File name: | fffffffffffffffffffffffffffff.7z |
Full analysis: | https://app.any.run/tasks/704fb003-2f7f-47c8-8d36-c23728feeec7 |
Verdict: | Malicious activity |
Analysis date: | August 03, 2024, 11:41:28 |
OS: | Windows 10 Professional (build: 19045, 64 bit) |
Indicators: | |
MIME: | application/x-7z-compressed |
File info: | 7-zip archive data, version 0.4 |
MD5: | F727CB1C363A77583BA80A882D63703D |
SHA1: | 8F878D149FF61144B9224086CE8DBEE032D2E004 |
SHA256: | 86D4984F7252AA4C84BAD7207ADE4230A1FA8FDF2E9CEEA4441997F0543BC676 |
SSDEEP: | 98304:HwhPZbrLlZLdLwnCpf6fNqGMcMYAjgXhsKzakEtEwkYW+XOTeWu73oKuvS5++pD+:Gwud+9rgsrAWbESQmSS0xbK |
.7z | | | 7-Zip compressed archive (v0.4) (57.1) |
---|---|---|
.7z | | | 7-Zip compressed archive (gen) (42.8) |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
6488 | "C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\fffffffffffffffffffffffffffff.7z | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.91.0 Modules
| |||||||||||||||
6812 | C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding | C:\Windows\System32\rundll32.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
6204 | "C:\Users\admin\Desktop\Xtreme Rat v2.7\Xtreme Rat v2.7\Cliente.exe" | C:\Users\admin\Desktop\Xtreme Rat v2.7\Xtreme Rat v2.7\Cliente.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
6236 | "C:\Users\admin\Desktop\Xtreme RAT v2.95\Xtreme RAT v2.9\Cliente.exe" | C:\Users\admin\Desktop\Xtreme RAT v2.95\Xtreme RAT v2.9\Cliente.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
1964 | "C:\Users\admin\Desktop\xtreme rat.v 2.9\xtreme rat\Cliente.exe" | C:\Users\admin\Desktop\xtreme rat.v 2.9\xtreme rat\Cliente.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Version: 2.9 Modules
| |||||||||||||||
7104 | "C:\Users\admin\AppData\Local\Temp\6576807.exe" | C:\Users\admin\AppData\Local\Temp\6576807.exe | — | Cliente.exe | |||||||||||
User: admin Company: NBCripter Integrity Level: MEDIUM Exit code: 3221225785 Version: 1.00.0013 Modules
| |||||||||||||||
6200 | "C:\Users\admin\AppData\Local\Temp\4113995.exe" | C:\Users\admin\AppData\Local\Temp\4113995.exe | — | Cliente.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
6996 | "C:\Users\admin\Desktop\XtremeRAT29\XtremeRAT\Cliente.exe" | C:\Users\admin\Desktop\XtremeRAT29\XtremeRAT\Cliente.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
|
(PID) Process: | (6488) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtBMP |
Value: | |||
(PID) Process: | (6488) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtIcon |
Value: | |||
(PID) Process: | (6488) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip | |||
(PID) Process: | (6488) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
Operation: | write | Name: | 0 |
Value: C:\Users\admin\Desktop\fffffffffffffffffffffffffffff.7z | |||
(PID) Process: | (6488) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | name |
Value: 120 | |||
(PID) Process: | (6488) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | size |
Value: 80 | |||
(PID) Process: | (6488) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | type |
Value: 120 | |||
(PID) Process: | (6488) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | mtime |
Value: 100 | |||
(PID) Process: | (1964) Cliente.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
(PID) Process: | (1964) Cliente.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | IntranetName |
Value: 1 |
PID | Process | Filename | Type | |
---|---|---|---|---|
6488 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa6488.12312\xtreme rat.v 2.9\xtreme rat\skins\Air2_Aero.skn | dbf | |
MD5:0F64D6774ABEB59CAE979398533B8A99 | SHA256:BD54E65EB0AB95918B7BCBB9504E78D5F4332CD1462733E34A56C6090CE7B333 | |||
6488 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa6488.12312\xtreme rat.v 2.9\xtreme rat\skins\2010Blue_Ext.skn | dbf | |
MD5:B0224B4347F6A385C8404A802C2A4662 | SHA256:8DB5AF8E5EEDB6AD4F0CF71232FFE13D37CA1186B7EF32E92A3C70FCD3E2B76B | |||
6488 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa6488.12312\xtreme rat.v 2.9\xtreme rat\Language\default.ini | text | |
MD5:E6AE7B5E7E0BB2D737B1FDCEF56410C3 | SHA256:7046863817CB5EEABABB641CFF1262915B13BB5DEE9BD1B6EA10C51929424956 | |||
6488 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa6488.12312\xtreme rat.v 2.9\xtreme rat\skins\Air_Remix.skn | dbf | |
MD5:34715CF5334957EC8F6191948AAD6021 | SHA256:0A1FBEBFCEF3C02D5B1DE634A7CA01656F61EA321890AD3D2977D10982E1584C | |||
6488 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa6488.12312\xtreme rat.v 2.9\xtreme rat\skins\Air2.skn | dbf | |
MD5:C13E7411530257BEDEDCC829B02429AE | SHA256:24A906C6631A4475CC23B33529FA1BBC908742BEFC83EF2BF1DD984D1F4D8B56 | |||
6488 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa6488.12312\xtreme rat.v 2.9\xtreme rat\skins\2010Blue_Aero.skn | dbf | |
MD5:50903ED4D83B95B36B2007BB5F2C8C5F | SHA256:C77E0F222DBB43484D19F26CED16E293CDB1CDDEAACAB29DDC1DC81ECE75CFC6 | |||
6488 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa6488.12312\Xtreme Rat v2.7\Xtreme Rat v2.7\Language\default.ini | text | |
MD5:4F04A2713B7B7E2E8D2467A0813C5489 | SHA256:78E0BEE9272C5095E28A711BC617686027FE64935B2674077CBC9E24700FF731 | |||
6488 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa6488.12312\xtreme rat.v 2.9\xtreme rat\Settings\settings.ini | text | |
MD5:CF2DCB0F8DCD685089624F995B20FAF0 | SHA256:35962F39D5CCEFB90C783B1A5F6F25A1F61A8147870A5441C64BBC1AC07F7F91 | |||
6488 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa6488.12312\xtreme rat.v 2.9\xtreme rat\skins\Air_Aero.skn | dbf | |
MD5:2BC73F7F9310C41F8FE62E80B1877246 | SHA256:4E4C2E6D5FB317C0B7E9E0525C1B35BA382B6EC3A73FA04A74FAEC35687D087A | |||
6488 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa6488.12312\xtreme rat.v 2.9\xtreme rat\Profiles\samuca.ini | text | |
MD5:D9969D0719B129EA8B7C9A0BF79B82A1 | SHA256:D6861E6AB78F21AD39FE2FD41BB28FFD4DEBC9F41622962CF1770A8A9FA82B05 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2456 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | unknown |
5336 | SearchApp.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | unknown |
6916 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | unknown | — | — | unknown |
6892 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | unknown | — | — | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
4084 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
2388 | RUXIMICS.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
2120 | MoUsoCoreWorker.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
3888 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
5336 | SearchApp.exe | 104.126.37.153:443 | www.bing.com | Akamai International B.V. | DE | unknown |
5336 | SearchApp.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
3260 | svchost.exe | 40.113.110.67:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
2456 | svchost.exe | 20.190.160.14:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | unknown |
Domain | IP | Reputation |
---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
www.bing.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
th.bing.com |
| whitelisted |
fd.api.iris.microsoft.com |
| whitelisted |
arc.msn.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |