (1652) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (584) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
Executable files
7
Suspicious files
16
Text files
23
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3368 | cvtres.exe | C:\Users\admin\AppData\Local\Temp\RESBE6F.tmp | binary | |
MD5:3678FE0F58861D5F21ADC53DEDF91CC8 | SHA256:C9CE559FE22989B11AF5EE22DA8B93DB9871F7C7630D903FB06D7F405A670ECD | |||
| 4016 | msdt.exe | C:\Users\admin\AppData\Local\Temp\SDIAG_7c564396-f396-4793-b006-3b5eed423dcb\DiagPackage.diagpkg | html | |
MD5:18A906A43C1C3E27064DB30C81505234 | SHA256:041430D1F0AE14300C46BDCD917C882F4850DA3D6010E3FBF692023655BC406E | |||
| 3096 | xf-adsk2015_x64.exe | C:\Users\admin\Desktop\adesk_patcher64.exe | executable | |
MD5:013A62C8010A5E6B79B613F11B2BEEED | SHA256:1D5AD1614F4E25C79C34FF9D9DD1A4AB8CE1D7B2E87AB58EF8611A6465457509 | |||
| 4016 | msdt.exe | C:\Users\admin\AppData\Local\Temp\SDIAG_7c564396-f396-4793-b006-3b5eed423dcb\TS_ProgramCompatibilityWizard.ps1 | text | |
MD5:46E22C2582B54BE56D80D7A79FEC9BB5 | SHA256:459AF2960B08E848573D45A7350223657ADB2115F24A3C37E69FFE61DEA647F9 | |||
| 4016 | msdt.exe | C:\Users\admin\AppData\Local\Temp\SDIAG_7c564396-f396-4793-b006-3b5eed423dcb\RS_ProgramCompatibilityWizard.ps1 | text | |
MD5:367FE5F4C6DB87E1600F46687E5AAC54 | SHA256:177625AC9B07BBFFCBBB47101C2D1121F47B03B42226861BFD7974B9CEBC0C98 | |||
| 4016 | msdt.exe | C:\Users\admin\AppData\Local\Temp\SDIAG_7c564396-f396-4793-b006-3b5eed423dcb\en-US\DiagPackage.dll.mui | executable | |
MD5:C31BD28AB34E75BC65A5458AC8D37539 | SHA256:5FB9E280013D58043C5689478F9DCFAD3212F4681534627EB33998DDD6F63308 | |||
| 1652 | WinRAR.exe | C:\Users\admin\Desktop\xf-adsk2015_x64_activation autodesk 2015.7z | compressed | |
MD5:14EDB383EAB1153B97A2B32CA53B132E | SHA256:36470B91564269278270B69514211A632D676E02C963CE2E6C7DD015A2B2234E | |||
| 2500 | sdiagnhost.exe | C:\Users\admin\AppData\Local\Temp\gzpp4a0u.0.cs | text | |
MD5:3880DE647B10555A534F34D5071FE461 | SHA256:F73390C091CD7E45DAC07C22B26BF667054EACDA31119513505390529744E15E | |||
| 2500 | sdiagnhost.exe | C:\Users\admin\AppData\Local\Temp\7ujjhj_m.cmdline | text | |
MD5:91831A67366073141904385AE03EF3A7 | SHA256:B81AF541054C0129F13762B87AFA15F589D3084F8EB1A75E1BA3EB8BD2887B1E | |||
| 2500 | sdiagnhost.exe | C:\Users\admin\AppData\Local\Temp\7ujjhj_m.0.cs | text | |
MD5:B0DC59B099CA7C12FB8AD72D3C50C82C | SHA256:E75EAAA3D7908FB05000C0A957048D20091A0D2575E87D091D11CDB3A5B562E5 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
DNS requests
Threats
Process | Message |
|---|---|
csc.exe |
*** HR originated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
|
csc.exe |
*** HR propagated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
|
csc.exe |
*** HR originated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
|
csc.exe |
*** HR originated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
|
csc.exe |
*** HR propagated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
|
csc.exe |
*** HR propagated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
|
csc.exe |
*** HR propagated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
|
csc.exe |
*** HR propagated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
|
csc.exe |
*** HR propagated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
|
csc.exe |
*** HR originated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
|