File name: | KcuXMj8y2efeV0FMnqzEQt.zip |
Full analysis: | https://app.any.run/tasks/7e5491b0-44cb-4e24-b68d-0d8cf1ad6ef2 |
Verdict: | Malicious activity |
Analysis date: | August 25, 2019, 09:36:32 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | 5215E6DDB8D9CCA3F79E0832131E554A |
SHA1: | 834B21D0330FAA0738FE7BC5D4FA785E1A0D9CB7 |
SHA256: | 6C9C632850D3BAE7A1DFA7D65E066CCE5B29FEB29D7C8BE1B5A6891A345E1406 |
SSDEEP: | 49152:mHYrsV2NUmbIJTfwf8c8WNXjI3hTjenwWY/z:mEsVZmcBfwfTExf4Y7 |
.zip | | | ZIP compressed archive (100) |
---|
ZipRequiredVersion: | 20 |
---|---|
ZipBitFlag: | 0x0009 |
ZipCompression: | Deflated |
ZipModifyDate: | 2019:08:25 09:23:27 |
ZipCRC: | 0x381364b0 |
ZipCompressedSize: | 1645497 |
ZipUncompressedSize: | 1779136 |
ZipFileName: | Cisco_WebEx_Add-On (1).exe_ |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3028 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\KcuXMj8y2efeV0FMnqzEQt.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
3964 | "C:\Program Files\WinRAR\WinRAR.exe" -elevate3028 | C:\Program Files\WinRAR\WinRAR.exe | WinRAR.exe | |
User: admin Company: Alexander Roshal Integrity Level: HIGH Description: WinRAR archiver Exit code: 0 Version: 5.60.0 | ||||
3052 | "C:\Windows\explorer.exe" | C:\Windows\explorer.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
1008 | "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Cisco_WebEx_Add-On (1).exe_ | C:\Windows\system32\rundll32.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3008 | C:\Windows\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09} | C:\Windows\system32\DllHost.exe | svchost.exe | |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: COM Surrogate Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3788 | "C:\Cisco_WebEx_Add-On (1).exe" | C:\Cisco_WebEx_Add-On (1).exe | explorer.exe | |
User: admin Company: Cisco Webex LLC Integrity Level: MEDIUM Description: Cisco_Webex_Add-On Exit code: 0 Version: 3300.4.1807.706 | ||||
2272 | /r | C:\Users\admin\AppData\Local\WebEx\CiscoWebExStart.exe | Cisco_WebEx_Add-On (1).exe | |
User: admin Company: Cisco Webex LLC Integrity Level: MEDIUM Description: Cisco Webex Meeting Exit code: 1 Version: 10039,1,2019,0111 | ||||
2340 | /r | C:\Users\admin\AppData\Local\WebEx\webex.exe | Cisco_WebEx_Add-On (1).exe | |
User: admin Company: Cisco Webex LLC Integrity Level: MEDIUM Description: Cisco Webex Meeting Exit code: 1 Version: 10039,1,2019,0111 | ||||
1100 | "C:\Program Files\Google\Chrome\Application\chrome.exe" | C:\Program Files\Google\Chrome\Application\chrome.exe | explorer.exe | |
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Version: 75.0.3770.100 | ||||
3180 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=75.0.3770.100 --initial-client-data=0x7c,0x80,0x84,0x78,0x88,0x6db0a9d0,0x6db0a9e0,0x6db0a9ec | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe |
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Version: 75.0.3770.100 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3788 | Cisco_WebEx_Add-On (1).exe | C:\Users\admin\AppData\Local\Temp\PreBA58.tmp | — | |
MD5:— | SHA256:— | |||
3788 | Cisco_WebEx_Add-On (1).exe | C:\Users\admin\AppData\Local\WebEx\chrome.json | text | |
MD5:16E6FD5AEE6393E09064D557F66944CC | SHA256:C96039E5DE97D1481A2964BDBCA8D7CB09358D1BE4A04CBC63DAB98513FFDE70 | |||
3788 | Cisco_WebEx_Add-On (1).exe | C:\Users\admin\AppData\Local\Temp\wbxBA57.tmp | binary | |
MD5:681F0851369FED7B13539464CC14F32D | SHA256:79809860FDBF9F68B8A0D31D382DED98BABC0A40A90314E17D8434936BCC568E | |||
1100 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old | text | |
MD5:C4D6CBB269C626168A5D6D0D8CCE6C30 | SHA256:B62CDBB758278A0C2E50593357390119441D8DE09428EB29027F3DFD1332E348 | |||
3788 | Cisco_WebEx_Add-On (1).exe | C:\Users\admin\AppData\Local\Temp\wbxtra_08252019_103802.wbt | binary | |
MD5:44AFB20E7225A826BD19A38D35962AD8 | SHA256:0821EBD98149E776729CC54234F950F01B20D2A25D0478284CEB439808A0A26B | |||
3788 | Cisco_WebEx_Add-On (1).exe | C:\Users\admin\AppData\Local\Google\Chrome\Application\Plugins\npatgpc.dll | executable | |
MD5:596A360CF4B2D28C494571C00C8DB05C | SHA256:2E54930A4CCC945F6FE479CE1BF998269D4CCE4E02C0BCD5E57C8D0338B0F9EA | |||
2272 | CiscoWebExStart.exe | C:\Users\admin\AppData\Local\Temp\wbxtra_08252019_103803.wbt | binary | |
MD5:B84F37CD1319BBC49ED25BB4E3C293C3 | SHA256:250A6B4ADD7FC7296CEE94D7442F1697B47171C65C23ECA2DDB0CA4FBDF01D2E | |||
3788 | Cisco_WebEx_Add-On (1).exe | C:\Users\admin\AppData\Local\WebEx\firefox.json | text | |
MD5:9365D7D324A8714B0E898C34E409F014 | SHA256:DDEF36A25A888454FF0EAF7E8182014CA36113265AA5983F4022C6FFA336BF65 | |||
3008 | DllHost.exe | C:\Cisco_WebEx_Add-On (1).exe | executable | |
MD5:C754606721181FC0B8BB09A1AE70776F | SHA256:7346A6B59E57917BD7D41A3F9608BC478A28FDA594700D05185A625BC6711840 | |||
3788 | Cisco_WebEx_Add-On (1).exe | C:\Users\admin\AppData\Roaming\Mozilla\plugins\npatgpc.dll | executable | |
MD5:596A360CF4B2D28C494571C00C8DB05C | SHA256:2E54930A4CCC945F6FE479CE1BF998269D4CCE4E02C0BCD5E57C8D0338B0F9EA |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3856 | chrome.exe | GET | 302 | 216.58.210.14:80 | http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvOWVmQUFXS041NV9ZVXlJVWwxbGc5TUM4dw/7519.422.0.3_pkedcjkdefgpdelpbcmbmeomcjbeemfm.crx | US | html | 516 b | whitelisted |
3856 | chrome.exe | GET | 200 | 173.194.5.216:80 | http://r2---sn-aigl6n7d.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvOWVmQUFXS041NV9ZVXlJVWwxbGc5TUM4dw/7519.422.0.3_pkedcjkdefgpdelpbcmbmeomcjbeemfm.crx?cms_redirect=yes&mip=185.217.117.157&mm=28&mn=sn-aigl6n7d&ms=nvh&mt=1566725835&mv=m&mvi=1&pl=24&shardbypass=yes | US | crx | 862 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3856 | chrome.exe | 172.217.22.67:443 | www.gstatic.com | Google Inc. | US | whitelisted |
3856 | chrome.exe | 216.58.207.74:443 | fonts.googleapis.com | Google Inc. | US | whitelisted |
3856 | chrome.exe | 172.217.22.77:443 | accounts.google.com | Google Inc. | US | whitelisted |
3856 | chrome.exe | 172.217.22.35:443 | fonts.gstatic.com | Google Inc. | US | whitelisted |
3856 | chrome.exe | 172.217.22.3:443 | clientservices.googleapis.com | Google Inc. | US | whitelisted |
3856 | chrome.exe | 172.217.21.238:443 | apis.google.com | Google Inc. | US | whitelisted |
3856 | chrome.exe | 216.58.205.227:443 | www.google.com.ua | Google Inc. | US | whitelisted |
3856 | chrome.exe | 172.217.21.225:443 | clients2.googleusercontent.com | Google Inc. | US | whitelisted |
3856 | chrome.exe | 172.217.22.46:443 | clients2.google.com | Google Inc. | US | whitelisted |
3856 | chrome.exe | 172.217.22.110:443 | ogs.google.com | Google Inc. | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
clientservices.googleapis.com |
| whitelisted |
accounts.google.com |
| shared |
www.google.com.ua |
| whitelisted |
fonts.googleapis.com |
| whitelisted |
www.gstatic.com |
| whitelisted |
fonts.gstatic.com |
| whitelisted |
apis.google.com |
| whitelisted |
ogs.google.com |
| whitelisted |
clients2.google.com |
| whitelisted |
clients2.googleusercontent.com |
| whitelisted |
Process | Message |
---|---|
Cisco_WebEx_Add-On (1).exe | WbxMapViewOfFile szMapFileName=WBX_TRACE_MAPVIEW_MAP_NAME_PRE_3788
|
Cisco_WebEx_Add-On (1).exe | WbxMapViewOfFile szMapFileName=WBX_TRACE_MAPVIEW_MAP_NAME_PRE_3788
|
Cisco_WebEx_Add-On (1).exe | WbxMapViewOfFile new lpBaseAddress=21757952
|
Cisco_WebEx_Add-On (1).exe | wbxtra_lib_clean start
|
Cisco_WebEx_Add-On (1).exe | wbxtra_lib_clean start
|
Cisco_WebEx_Add-On (1).exe | WbxUnmapViewOfFile lpBaseAddress=2175795l |
Cisco_WebEx_Add-On (1).exe | WbxUnmapViewOfFile lpBaseAddress=21757952
|
Cisco_WebEx_Add-On (1).exe | WbxMapViewOfFile AddMapFileRef=0 lpBaseAddress=21757952
|
Cisco_WebEx_Add-On (1).exe | WbxMapViewOfFile AddMapFileRef data.dwRefCount=0
|
Cisco_WebEx_Add-On (1).exe | wbxtra_lib_clean end
|