URL: | https://www.dropbox.com/s/834v5xac3lpz6x1/IMG-8003221.rar?dl=1 |
Full analysis: | https://app.any.run/tasks/4485d9d7-f237-41c8-ae2c-4c26c29a6fb5 |
Verdict: | Malicious activity |
Analysis date: | April 15, 2019, 07:53:21 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MD5: | 399553A3A2E16B927EACD6D45195B252 |
SHA1: | 3E339267F5622D8AFC23949C45B8573DFA15C358 |
SHA256: | 7F3C5BD5D0F8DA0F57B288CDF64A7716112876566FFD540FB99C411D0D163256 |
SSDEEP: | 3:N8DSLcVHGkBWvOVfRgoiQ80jlB:2OLHkBWvOVZtigv |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2660 | "C:\Program Files\Internet Explorer\iexplore.exe" https://www.dropbox.com/s/834v5xac3lpz6x1/IMG-8003221.rar?dl=1 | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 1 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
2864 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2660 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
2868 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFR7TN5Q\IMG-8003221[1].rar" | C:\Program Files\WinRAR\WinRAR.exe | iexplore.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
2484 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa2868.35092\IMG-8003221.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa2868.35092\IMG-8003221.exe | — | WinRAR.exe |
User: admin Integrity Level: MEDIUM Exit code: 0 Version: 3, 3, 8, 1 | ||||
4060 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa2868.35609\IMG-8003221.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa2868.35609\IMG-8003221.exe | — | WinRAR.exe |
User: admin Integrity Level: MEDIUM Exit code: 0 Version: 3, 3, 8, 1 | ||||
2832 | "C:\Windows\System32\eventvwr.exe" 0 | C:\Windows\System32\eventvwr.exe | — | IMG-8003221.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Event Viewer Snapin Launcher Exit code: 3221226540 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2256 | "C:\Windows\System32\eventvwr.exe" 0 | C:\Windows\System32\eventvwr.exe | IMG-8003221.exe | |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Event Viewer Snapin Launcher Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3728 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa2868.35092\IMG-8003221.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa2868.35092\IMG-8003221.exe | eventvwr.exe | |
User: admin Integrity Level: HIGH Exit code: 0 Version: 3, 3, 8, 1 | ||||
2556 | "C:\Windows\System32\eventvwr.exe" 0 | C:\Windows\System32\eventvwr.exe | — | IMG-8003221.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Event Viewer Snapin Launcher Exit code: 3221226540 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2344 | "C:\Windows\System32\eventvwr.exe" 0 | C:\Windows\System32\eventvwr.exe | IMG-8003221.exe | |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Event Viewer Snapin Launcher Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
2660 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
2660 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
2864 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@dropbox[1].txt | — | |
MD5:— | SHA256:— | |||
2864 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt | — | |
MD5:— | SHA256:— | |||
2660 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DFA4EEF7C832F41184.TMP | — | |
MD5:— | SHA256:— | |||
2660 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DF773F7408E7125637.TMP | — | |
MD5:— | SHA256:— | |||
2660 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{92011BC5-5F53-11E9-B63D-5254004A04AF}.dat | — | |
MD5:— | SHA256:— | |||
2864 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\JavaDeployReg.log | text | |
MD5:3C3F255A871EE8D838163A80285C0829 | SHA256:036E7E8E4FB416B79683F7E218C8656CEF84FE8460FFA864359154B5149F097E | |||
2864 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\index.dat | dat | |
MD5:CC3559C69790864F6AE58EEA0D2ADCD1 | SHA256:B32E8F640B43748854E9B7F82CA07A3674B9D2A3AC88C5AD7196A6C9818708F2 | |||
2660 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini | ini | |
MD5:4A3DEB274BB5F0212C2419D3D8D08612 | SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2660 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2864 | iexplore.exe | 162.125.66.6:443 | uca8d2e08606a65ebc3ce169624a.dl.dropboxusercontent.com | Dropbox, Inc. | DE | shared |
2660 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
2864 | iexplore.exe | 162.125.65.1:443 | www.dropbox.com | Dropbox, Inc. | NL | shared |
1064 | svhost.exe | 185.222.202.29:9998 | nicholaspring.xyz | — | — | malicious |
Domain | IP | Reputation |
---|---|---|
www.dropbox.com |
| shared |
www.bing.com |
| whitelisted |
uca8d2e08606a65ebc3ce169624a.dl.dropboxusercontent.com |
| malicious |
nicholaspring.xyz |
| malicious |
PID | Process | Class | Message |
---|---|---|---|
2864 | iexplore.exe | Potential Corporate Privacy Violation | SUSPICIOUS [PTsecurity] Dropbox SSL Payload Request |