File name: | Bustabit Predictor v2.rar |
Full analysis: | https://app.any.run/tasks/0a079168-7d31-4557-88e2-e134b74f58ca |
Verdict: | Malicious activity |
Analysis date: | May 21, 2022, 06:35:30 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-rar |
File info: | RAR archive data, v5 |
MD5: | 1D42AC1FD56D8F206B39EFA1C3E7DB9C |
SHA1: | 5168843280EB0973C297B66EF00CFC6070A317E2 |
SHA256: | 9850BFE5D1BB539E9E0B25351855C1EE8C85D376A623C9A8AACB0F6A51CDAF41 |
SSDEEP: | 1536:Bw2GJP/T42WHCylOb4or5efTOC6QpK3ECg1YqoD7B7Qyw3m/:Bw9pUHCylOb4m5efTOPQpK3E711oDVsg |
.rar | | | RAR compressed archive (v5.0) (61.5) |
---|---|---|
.rar | | | RAR compressed archive (gen) (38.4) |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2856 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Bustabit Predictor v2.rar" | C:\Program Files\WinRAR\WinRAR.exe | Explorer.EXE | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.91.0 Modules
| |||||||||||||||
312 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa2856.9574\Bustabit Predictor v2.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa2856.9574\Bustabit Predictor v2.exe | WinRAR.exe | ||||||||||||
User: admin Company: The Arts Company Integrity Level: MEDIUM Description: LinkedIn Exit code: 0 Version: 2.0.0.0 Modules
| |||||||||||||||
2356 | "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yvYyEUl" /XML "C:\Users\admin\AppData\Local\Temp\tmp7AA0.tmp" | C:\Windows\System32\schtasks.exe | — | Bustabit Predictor v2.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Manages scheduled tasks Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
1256 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Bustabit Predictor v2.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft .NET Services Installation Utility Version: 4.0.30319.34209 built by: FX452RTMGDR Modules
|
(PID) Process: | (2856) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtBMP |
Value: | |||
(PID) Process: | (2856) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtIcon |
Value: | |||
(PID) Process: | (2856) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (2856) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip | |||
(PID) Process: | (2856) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\Win7-KB3191566-x86.zip | |||
(PID) Process: | (2856) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\Bustabit Predictor v2.rar | |||
(PID) Process: | (2856) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | name |
Value: 120 | |||
(PID) Process: | (2856) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | size |
Value: 80 | |||
(PID) Process: | (2856) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | type |
Value: 120 | |||
(PID) Process: | (2856) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | mtime |
Value: 100 |
PID | Process | Filename | Type | |
---|---|---|---|---|
312 | Bustabit Predictor v2.exe | C:\Users\admin\AppData\Local\Temp\tmp7AA0.tmp | xml | |
MD5:B69BED168F3C574443BE1F2F553D9697 | SHA256:6BF4177EC2397A12141ACAF3717F46DD0E72DA1C21B93979D2F02D5C69091687 | |||
312 | Bustabit Predictor v2.exe | C:\Users\admin\AppData\Roaming\yvYyEUl.exe | executable | |
MD5:6B7A01EFE8C0E20331BDF345F60FD1AB | SHA256:DD57D5F3288A4D1DE8E71C2F4D4CF1BD1789A7F62225C67160FDB572E5840199 | |||
1256 | RegSvcs.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Chrome updater.exe | executable | |
MD5:CACACC25DDADEEF052D7F9559E9AF0DB | SHA256:702A898F99FDCF56D29F5A9D4C54794C09880F7B000488A1F9F4C2259E520BEE | |||
2856 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa2856.9574\Bustabit Predictor v2.exe | executable | |
MD5:6B7A01EFE8C0E20331BDF345F60FD1AB | SHA256:DD57D5F3288A4D1DE8E71C2F4D4CF1BD1789A7F62225C67160FDB572E5840199 |