File name: | document7509.vbe.xz |
Full analysis: | https://app.any.run/tasks/3d25618d-be58-48d9-944a-2cfc3e9701da |
Verdict: | Malicious activity |
Analysis date: | October 14, 2019, 10:12:37 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-xz |
File info: | XZ compressed data |
MD5: | B979A3CD12F33753FC1661FAE1679480 |
SHA1: | C0DB2F437A3DCA8ADA709F3034D4BC25E1D32E14 |
SHA256: | 833859A438015343F82744602B24546AD016D8D6DBCBE58ACF1D5CDB8AB93B26 |
SSDEEP: | 48:jO85cXpVqnJMWI8qPF/LjWd4kdJ9rG9nxdv6wZMq6fnJuySzJatQKfVrDv:a7Z6IFPFZuVIbf0JuWfVrb |
.xz | | | xz compressed container (85.7) |
---|
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2172 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\document7509.vbe.xz" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
1856 | "C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIa2172.908\document7509.vbe" | C:\Windows\System32\WScript.exe | — | WinRAR.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 | ||||
3388 | "C:\Windows\System32\wscript.exe" C:\Users\admin\AppData\Local\Temp\Rar$DIa2172.908\document7509.vbe +-++ | C:\Windows\System32\wscript.exe | — | WScript.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 | ||||
1416 | "C:\Windows\System32\wscript.exe" C:\Users\admin\AppData\Local\Temp\Rar$DIa2172.908\document7509.vbe +-++ +-++ | C:\Windows\System32\wscript.exe | — | wscript.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 | ||||
1752 | "C:\Windows\System32\wscript.exe" C:\Users\admin\AppData\Local\Temp\Rar$DIa2172.908\document7509.vbe +-++ +-++ +-++ | C:\Windows\System32\wscript.exe | — | wscript.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 | ||||
788 | "C:\Windows\System32\wscript.exe" C:\Users\admin\AppData\Local\Temp\Rar$DIa2172.908\document7509.vbe +-++ +-++ +-++ +-++ | C:\Windows\System32\wscript.exe | — | wscript.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 | ||||
2496 | "C:\Windows\System32\wscript.exe" C:\Users\admin\AppData\Local\Temp\Rar$DIa2172.908\document7509.vbe +-++ +-++ +-++ +-++ +-++ | C:\Windows\System32\wscript.exe | — | wscript.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 | ||||
2764 | "C:\Windows\System32\wscript.exe" C:\Users\admin\AppData\Local\Temp\Rar$DIa2172.908\document7509.vbe +-++ +-++ +-++ +-++ +-++ +-++ | C:\Windows\System32\wscript.exe | — | wscript.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 | ||||
3640 | "C:\Windows\System32\wscript.exe" C:\Users\admin\AppData\Local\Temp\Rar$DIa2172.908\document7509.vbe +-++ +-++ +-++ +-++ +-++ +-++ +-++ | C:\Windows\System32\wscript.exe | — | wscript.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 | ||||
2412 | "C:\Windows\System32\wscript.exe" C:\Users\admin\AppData\Local\Temp\Rar$DIa2172.908\document7509.vbe +-++ +-++ +-++ +-++ +-++ +-++ +-++ +-++ | C:\Windows\System32\wscript.exe | — | wscript.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2172 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DIa2172.908\document7509.vbe | text | |
MD5:30336D29B1F2841CC73A3983EA3C2990 | SHA256:2CCE3B9828B852840CA239D35E79872AA85D25166A01AB2D701E7F4A7455E039 |