download: | dictionary.rar |
Full analysis: | https://app.any.run/tasks/2431fdd6-add6-4229-8650-d051329b2914 |
Verdict: | Malicious activity |
Analysis date: | May 15, 2019, 15:00:02 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-rar |
File info: | RAR archive data, v4, os: Win32 |
MD5: | 2295CEC207946E625CFEAF54499328CA |
SHA1: | C164FB74D1E29569AAC78F864BE4FEECA33DC582 |
SHA256: | 805F8D811FE3B0C0EC0FCC5A54A7B50D062D7235941243ED9FD94D6841D9BD8B |
SSDEEP: | 786432:W09VE5lCN6RJG5ZOyBY4nMwwvWPVXOWwvH9q60dYlO3uH:W04lc6SywY4nMsV8Mdp3+ |
.rar | | | RAR compressed archive (v-4.x) (58.3) |
---|---|---|
.rar | | | RAR compressed archive (gen) (41.6) |
ArchivedFileName: | Dictionary\anc_dictionary.ico |
---|---|
PackingMethod: | Normal |
ModifyDate: | 2008:12:11 01:31:24 |
OperatingSystem: | Win32 |
UncompressedSize: | 141842 |
CompressedSize: | 30127 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3380 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\dictionary.rar" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
1540 | "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe5_ Global\UsGthrCtrlFltPipeMssGthrPipe5 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" | C:\Windows\System32\SearchProtocolHost.exe | — | SearchIndexer.exe |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft Windows Search Protocol Host Version: 7.00.7600.16385 (win7_rtm.090713-1255) | ||||
1732 | "C:\Users\admin\Desktop\Dictionary\dictionary.exe" | C:\Users\admin\Desktop\Dictionary\dictionary.exe | — | explorer.exe |
User: admin Company: EC Software Integrity Level: MEDIUM Description: Help & Manual Multimedia Viewer Exit code: 0 Version: 1.0.1.0 |
(PID) Process: | (3380) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtBMP |
Value: | |||
(PID) Process: | (3380) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtIcon |
Value: | |||
(PID) Process: | (3380) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (3380) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\dictionary.rar | |||
(PID) Process: | (3380) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | name |
Value: 120 | |||
(PID) Process: | (3380) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | size |
Value: 80 | |||
(PID) Process: | (3380) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | type |
Value: 120 | |||
(PID) Process: | (3380) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | mtime |
Value: 100 | |||
(PID) Process: | (3380) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\DialogEditHistory\ExtrPath |
Operation: | write | Name: | 0 |
Value: C:\Users\admin\Desktop | |||
(PID) Process: | (1540) SearchProtocolHost.exe | Key: | HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\62\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US |
PID | Process | Filename | Type | |
---|---|---|---|---|
3380 | WinRAR.exe | C:\Users\admin\Desktop\Dictionary\Source\Alpha Lub.pdf | — | |
MD5:— | SHA256:— | |||
3380 | WinRAR.exe | C:\Users\admin\Desktop\Dictionary\anc_dictionary.ico | image | |
MD5:C58F8DFE8C06FA98073D8A9FC3D033D9 | SHA256:0989640CEAABB765B85AF3D1F8A071E10547981F880CFEA7617AAE83EABA196D | |||
3380 | WinRAR.exe | C:\Users\admin\Desktop\Dictionary\Source\Breathing Apparatus.jpg | image | |
MD5:B039492F6ACBFBC925E8D8ADF78930D5 | SHA256:353E904CA0919A4B85C291E39089727377C37FB36C5CFB047542CA8292BC7ACE | |||
3380 | WinRAR.exe | C:\Users\admin\Desktop\Dictionary\Desktop.ini | ini | |
MD5:9BB60482774E0FBE922D02678E771F3D | SHA256:EE2D67AF1B8C39DA4CA7BE80E98B2EADA9FF2ED70DB3587BD42B91A6453F8C63 | |||
3380 | WinRAR.exe | C:\Users\admin\Desktop\Dictionary\Source\ballbearings.pdf | ||
MD5:469334E3FA71A4022E56E7B888BB6DA3 | SHA256:04A1AEED94A13577F58E0E736D6AB5988F69B26E2B09E2928F39BE8E5AA9A8AC | |||
3380 | WinRAR.exe | C:\Users\admin\Desktop\Dictionary\Source\45-SCHIC.PDF | ||
MD5:D018749CDBFDBB88AD57E27F2EAE83FF | SHA256:28E8CDBF7537B27CCC8A573C542ACFA9F4573276EA75E5DE4B80EB9334429EE4 | |||
3380 | WinRAR.exe | C:\Users\admin\Desktop\Dictionary\Source\boats.gif | image | |
MD5:86EDCA6AD1932042DA8900B6554375C9 | SHA256:4B7F7A926A3D684E25FA7023D235E30AE5295B4F3EC8647B5BD83C2C209AF2B3 | |||
3380 | WinRAR.exe | C:\Users\admin\Desktop\Dictionary\Source\anc_dictionary.ico | image | |
MD5:C58F8DFE8C06FA98073D8A9FC3D033D9 | SHA256:0989640CEAABB765B85AF3D1F8A071E10547981F880CFEA7617AAE83EABA196D | |||
3380 | WinRAR.exe | C:\Users\admin\Desktop\Dictionary\Source\btn_hsp_file.png | image | |
MD5:E256106D223A14C5E12D98DBB9304A10 | SHA256:6932B3050AA7CD8CA10F204793552920E2EEE2FCE1EC1E0D37CA2B444F9FCF5F | |||
3380 | WinRAR.exe | C:\Users\admin\Desktop\Dictionary\Source\Bearings.pdf | ||
MD5:0C24DC0BE49F6025D24CCE82406883C8 | SHA256:73A15B5066F10767B435DB59AA9D2B75E4A8FA12C62AFD542655DBB3A679FE62 |