File name: | Contract#2648.iso |
Full analysis: | https://app.any.run/tasks/d2845008-620a-40c9-a430-29b3b5b0a2d6 |
Verdict: | Malicious activity |
Analysis date: | October 05, 2022, 00:17:18 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-iso9660-image |
File info: | ISO 9660 CD-ROM filesystem data 'CD_ROM' |
MD5: | 3CA24F6A18CBB56C2E6189ACAD3813B6 |
SHA1: | A274B69F8CFAE8647F0DF4ADF5052CA98ADD9E28 |
SHA256: | 9E66994AB67FAF93AA26E84A2790C5B9516D30E031263CFF076B32BCE9E19EB5 |
SSDEEP: | 24576:jwFOHrwcwjHmvw1urOkVhEs7RK7Jb0y/cT5SLnujfHH:jwFOHrwcwjHmvwcrOYCs7RKb1/cT5SOf |
.iso | | | ISO 9660 CD image (27.6) |
---|---|---|
.atn | | | Photoshop Action (27.1) |
.gmc | | | Game Music Creator Music (6.1) |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2460 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Contract#2648.iso" | C:\Program Files\WinRAR\WinRAR.exe | Explorer.EXE | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.91.0 Modules
| |||||||||||||||
2800 | "C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIa2460.21190\pilgrimsNankeen.vbs" | C:\Windows\System32\WScript.exe | — | WinRAR.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 Modules
| |||||||||||||||
3108 | C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\Rar$DIa2460.21898\scabbyActin.cmd" " | C:\Windows\system32\cmd.exe | — | WinRAR.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 9009 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
3824 | C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\Rar$DIa2460.23469\scabbyActin.cmd" " | C:\Windows\system32\cmd.exe | — | WinRAR.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 9009 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
2528 | "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\Rar$DIa2460.27021\fuss.dat | C:\Windows\system32\rundll32.exe | — | WinRAR.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
|
(PID) Process: | (2460) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtBMP |
Value: | |||
(PID) Process: | (2460) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtIcon |
Value: | |||
(PID) Process: | (2460) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (2460) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip | |||
(PID) Process: | (2460) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\Win7-KB3191566-x86.zip | |||
(PID) Process: | (2460) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\Contract#2648.iso | |||
(PID) Process: | (2460) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | name |
Value: 120 | |||
(PID) Process: | (2460) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | size |
Value: 80 | |||
(PID) Process: | (2460) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | type |
Value: 120 | |||
(PID) Process: | (2460) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | mtime |
Value: 100 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2460 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DIa2460.27021\fuss.dat | executable | |
MD5:A5332F86382D9FA4201FB1D5A7E8C1DA | SHA256:EA28BE72DC6FDA30D9E33A1A805D3DD95B88904804CB806DC39B5129E1BBD3A2 | |||
2460 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DIa2460.21190\pilgrimsNankeen.vbs | text | |
MD5:C74ED96F8C74A0A63BCD142A3A07F45B | SHA256:AF9AFB53186842D71A9EC0A73A05BA6C1753590B29652AD2C882299FD4A8BEE6 | |||
2460 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DIa2460.21898\scabbyActin.cmd | text | |
MD5:B287AC68C87BDAD951EC9184FCAB5641 | SHA256:74227748458051E9FA0B130C04A70B0E2E821338DF4A93EC08F7C7BC885CC7B0 | |||
2460 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DIa2460.23469\scabbyActin.cmd | text | |
MD5:B287AC68C87BDAD951EC9184FCAB5641 | SHA256:74227748458051E9FA0B130C04A70B0E2E821338DF4A93EC08F7C7BC885CC7B0 |