| File name: | _WRF_114B6403-D448-4C1D-A3D8-DFC14D56089F_.tmp.zip |
| Full analysis: | https://app.any.run/tasks/26c3db6c-4698-4449-89d4-a480189f9af3 |
| Verdict: | Malicious activity |
| Analysis date: | December 06, 2018, 12:52:02 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v2.0 to extract |
| MD5: | FBC8544BABE46997B051B963F8909746 |
| SHA1: | BDB6BDD407209278DE4118E91FB6EAFCB0265C36 |
| SHA256: | 7E00E15B01BE2634E78A10C1AA1462AA4463A1811B9996E673E9536A1E933CA4 |
| SSDEEP: | 6144:bgBFQyym4VsDIc+Kau2RIiyIDJJJEJGCW6Js:bEnUG+u2RIkDJbEYC7Js |
MALICIOUS
Application was dropped or rewritten from another process
- saver.scr (PID: 2348)
SUSPICIOUS
Executable content was dropped or overwritten
- WinRAR.exe (PID: 3316)
- saver.scr (PID: 2348)
Application launched itself
- WinRAR.exe (PID: 3508)
Starts application with an unusual extension
- WinRAR.exe (PID: 3316)
INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .zip | | | ZIP compressed archive (100) |
|---|
EXIF
ZIP
| ZipRequiredVersion: | 788 |
|---|---|
| ZipBitFlag: | 0x0001 |
| ZipCompression: | Deflated |
| ZipModifyDate: | 2018:12:05 16:24:17 |
| ZipCRC: | 0xa49ffd88 |
| ZipCompressedSize: | 294279 |
| ZipUncompressedSize: | 311296 |
| ZipFileName: | _WRF_73120444-C3DD-4922-963C-EED5D5918CBA_.tmp |
Total processes
32
Monitored processes
3
Malicious processes
0
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2348 | "C:\Users\admin\AppData\Local\Temp\Rar$DIa3316.25549\saver.scr" /S | C:\Users\admin\AppData\Local\Temp\Rar$DIa3316.25549\saver.scr | WinRAR.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 3316 | "C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\Rar$DIb3508.24846\_WRF_73120444-C3DD-4922-963C-EED5D5918CBA_.tmp | C:\Program Files\WinRAR\WinRAR.exe | WinRAR.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 Modules
| |||||||||||||||
| 3508 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\_WRF_114B6403-D448-4C1D-A3D8-DFC14D56089F_.tmp.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 Modules
| |||||||||||||||
Total events
1 194
Read events
1 166
Write events
28
Delete events
0
Modification events
| (PID) Process: | (3508) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (3508) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (3508) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (3508) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\_WRF_114B6403-D448-4C1D-A3D8-DFC14D56089F_.tmp.zip | |||
| (PID) Process: | (3508) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (3508) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (3508) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (3508) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (3316) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (3316) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
Executable files
4
Suspicious files
3
Text files
1
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3316 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DIa3316.25847\gondi.doc | document | |
MD5:— | SHA256:— | |||
| 2348 | saver.scr | C:\Users\admin\AppData\Local\Temp\Marabou | binary | |
MD5:— | SHA256:— | |||
| 3508 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DIb3508.24846\_WRF_73120444-C3DD-4922-963C-EED5D5918CBA_.tmp | binary | |
MD5:— | SHA256:— | |||
| 2348 | saver.scr | C:\Users\admin\AppData\Local\Temp\penalisation.dll | executable | |
MD5:— | SHA256:— | |||
| 3316 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DIa3316.25549\saver.scr | executable | |
MD5:— | SHA256:— | |||
| 3316 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DIa3316.27321\saver.scr | executable | |
MD5:— | SHA256:— | |||
| 2348 | saver.scr | C:\Users\admin\AppData\Local\Temp\nspFC94.tmp\System.dll | executable | |
MD5:75ED96254FBF894E42058062B4B4F0D1 | SHA256:A632D74332B3F08F834C732A103DAFEB09A540823A2217CA7F49159755E8F1D7 | |||
| 2348 | saver.scr | C:\Users\admin\AppData\Local\Temp\made.rtf | text | |
MD5:8274425DE767B30B2FFF1124AB54ABB5 | SHA256:0D6AFB7E939F0936F40AFDC759B5A354EA5427EC250A47E7B904AB1EA800A01D | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
2
DNS requests
3
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | POST | — | 91.243.80.52:80 | http://radburgsoft.com/bet/nite/logout.php?id=8048257 | NL | — | — | malicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 13.77.161.179:80 | microsoft.com | Microsoft Corporation | US | whitelisted |
— | — | 91.243.80.52:80 | radburgsoft.com | Sinarohost LTD | NL | malicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
microsoft.com |
| whitelisted |
radburgsoft.com |
| malicious |