| File name: | OLicenseCleanup.zip |
| Full analysis: | https://app.any.run/tasks/dff38f13-af1b-4708-ad8f-e50364553894 |
| Verdict: | Malicious activity |
| Analysis date: | January 24, 2024, 03:02:28 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v2.0 to extract |
| MD5: | 099686FDA868341EA80508C5A258F601 |
| SHA1: | 1A4F68F7BF2E8F79E9E8AF6D5DAEF2B25E2C1749 |
| SHA256: | 69C0B8BBCEF254B8B656743A9258140BC5153B40614E618374491C5B140E08DF |
| SSDEEP: | 192:A5FSHZA4I3PdAnVFaMM5EhTHimLfC0nWfvpludEYPj:mKATFAvz8KHJzCNZlcEW |
MALICIOUS
Checks whether a specified folder exists (SCRIPT)
- wscript.exe (PID: 2584)
Accesses environment variables (SCRIPT)
- wscript.exe (PID: 2584)
Gets TEMP folder path (SCRIPT)
- wscript.exe (PID: 2584)
SUSPICIOUS
Gets full path of the running script (SCRIPT)
- wscript.exe (PID: 2584)
Uses WMI to retrieve WMI-managed resources (SCRIPT)
- wscript.exe (PID: 2584)
The process executes VB scripts
- WinRAR.exe (PID: 984)
Reads the Internet Settings
- wscript.exe (PID: 2584)
Gets computer name (SCRIPT)
- wscript.exe (PID: 2584)
Runs shell command (SCRIPT)
- wscript.exe (PID: 2584)
Accesses language version of the operating system installed via WMI (SCRIPT)
- wscript.exe (PID: 2584)
Creates an object to access WMI (SCRIPT)
- wscript.exe (PID: 2584)
Executes WMI query (SCRIPT)
- wscript.exe (PID: 2584)
Accesses WMI object caption (SCRIPT)
- wscript.exe (PID: 2584)
Accesses computer name via WMI (SCRIPT)
- wscript.exe (PID: 2584)
Creates FileSystem object to access computer's file system (SCRIPT)
- wscript.exe (PID: 2584)
Accesses operating system name via WMI (SCRIPT)
- wscript.exe (PID: 2584)
Uses REG/REGEDIT.EXE to modify registry
- wscript.exe (PID: 2584)
Accesses OperatingSystem(Win32_OperatingSystem) via WMI (SCRIPT)
- wscript.exe (PID: 2584)
Writes binary data to a Stream object (SCRIPT)
- wscript.exe (PID: 2584)
Reads data from a binary Stream object (SCRIPT)
- wscript.exe (PID: 2584)
Accesses ComputerSystem(Win32_ComputerSystem) via WMI (SCRIPT)
- wscript.exe (PID: 2584)
Checks whether a specific file exists (SCRIPT)
- wscript.exe (PID: 2584)
INFO
Checks supported languages
- wmpnscfg.exe (PID: 3840)
Manual execution by a user
- wmpnscfg.exe (PID: 3840)
Reads the computer name
- wmpnscfg.exe (PID: 3840)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .zip | | | ZIP compressed archive (100) |
|---|
EXIF
ZIP
| ZipRequiredVersion: | 20 |
|---|---|
| ZipBitFlag: | - |
| ZipCompression: | Deflated |
| ZipModifyDate: | 2023:05:05 11:35:58 |
| ZipCRC: | 0x4ad10f05 |
| ZipCompressedSize: | 6206 |
| ZipUncompressedSize: | 27900 |
| ZipFileName: | OLicenseCleanup/OLicenseCleanup.vbs |
Total processes
76
Monitored processes
20
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 128 | "C:\Windows\System32\reg.exe" DELETE HKCU\Software\Microsoft\Office\15.0\Common\Roaming\Identities /f | C:\Windows\System32\reg.exe | — | wscript.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Registry Console Tool Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 980 | "C:\Windows\System32\reg.exe" DELETE HKCU\Software\Microsoft\Office\16.0\Common\ScriptRun\OLicenseCleanup /f | C:\Windows\System32\reg.exe | — | wscript.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Registry Console Tool Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 984 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\OLicenseCleanup.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
| 1972 | "C:\Windows\System32\reg.exe" DELETE HKCU\Software\Microsoft\Office\16.0\Common\Identity /f | C:\Windows\System32\reg.exe | — | wscript.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Registry Console Tool Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2176 | "C:\Windows\System32\reg.exe" DELETE HKCU\Software\Microsoft\Office\15.0\Common\Internet\WebServiceCache /f | C:\Windows\System32\reg.exe | — | wscript.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Registry Console Tool Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2208 | "C:\Windows\System32\reg.exe" DELETE HKCU\Software\Microsoft\Office\15.0\Common\Identity /f | C:\Windows\System32\reg.exe | — | wscript.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Registry Console Tool Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2376 | "C:\Windows\System32\reg.exe" DELETE HKCU\Software\Microsoft\Office\16.0\Common\Licensing /f | C:\Windows\System32\reg.exe | — | wscript.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Registry Console Tool Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2584 | "C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIa984.34898\OLicenseCleanup.vbs" | C:\Windows\System32\wscript.exe | — | WinRAR.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 Modules
| |||||||||||||||
| 2732 | "C:\Windows\System32\reg.exe" DELETE HKCU\Software\Microsoft\Office\16.0\Common\Roaming\Identities /f | C:\Windows\System32\reg.exe | — | wscript.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Registry Console Tool Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2784 | "C:\Windows\System32\reg.exe" DELETE HKCU\Software\Microsoft\Office\16.0\Registration /f | C:\Windows\System32\reg.exe | — | wscript.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Registry Console Tool Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
1 337
Read events
1 311
Write events
26
Delete events
0
Modification events
| (PID) Process: | (984) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (984) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 3 |
Value: C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip | |||
| (PID) Process: | (984) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\phacker.zip | |||
| (PID) Process: | (984) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\Win7-KB3191566-x86.zip | |||
| (PID) Process: | (984) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip | |||
| (PID) Process: | (984) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (984) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (984) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (984) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (984) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
Executable files
0
Suspicious files
0
Text files
2
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 984 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DIa984.34898\OLicenseCleanup.vbs | text | |
MD5:3979D2C04D7D4C9C33A3B0EE836FD021 | SHA256:B10FAB9A211A1B44C008FECEE92CDD8197240AC8809B6A55FA17CC5E6D5CE7C6 | |||
| 2584 | wscript.exe | C:\Users\admin\AppData\Local\Temp\USER-PC_20240124030246_OLicenseClean.txt | text | |
MD5:647096D7E6AA595F775CFB097CE299BE | SHA256:E4877850D400C683B4DB37D0F1AF8AF3749AE06E815B0CF767FC833C7FB7FB1C | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |