File name: | WDATP_File_Sample_7c7cb3ec6aa1aa0d1d8b3b213c85fb510b38a663.zip |
Full analysis: | https://app.any.run/tasks/ca933157-0899-4fbd-a4db-768442f89bc8 |
Verdict: | Malicious activity |
Analysis date: | March 31, 2020, 10:24:47 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | 771E0A62B5D445CAD0225C083EDA309E |
SHA1: | 096ED9ECBF2709C7147DEF1FCC7D9BCF3EBFDC7B |
SHA256: | 853A35447811EFF437188F987B50136643B9A12D38E9062B8E20FD6D093C0C5E |
SSDEEP: | 3072:MKJbgAqvV39dL8nqsmGIR9ssSrXmFVZ997Db3GXorsGtmXR5NwSOvJ0pZM4:MycNNl8nyWrWVZb7nG4rivNLBI4 |
.zip | | | ZIP compressed archive (100) |
---|
ZipRequiredVersion: | 20 |
---|---|
ZipBitFlag: | 0x0001 |
ZipCompression: | Deflated |
ZipModifyDate: | 2020:03:31 10:23:27 |
ZipCRC: | 0x2fd2eb46 |
ZipCompressedSize: | 231431 |
ZipUncompressedSize: | 486912 |
ZipFileName: | NewUI.dll |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
1232 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\WDATP_File_Sample_7c7cb3ec6aa1aa0d1d8b3b213c85fb510b38a663.zip" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 | ||||
440 | "C:\Windows\system32\cmd.exe" | C:\Windows\system32\cmd.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 3221225786 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3516 | regsvr32 NewUI.dll | C:\Windows\system32\regsvr32.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft(C) Register Server Exit code: 4 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
372 | C:\Windows\Explorer.EXE | C:\Windows\explorer.exe | — | — |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2908 | "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\temp\NewUI.dll | C:\Windows\system32\rundll32.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3832 | "C:\Windows\system32\NOTEPAD.EXE" C:\temp\NewUI.dll | C:\Windows\system32\NOTEPAD.EXE | — | rundll32.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Notepad Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
1232 | WinRAR.exe | C:\temp | — | |
MD5:— | SHA256:— | |||
372 | explorer.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\temp.lnk | lnk | |
MD5:5839387771181608C5B90D7B6C39A54A | SHA256:9438DD8E18A0325DC228C5B421AD6D3ACE4D99188E0EE4672B779B151E3EAA29 | |||
372 | explorer.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\1b4dd67f29cb1962.automaticDestinations-ms | automaticdestinations-ms | |
MD5:4BB44528130F296992FE006C44409BF9 | SHA256:1DEECB959BAA3387800392DF45A8D48B863A3A2FEBCF607BF318C91D81CE8A4B | |||
372 | explorer.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\NewUI.dll.lnk | lnk | |
MD5:EA48F011ECAF61D020D9E6F13422F3AF | SHA256:D6E155D8EF885BABAB60DCE64A1B1BF1B089D8B506F7C796ED9D6DEB936AA497 | |||
372 | explorer.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\918e0ecb43d17e23.automaticDestinations-ms | automaticdestinations-ms | |
MD5:8F49ED8A229CC818BC2CB7E1FCEAD8BE | SHA256:8B05ABC97C2633F14A5354926CC6F1880710F69D73B04E54D72C1F8341CEF78B | |||
1232 | WinRAR.exe | C:\temp\NewUI.dll | executable | |
MD5:69AE2C900632AF2437786C7D65504667 | SHA256:05F85FF76F8BB96424C0DF7378661C3C1349F0DE393AC7FF9C87B2779366C1D6 |