File name: | _WRF_114B6403-D448-4C1D-A3D8-DFC14D56089F_.tmp.zip |
Full analysis: | https://app.any.run/tasks/26c3db6c-4698-4449-89d4-a480189f9af3 |
Verdict: | Malicious activity |
Analysis date: | December 06, 2018, 12:52:02 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | FBC8544BABE46997B051B963F8909746 |
SHA1: | BDB6BDD407209278DE4118E91FB6EAFCB0265C36 |
SHA256: | 7E00E15B01BE2634E78A10C1AA1462AA4463A1811B9996E673E9536A1E933CA4 |
SSDEEP: | 6144:bgBFQyym4VsDIc+Kau2RIiyIDJJJEJGCW6Js:bEnUG+u2RIkDJbEYC7Js |
.zip | | | ZIP compressed archive (100) |
---|
ZipFileName: | _WRF_73120444-C3DD-4922-963C-EED5D5918CBA_.tmp |
---|---|
ZipUncompressedSize: | 311296 |
ZipCompressedSize: | 294279 |
ZipCRC: | 0xa49ffd88 |
ZipModifyDate: | 2018:12:05 16:24:17 |
ZipCompression: | Deflated |
ZipBitFlag: | 0x0001 |
ZipRequiredVersion: | 788 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3508 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\_WRF_114B6403-D448-4C1D-A3D8-DFC14D56089F_.tmp.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
3316 | "C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\Rar$DIb3508.24846\_WRF_73120444-C3DD-4922-963C-EED5D5918CBA_.tmp | C:\Program Files\WinRAR\WinRAR.exe | WinRAR.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
2348 | "C:\Users\admin\AppData\Local\Temp\Rar$DIa3316.25549\saver.scr" /S | C:\Users\admin\AppData\Local\Temp\Rar$DIa3316.25549\saver.scr | WinRAR.exe | |
User: admin Integrity Level: MEDIUM |
(PID) Process: | (3508) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtBMP |
Value: | |||
(PID) Process: | (3508) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtIcon |
Value: | |||
(PID) Process: | (3508) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (3508) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\_WRF_114B6403-D448-4C1D-A3D8-DFC14D56089F_.tmp.zip | |||
(PID) Process: | (3508) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | name |
Value: 120 | |||
(PID) Process: | (3508) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | size |
Value: 80 | |||
(PID) Process: | (3508) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | type |
Value: 120 | |||
(PID) Process: | (3508) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | mtime |
Value: 100 | |||
(PID) Process: | (3508) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface |
Operation: | write | Name: | ShowPassword |
Value: 0 | |||
(PID) Process: | (3508) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3508 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DIb3508.24846\_WRF_73120444-C3DD-4922-963C-EED5D5918CBA_.tmp | binary | |
MD5:EDA3C17D9098D8571ED02F3B837B350D | SHA256:A607FCD83110013DCEAEFABE5E9EAF242BEE572C9366834F275E42B5A99991E0 | |||
3316 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DIa3316.25847\gondi.doc | document | |
MD5:9B5662F43ADBAE343CBCFE9C8C9A12DB | SHA256:280F431FB3050075956D5CBD5C691B35EBDB3C95245A21F1A63209BC71943885 | |||
3316 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DIa3316.25549\saver.scr | executable | |
MD5:7723283807A9C8176E741F489CD3CFCF | SHA256:78B095CB056A5A8F91FDA1062B62E08C8575416D3F79321F9C1A287738447E80 | |||
3316 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DIa3316.27321\saver.scr | executable | |
MD5:7723283807A9C8176E741F489CD3CFCF | SHA256:78B095CB056A5A8F91FDA1062B62E08C8575416D3F79321F9C1A287738447E80 | |||
2348 | saver.scr | C:\Users\admin\AppData\Local\Temp\Marabou | binary | |
MD5:851AED89C5F86565FAEA4A2547B8BC9E | SHA256:3D8FF51B61ED9C26958E90A93BD9A9AA4BE3FB65ED3F8989641BFB501402C0C1 | |||
2348 | saver.scr | C:\Users\admin\AppData\Local\Temp\penalisation.dll | executable | |
MD5:AF01229ADB25AC310922F3FEF7343AD9 | SHA256:B879BF1E60CB6121CE95B58CD946A5CC15848BFB8D681FFC0E5F50F0FC71AF69 | |||
2348 | saver.scr | C:\Users\admin\AppData\Local\Temp\made.rtf | text | |
MD5:8274425DE767B30B2FFF1124AB54ABB5 | SHA256:0D6AFB7E939F0936F40AFDC759B5A354EA5427EC250A47E7B904AB1EA800A01D | |||
2348 | saver.scr | C:\Users\admin\AppData\Local\Temp\nspFC94.tmp\System.dll | executable | |
MD5:75ED96254FBF894E42058062B4B4F0D1 | SHA256:A632D74332B3F08F834C732A103DAFEB09A540823A2217CA7F49159755E8F1D7 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
— | — | POST | — | 91.243.80.52:80 | http://radburgsoft.com/bet/nite/logout.php?id=8048257 | NL | — | — | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
— | — | 13.77.161.179:80 | microsoft.com | Microsoft Corporation | US | whitelisted |
— | — | 91.243.80.52:80 | radburgsoft.com | Sinarohost LTD | NL | malicious |
Domain | IP | Reputation |
---|---|---|
microsoft.com |
| whitelisted |
radburgsoft.com |
| malicious |