File name: | Application.zip |
Full analysis: | https://app.any.run/tasks/dae54300-f031-4db5-a419-592e5d6d649d |
Verdict: | Malicious activity |
Analysis date: | May 24, 2019, 13:06:36 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | 59E2F7EE47E364946792E62475DED77E |
SHA1: | EAAA01E827082CED51B1880BFCE50EAC87303BDB |
SHA256: | 734A062C3BD455BB168D1E56640ABB7CAB6D0E31ECA11E210E6648FFA206F4D0 |
SSDEEP: | 196608:+3I/3ES4oxr8cvN6iVGHevm42oDgxe4EJIKzBG2d8JhmFPBP:+3m3E0xr8k6iVGiv2o64JA24SPR |
.zip | | | ZIP compressed archive (100) |
---|
ZipRequiredVersion: | 20 |
---|---|
ZipBitFlag: | - |
ZipCompression: | Deflated |
ZipModifyDate: | 2014:06:24 09:03:05 |
ZipCRC: | 0x1db802c7 |
ZipCompressedSize: | 2731510 |
ZipUncompressedSize: | 2905216 |
ZipFileName: | setup.exe |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3148 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Application.zip" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 | ||||
3020 | "C:\Users\admin\Desktop\setup.exe" | C:\Users\admin\Desktop\setup.exe | — | explorer.exe |
User: admin Company: AIRMAR Technology Corporation Integrity Level: MEDIUM Description: Setup Launcher Exit code: 3221226540 Version: 3.005.0000 | ||||
2368 | "C:\Users\admin\Desktop\setup.exe" | C:\Users\admin\Desktop\setup.exe | explorer.exe | |
User: admin Company: AIRMAR Technology Corporation Integrity Level: HIGH Description: Setup Launcher Exit code: 4294967295 Version: 3.005.0000 | ||||
352 | "C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\Desktop\WeatherCaster.msi" | C:\Windows\System32\msiexec.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Exit code: 1603 Version: 5.0.7600.16385 (win7_rtm.090713-1255) | ||||
4064 | C:\Windows\system32\msiexec.exe /V | C:\Windows\system32\msiexec.exe | — | services.exe |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows® installer Version: 5.0.7600.16385 (win7_rtm.090713-1255) | ||||
2424 | "C:\Users\admin\Desktop\setup.exe" | C:\Users\admin\Desktop\setup.exe | — | explorer.exe |
User: admin Company: AIRMAR Technology Corporation Integrity Level: MEDIUM Description: Setup Launcher Exit code: 3221226540 Version: 3.005.0000 | ||||
3756 | "C:\Users\admin\Desktop\setup.exe" | C:\Users\admin\Desktop\setup.exe | explorer.exe | |
User: admin Company: AIRMAR Technology Corporation Integrity Level: HIGH Description: Setup Launcher Exit code: 4294967295 Version: 3.005.0000 |
(PID) Process: | (3148) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtBMP |
Value: | |||
(PID) Process: | (3148) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtIcon |
Value: | |||
(PID) Process: | (3148) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (3148) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\Application.zip | |||
(PID) Process: | (3148) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | name |
Value: 120 | |||
(PID) Process: | (3148) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | size |
Value: 80 | |||
(PID) Process: | (3148) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | type |
Value: 120 | |||
(PID) Process: | (3148) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | mtime |
Value: 100 | |||
(PID) Process: | (3148) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E |
Operation: | write | Name: | @C:\Windows\System32\msimsg.dll,-34 |
Value: Windows Installer Package | |||
(PID) Process: | (3148) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin |
Operation: | write | Name: | Placement |
Value: 2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3148 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3148.22826\WeatherCaster.msi | — | |
MD5:— | SHA256:— | |||
2368 | setup.exe | C:\Users\admin\AppData\Local\Temp\~2CE6.tmp | — | |
MD5:— | SHA256:— | |||
3756 | setup.exe | C:\Users\admin\AppData\Local\Temp\~8EFB.tmp | — | |
MD5:— | SHA256:— | |||
352 | msiexec.exe | C:\Users\admin\AppData\Local\Temp\MSI5387e.LOG | text | |
MD5:C4E6C44DF36B1E271B6FAF583D38F3CA | SHA256:094C9347373485CB136FB6550EB78F72439CDA6027EFB7EE5E9E69059B57B504 | |||
3756 | setup.exe | C:\Users\admin\AppData\Local\Temp\{061DD4D6-631B-473A-B9BA-2C1A13251AF9}\Setup.INI | text | |
MD5:F147BC8A50F010CECF4668CCE98D7360 | SHA256:B284BE14D2ECD12DA00CCB78876BFF854EB5EA37333EEB6C9F38AFAACE045765 | |||
2368 | setup.exe | C:\Users\admin\AppData\Local\Temp\{AD190582-5314-493D-B03C-9D24206DBCBB}\_ISMSIDEL.INI | text | |
MD5:332B586F53FB896ADCB1629A8EBFB654 | SHA256:DBA8BE4EB6CFDF7CA509F1F14963C6DF30585D83E8773CE358B24362B08395C5 | |||
3756 | setup.exe | C:\Users\admin\AppData\Local\Temp\{061DD4D6-631B-473A-B9BA-2C1A13251AF9}\_ISMSIDEL.INI | text | |
MD5:8B65D419C908935A40E7F46D531331DA | SHA256:120308BA2E2CA9DB40222A51D2C139D167C6D46F3C56FDF5CC83BB83008EC6CD | |||
3148 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3148.22521\setup.exe | executable | |
MD5:0A3A5014EAD035A81FE282ABB3E44725 | SHA256:BC92219A5615FCF64F857EC400FF07FB34EF5C721550317EB693B7741E10D6A2 | |||
2368 | setup.exe | C:\Users\admin\AppData\Local\Temp\{AD190582-5314-493D-B03C-9D24206DBCBB}\Setup.INI | text | |
MD5:F147BC8A50F010CECF4668CCE98D7360 | SHA256:B284BE14D2ECD12DA00CCB78876BFF854EB5EA37333EEB6C9F38AFAACE045765 | |||
2368 | setup.exe | C:\Users\admin\AppData\Local\Temp\{AD190582-5314-493D-B03C-9D24206DBCBB}\0x0409.ini | text | |
MD5:52D179AD79966752EC40A678FD8B0062 | SHA256:57E020C41AD0566FB55415A40167A0C3DA89584BC4E5F961D8E8C646F80C5590 |