File name: | Mal3$.rar |
Full analysis: | https://app.any.run/tasks/bc7d7722-db22-4fc6-afdc-220d485a52da |
Verdict: | Malicious activity |
Analysis date: | October 20, 2020, 02:06:08 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-rar |
File info: | RAR archive data, v5 |
MD5: | EF2181C3E6B686FFBE308CBC9C4974F6 |
SHA1: | 973FDB6D8EDFF4353AFA3F877260D2D19CC8E9A1 |
SHA256: | A361D02CBDED00DF80272895B681F3677A5427AA2B843CD9D7A9DDD14155E30A |
SSDEEP: | 393216:ViCpCJQw+VNi9aEIs5EvK0rxVuaTZFoWt+8BC/Eveo:wDB909xV9TjLciCqeo |
.rar | | | RAR compressed archive (v5.0) (61.5) |
---|---|---|
.rar | | | RAR compressed archive (gen) (38.4) |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2476 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Mal3$.rar" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
2728 | "C:\Users\admin\Desktop\Hermer Tools\hermer_tools.exe" | C:\Users\admin\Desktop\Hermer Tools\hermer_tools.exe | — | explorer.exe |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
2352 | wmic csproduct get uuid | C:\Windows\System32\Wbem\wmic.exe | — | hermer_tools.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: WMI Commandline Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2372 | C:\Windows\system32\cmd.exe /c cls | C:\Windows\system32\cmd.exe | — | hermer_tools.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2500 | "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe6_ Global\UsGthrCtrlFltPipeMssGthrPipe6 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" | C:\Windows\System32\SearchProtocolHost.exe | — | SearchIndexer.exe |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft Windows Search Protocol Host Version: 7.00.7600.16385 (win7_rtm.090713-1255) | ||||
3652 | "C:\Users\admin\Desktop\Hermer Tools\hermer_tools.exe" | C:\Users\admin\Desktop\Hermer Tools\hermer_tools.exe | — | explorer.exe |
User: admin Integrity Level: MEDIUM | ||||
1104 | wmic csproduct get uuid | C:\Windows\System32\Wbem\wmic.exe | — | hermer_tools.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: WMI Commandline Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2356 | C:\Windows\system32\cmd.exe /c cls | C:\Windows\system32\cmd.exe | — | hermer_tools.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) |
(PID) Process: | (2476) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtBMP |
Value: | |||
(PID) Process: | (2476) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtIcon |
Value: | |||
(PID) Process: | (2476) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\13B\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (2476) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\Mal3$.rar | |||
(PID) Process: | (2476) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | name |
Value: 120 | |||
(PID) Process: | (2476) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | size |
Value: 80 | |||
(PID) Process: | (2476) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | type |
Value: 120 | |||
(PID) Process: | (2476) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | mtime |
Value: 100 | |||
(PID) Process: | (2476) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\DialogEditHistory\ExtrPath |
Operation: | write | Name: | 0 |
Value: C:\Users\admin\Desktop | |||
(PID) Process: | (2500) SearchProtocolHost.exe | Key: | HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\13B\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US |
PID | Process | Filename | Type | |
---|---|---|---|---|
2476 | WinRAR.exe | C:\Users\admin\Desktop\Hermer Tools\lib\asyncio\coroutines.pyc | binary | |
MD5:AA3A7E59126BA53BA8837B3E89030B27 | SHA256:A208EEE21E462604307C098757AA6FF8FD18187D10229899DE269A31068A0C1E | |||
2476 | WinRAR.exe | C:\Users\admin\Desktop\Hermer Tools\lib\asyncio\protocols.pyc | binary | |
MD5:2291DD0A59D1B5045176AA768A962A7E | SHA256:678606E02D3D5F77A376EA86E3738C21D33C043C4380FC6F67A78D5BBFEEA57D | |||
2476 | WinRAR.exe | C:\Users\admin\Desktop\Hermer Tools\lib\asyncio\futures.pyc | binary | |
MD5:272889511FA340758F3F3D04DF75AE72 | SHA256:FA837423D039BF309BAA5F16A151C5391AEAF71E4E78DF09D55A5E5B84B928E7 | |||
2476 | WinRAR.exe | C:\Users\admin\Desktop\Hermer Tools\lib\asyncio\base_futures.pyc | binary | |
MD5:08E500A3D11CB0681EFBB1E9AA2D7FA4 | SHA256:C609635AD7DC56331199A1492215C2C294683680B9FC0137F930DFCB206DEC39 | |||
2476 | WinRAR.exe | C:\Users\admin\Desktop\Hermer Tools\lib\asyncio\base_tasks.pyc | binary | |
MD5:C87FF2E75DE7FA64C92B5CC0AD2F7A94 | SHA256:9E8DF8DFFFD38F55933EAC236883C6F4462024CD62FBFFAFEC81967C8029809E | |||
2476 | WinRAR.exe | C:\Users\admin\Desktop\Hermer Tools\hermer_tools.exe | executable | |
MD5:E3C67A557819679044274A272AF589C5 | SHA256:437D758AF8E34386E0B312A45A15763F541DDCC47C6FF8E8D6FD3596F49888F1 | |||
2476 | WinRAR.exe | C:\Users\admin\Desktop\Hermer Tools\lib\asyncio\base_events.pyc | binary | |
MD5:962198D1EAD870CCEEC4369D614A40E0 | SHA256:4274703D2E8CB79D20BC7248C7D866EEBD5D28239FD26AD71DC279088979A274 | |||
2476 | WinRAR.exe | C:\Users\admin\Desktop\Hermer Tools\lib\asyncio\selector_events.pyc | binary | |
MD5:46AAA59B70D828071139F04BA16F8178 | SHA256:5B546B0803154A1B20294CBD4A2A7AEB6B7CC96A2044872082F8A923937D52CB | |||
2476 | WinRAR.exe | C:\Users\admin\Desktop\Hermer Tools\lib\asyncio\runners.pyc | binary | |
MD5:9306266C0CFEA3842A9575EDBDBB6F8E | SHA256:6F0EBAD6485A576E376601355DC0533F4DDFBDAC8F3BC98626985432F440280E | |||
2476 | WinRAR.exe | C:\Users\admin\Desktop\Hermer Tools\lib\asyncio\base_subprocess.pyc | binary | |
MD5:C4EBBD42108608F4EB07CF03E9624BBC | SHA256:4677B2D27FC038B5BD05E7C0B5847480B1F37524256D082992AF87AEE0150BDE |