File name: | Install_CutePDF_v30.exe.7z |
Full analysis: | https://app.any.run/tasks/48a11389-3930-4bac-b039-740315966e39 |
Verdict: | Malicious activity |
Analysis date: | August 12, 2022, 18:19:01 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-7z-compressed |
File info: | 7-zip archive data, version 0.4 |
MD5: | 7BA5B9618C531EE0CA3666438E370335 |
SHA1: | 56FF7521F26E2F8C2F5429EEB53348A0B39D0E2B |
SHA256: | 9831403E185DDD5FA0B74F4EA9D684E2F01117115D948E14F52C752ED642BA2E |
SSDEEP: | 768:T8Ouhr0kmTQrVT7Q9foe9X2XxayotTGJ1QwZnU9oM2JNfSgaSRaBitg7fZfNtNAG:TZ5kzrVT7cgaTe1QwZnMzEJb27fZFtu |
.7z | | | 7-Zip compressed archive (v0.4) (57.1) |
---|---|---|
.7z | | | 7-Zip compressed archive (gen) (42.8) |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2972 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Install_CutePDF_v30.exe.7z" | C:\Program Files\WinRAR\WinRAR.exe | Explorer.EXE | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 | ||||
2508 | "C:\Program Files\Notepad++\notepad++.exe" "C:\Users\admin\Desktop\Install_CutePDF_v30.exe" | C:\Program Files\Notepad++\notepad++.exe | Explorer.EXE | |
User: admin Company: Don HO [email protected] Integrity Level: MEDIUM Description: Notepad++ : a free (GNU) source code editor Exit code: 0 Version: 7.91 | ||||
1156 | "C:\Users\admin\Desktop\Install_CutePDF_v30.exe" | C:\Users\admin\Desktop\Install_CutePDF_v30.exe | — | Explorer.EXE |
User: admin Integrity Level: MEDIUM Exit code: 3221226540 | ||||
3224 | "C:\Users\admin\Desktop\Install_CutePDF_v30.exe" | C:\Users\admin\Desktop\Install_CutePDF_v30.exe | Explorer.EXE | |
User: admin Integrity Level: HIGH Exit code: 3221225786 | ||||
2904 | cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\3224724R.cmd" "C:\Users\admin\Desktop\Install_CutePDF_v30.exe" " | C:\Windows\system32\cmd.exe | — | Install_CutePDF_v30.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 3221225786 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
1608 | C:\Windows\system32\cmd.exe /S /D /c" VER " | C:\Windows\system32\cmd.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2380 | FIND "2000" | C:\Windows\system32\find.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Find String (grep) Utility Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2484 | C:\Windows\system32\cmd.exe /S /D /c" VER " | C:\Windows\system32\cmd.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
1524 | FIND "XP" | C:\Windows\system32\find.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Find String (grep) Utility Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
(PID) Process: | (2972) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtBMP |
Value: | |||
(PID) Process: | (2972) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtIcon |
Value: | |||
(PID) Process: | (2972) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (2972) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip | |||
(PID) Process: | (2972) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\Win7-KB3191566-x86.zip | |||
(PID) Process: | (2972) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\Install_CutePDF_v30.exe.7z | |||
(PID) Process: | (2972) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | name |
Value: 120 | |||
(PID) Process: | (2972) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | size |
Value: 80 | |||
(PID) Process: | (2972) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | type |
Value: 120 | |||
(PID) Process: | (2972) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | mtime |
Value: 100 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2508 | notepad++.exe | C:\Users\admin\AppData\Roaming\Notepad++\session.xml | text | |
MD5:ECAF817D97F0A3B93F840FF61C2EE07B | SHA256:7EE6DACDA07C1A39F47B6A0335459418EF7767A13007148EF41E929AF9EEDDD2 | |||
2972 | WinRAR.exe | C:\Users\admin\Desktop\Install_CutePDF_v30.exe | executable | |
MD5:949364A1A85FA921CE80156C787BCDFE | SHA256:71F61AB9F711D0F4C1F322A4313C2737C70916A6B241861AFAE3506CA3A4373C | |||
3224 | Install_CutePDF_v30.exe | C:\Users\admin\AppData\Local\Temp\3224724R.cmd | text | |
MD5:08D642167DCF813786F5A8E4771B2288 | SHA256:BB00B0D3F154B0D4AC0C80B49CC4B97208F24C3EB4B18377EE4FB00DA237B160 | |||
2508 | notepad++.exe | C:\Users\admin\AppData\Roaming\Notepad++\config.xml | xml | |
MD5:75DAF0C838CA0F9DAA89D4074A504E1B | SHA256:97901B6DEF410AA997B0E91A0FD0947EB3A26B7D5C83FD7228FDE04F981AC53C |
Process | Message |
---|---|
notepad++.exe | VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
|
notepad++.exe | VerifyLibrary: certificate revocation checking is disabled
|
notepad++.exe | ED255D9151912E40DF048A56288E969A8D0DAFA3
|
notepad++.exe | VerifyLibrary: C:\Program Files\Notepad++\updater\gup.exe
|
notepad++.exe | VerifyLibrary: certificate revocation checking is disabled
|
notepad++.exe | ED255D9151912E40DF048A56288E969A8D0DAFA3
|
notepad++.exe | VerifyLibrary: C:\Program Files\Notepad++\plugins\Config\nppPluginList.dll
|
notepad++.exe | VerifyLibrary: certificate revocation checking is disabled
|
notepad++.exe | ED255D9151912E40DF048A56288E969A8D0DAFA3
|
notepad++.exe | VerifyLibrary: C:\Program Files\Notepad++\updater\gup.exe
|